fullcourtdefense-cli 1.38.0 → 1.39.0

package/dist/askDialog.d.ts

@@ -15,7 +15,9 @@
  *
  * and answers the IDE `allow` or `deny`. The IDE's own card is the fallback only
  * where no dialog is possible (no display, dialog binary missing) or where the
- * org chose it (`FCD_ASK_CHANNEL=ide`). The envelope never reaches the IDE.
+ * org chose it (`FCD_ASK_CHANNEL=ide`) — and never for a client that reports a
+ * permission mode in which it may answer its own card (v139 F-13 / F-33): our
+ * dialog asks there, or the action is denied. The envelope never reaches the IDE.
  *
  * Deterministic all the way: the rule that asked is named in the envelope, the
  * grant is bound to that rule's hash, and nothing here re-evaluates the action.
@@ -67,8 +69,20 @@ export interface AskEnvelope {
         instanceId?: string;
         attemptId?: string;
     };
+    /**
+     * The permission mode the asking client reported (Claude Code `permission_mode`).
+     * A mode in which the IDE may answer its own card (`idePromptState` = auto) never
+     * gets the question: our dialog asks, or the action is denied. Absent: the client
+     * does not say (Cursor, VS Code, Copilot CLI) or an older hook build.
+     */
+    ideMode?: string;
 }
-export type AskResolution = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'ide';
+/**
+ * How an ask ended in the per-event process. `ide`: handed to the IDE's own card.
+ * `ide_auto`: no FullCourtDefense dialog was possible and the IDE runs in a mode that
+ * may answer its own card — denied, never handed over.
+ */
+export type AskResolution = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'ide' | 'ide_auto';
 export interface HookVerdict {
     stdout: string;
     stderr: string;
@@ -92,12 +106,19 @@ export declare function takeAskEnvelope(stdout: string): {
  * Last step of the per-event hook process (full and slim entries alike): an `ask`
  * verdict is put to the developer in the FullCourtDefense dialog and becomes the
  * IDE's allow / deny; anything else — and an ask where no dialog is possible — is
- * written as-is with the envelope removed. Then the process exits.
+ * written as-is with the envelope removed (an ask the IDE may answer on its own is
+ * denied instead, v139 F-13). Then the process exits.
  */
 export declare function emitVerdictForIde(args: {
     event?: string;
     agentClient?: string;
 }, result: HookVerdict, entry: 'ipc' | 'local' | 'slim-ipc' | 'slim-local'): Promise<never>;
+/**
+ * The verdict when the dialog step itself failed (emitVerdictForIde's catch): the dialog
+ * step must never break the verdict, so the IDE ask goes out with the envelope stripped —
+ * or, where the IDE may answer its own card, a deny (v139 F-13). Never throws.
+ */
+export declare function verdictAfterDialogError(result: HookVerdict, clientLabel?: string): HookVerdict;
 /**
  * Resolve an `ask` verdict with the developer. Returns the verdict to hand to the
  * IDE (envelope removed) and how it was resolved. Any verdict without an envelope,

package/dist/askDialog.js

@@ -5,6 +5,7 @@ exports.askChannel = askChannel;
 exports.attachAskEnvelope = attachAskEnvelope;
 exports.takeAskEnvelope = takeAskEnvelope;
 exports.emitVerdictForIde = emitVerdictForIde;
+exports.verdictAfterDialogError = verdictAfterDialogError;
 exports.resolveAskWithDialog = resolveAskWithDialog;
 /**
  * The developer's question, answered in OUR dialog — one flow for every IDE.
@@ -23,7 +24,9 @@ exports.resolveAskWithDialog = resolveAskWithDialog;
  *
  * and answers the IDE `allow` or `deny`. The IDE's own card is the fallback only
  * where no dialog is possible (no display, dialog binary missing) or where the
- * org chose it (`FCD_ASK_CHANNEL=ide`). The envelope never reaches the IDE.
