Context
From PR #115 review. When confirmViaElicitation returns !elicit.proceed (user declined or client doesn't support elicitation), the tool handler returns early before registry.dispatch(), so denied writes are never audited.
Files
src/tools/harness-create.ts (line 62-63)src/tools/harness-update.tssrc/tools/harness-execute.tssrc/tools/harness-delete.ts
Proposed fix
Emit an audit event with status: "denied" and the confirmation: "blocked" | "declined" method before returning the error result. This gives operators visibility into rejected operations.
Priority
Medium — improves audit completeness but no security risk (the operation never executed).
Context
From PR #115 review. When
confirmViaElicitationreturns!elicit.proceed(user declined or client doesn't support elicitation), the tool handler returns early beforeregistry.dispatch(), so denied writes are never audited.Files
src/tools/harness-create.ts(line 62-63)src/tools/harness-update.tssrc/tools/harness-execute.tssrc/tools/harness-delete.tsProposed fix
Emit an audit event with
status: "denied"and theconfirmation: "blocked" | "declined"method before returning the error result. This gives operators visibility into rejected operations.Priority
Medium — improves audit completeness but no security risk (the operation never executed).