+ * org chose it (`FCD_ASK_CHANNEL=ide`) — and never for a client that reports a
+ * permission mode in which it may answer its own card (v139 F-13 / F-33): our
+ * dialog asks there, or the action is denied. The envelope never reaches the IDE.
  *
  * Deterministic all the way: the rule that asked is named in the envelope, the
  * grant is bound to that rule's hash, and nothing here re-evaluates the action.
@@ -97,7 +100,8 @@ function rewriteDecision(decision, allowed, userMsg, agentMsg) {
  * Last step of the per-event hook process (full and slim entries alike): an `ask`
  * verdict is put to the developer in the FullCourtDefense dialog and becomes the
  * IDE's allow / deny; anything else — and an ask where no dialog is possible — is
- * written as-is with the envelope removed. Then the process exits.
+ * written as-is with the envelope removed (an ask the IDE may answer on its own is
+ * denied instead, v139 F-13). Then the process exits.
  */
 async function emitVerdictForIde(args, result, entry) {
     // This process ends with the verdict below: an upload the dialog's outcome
@@ -119,9 +123,8 @@ async function emitVerdictForIde(args, result, entry) {
         final = resolved;
     }
     catch (err) {
-        // The dialog step must never break the verdict: fall back to the IDE ask (envelope stripped).
         (0, hookIo_1.dbg)({ phase: 'ask_dialog_error', event: args.event, entry, error: err instanceof Error ? err.message : String(err) });
-        final = { ...result, stdout: takeAskEnvelope(result.stdout).stdout };
+        final = verdictAfterDialogError(result, args.agentClient);
     }
     if (final.stderr) {
         try {
@@ -137,6 +140,22 @@ async function emitVerdictForIde(args, result, entry) {
     }
     return process.exit(final.exitCode);
 }
+/**
+ * The verdict when the dialog step itself failed (emitVerdictForIde's catch): the dialog
+ * step must never break the verdict, so the IDE ask goes out with the envelope stripped —
+ * or, where the IDE may answer its own card, a deny (v139 F-13). Never throws.
+ */
+function verdictAfterDialogError(result, clientLabel) {
+    const taken = takeAskEnvelope(result.stdout);
+    let final = { ...result, stdout: taken.stdout };
+    try {
+        if (taken.decision && taken.envelope && decisionAsks(taken.decision) && (0, devConfirm_1.idePromptState)(taken.envelope.ideMode) === 'auto') {
+            final = denyNoHumanPrompt({ ...final, envelope: taken.envelope }, taken.decision, taken.envelope, clientLabel);
+        }
+    }
+    catch { /* the verdict must still be written */ }
+    return final;
+}
 /**
  * Resolve an `ask` verdict with the developer. Returns the verdict to hand to the
  * IDE (envelope removed) and how it was resolved. Any verdict without an envelope,
@@ -155,8 +174,18 @@ async function resolveAskWithDialog(verdict, options = {}) {
     // left for a person to read and answer: the IDE's own ask card takes the
     // question instead, so the hook still answers inside the IDE's window.
     const dialogTimeoutMs = Math.min(options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, options.deadlineAt === undefined ? Number.POSITIVE_INFINITY : options.deadlineAt - Date.now());
-    if (askChannel() === 'ide' || !canAsk || dialogTimeoutMs < MIN_DIALOG_TIMEOUT_MS)
-        return { ...clean, resolution: 'ide' };
+    // v139 F-13 / F-33: the IDE's card is a channel only where it can reach a person. A
+    // client that reports a mode in which it may answer its own card (Claude Code
+    // bypassPermissions, acceptEdits, auto, dontAsk) never gets the question, whatever
+    // FCD_ASK_CHANNEL / FCD_HOOK_IDE_TIMEOUT_MS say (both reachable from an IDE settings
+    // env block the agent can write): our dialog asks, or — no dialog possible here — the
+    // action is denied. A client that does not say keeps today's routing; its card's
+    // answer is recorded as unverified and never becomes memory (settlePostExecution).
+    const ideMayAnswerItself = (0, devConfirm_1.idePromptState)(envelope.ideMode) === 'auto';
+    const dialogPossible = canAsk && dialogTimeoutMs >= MIN_DIALOG_TIMEOUT_MS;
+    if (!dialogPossible || (askChannel() === 'ide' && !ideMayAnswerItself)) {
+        return ideMayAnswerItself ? denyNoHumanPrompt(clean, decision, envelope, options.clientLabel) : { ...clean, resolution: 'ide' };
+    }
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
     const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits) && (0, devConfirm_1.grantOffered)(envelope.scope);
@@ -187,7 +216,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         outcome = 'unavailable';
     }
     if (outcome === 'unavailable')
-        return { ...clean, resolution: 'ide' };
+        return ideMayAnswerItself ? denyNoHumanPrompt(clean, decision, envelope, options.clientLabel) : { ...clean, resolution: 'ide' };
     const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
     // The outcome is the asking call's: its client and identity, not this process's.
     // No latency / verdict path: the ask itself recorded the hook's wait (one health
@@ -253,6 +282,44 @@ async function resolveAskWithDialog(verdict, options = {}) {
         : `FullCourtDefense: the developer denied this ${envelope.event} in the confirmation dialog. Do not retry or work around it.`;
     return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, false, userMsg, agentMsg)), exitCode: 0, resolution: outcome };
 }
+/**
+ * v139 F-13: the ask cannot reach a person — no FullCourtDefense dialog is possible here
+ * and the IDE runs in a mode that may answer its own card (or refuse it unseen). Denied
+ * with an honest record (nobody answered), and the pending marker is dropped so no later
+ * post-execution hook can settle it.
+ */
+function denyNoHumanPrompt(clean, decision, envelope, clientLabel) {
+    try {
+        (0, devConfirm_1.rejectDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
+    }
+    catch { /* the deny below still stands */ }
+    const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
+    const agentClient = envelope.agentClient || clientLabel;
+    const client = agentClient || 'the agent';
+    const mode = envelope.ideMode || 'auto-approve';
+    try {
+        (0, telemetry_1.spoolEvent)({
+            decision: 'block',
+            toolName: envelope.toolName,
+            operation: envelope.operation,
+            // The gateway's "confirmation not possible" family: nobody could be asked, which the
+            // fleet keeps as a block alert (backend fleet-block-alerts.ts), unlike a dialog timeout.
+            reason: `developer confirmation not possible (the FullCourtDefense dialog cannot be shown here and ${client} runs in "${mode}" mode, which may answer its own prompt without showing it to a person) — denied${policyLabel}`,
+            ruleId: envelope.policyId,
+            policyHash: envelope.policyHash,
+            approvalScope: 'developer',
+            // Nobody answered: not a rule's block and not a person's deny.
+            askOutcome: 'unanswered',
+            ...(agentClient ? { agentClient } : {}),
+            ...envelopeIdentity(envelope),
+        });
+        (0, telemetry_1.triggerFlush)(true);
+    }
+    catch { /* the deny below still stands */ }
+    const userMsg = `FullCourtDefense stopped this ${envelope.event}: a rule asks you to confirm it${policyLabel}, but ${client} is in "${mode}" mode, which may approve its own prompts without showing them to you, and the FullCourtDefense dialog cannot be shown here. Switch the agent to a mode that asks you, or run it where the FullCourtDefense dialog can appear, to be asked.`;
+    const agentMsg = `${userMsg} Do not retry or work around it.`;
+    return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, false, userMsg, agentMsg)), exitCode: 0, resolution: 'ide_auto' };
+}
 /** The asking call's identity from the envelope: well-formed parts only. */
 function envelopeIdentity(envelope) {
     const raw = envelope.identity;