fix(ai-hook): say when an MCP tool call was not checked against policy

[amascia-gg]

Context

send_mcp_activity() returned MCPActivityResponse(allowed=True, reason="") on every failure path — byte-identical to a genuine policy approval. A timeout, a 500, a malformed response, or a bug in parse_mcp_activity all permitted the MCP tool call, and the caller had no way to tell them from "the API said yes".

So an unreachable policy endpoint silently allows every MCP tool call. Same class of invisible fail-open as #1375 (heredoc scans abandoned) and #1378 (keychain write-probe).

What has been done

send_mcp_activity() now returns Optional[MCPActivityResponse], where None means "no answer obtained". The caller fails open with a warning, reusing what the secret scan already does when it cannot scan (HookResult.allow_with_warning → systemMessage).

Behaviour stays fail-open — a network blip must never block a tool call. The change is visibility, not denial.

Three related fixes on the way through:

• The "not an MCP pre-tool-use" early return stays a genuine, silent allow. Warning there would fire on every Read, Bash and Edit call.
• refresh_and_maybe_submit_discovery() moves inside the try block. It walks the filesystem and calls the API, so it fails for the same reasons the request does. Outside, its failures bypassed the MCP fail-open and surfaced as the generic "could not scan for secrets" warning — the wrong message, since the scan itself was fine.
• The bare except Exception is split: an expected RequestException logs at debug, anything else at warning, so a bug is findable instead of looking like a network blip.

One bug found while wiring it up: _scan_payloads() only returns a result for a blocking payload and otherwise builds a fresh HookResult.allow(), which dropped the warning. It now collects non-blocking warnings and attaches them to the final allow.

Validation

• pytest tests/unit → 2603 passed, 4 skipped
• 7 new tests: API error / network error / unexpected error / discovery failure all yield no answer; a non-MCP payload stays a silent allow; a real allow warns about nothing; and the warning survives _scan_payloads
• Revert check: with the source reverted and the tests kept, 4 of the new tests fail — so they catch the regression rather than restating the code
• black / isort / flake8 clean

Not covered: the Rust ai-hook port (#1381) does not implement MCP policy at all, so this widens the Python/Rust behavioural gap. The equivalence harness has no MCP cases yet — tracked separately.

PR check list

• Tests included
• Changelog entry (changelog.d/)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.03%. Comparing base (8d7e53d) to head (0663812).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1391   +/-   ##
=======================================
  Coverage   94.02%   94.03%           
=======================================
  Files         199      199           
  Lines       12286    12304   +18     
=======================================
+ Hits        11552    11570   +18     
  Misses        734      734           

Flag	Coverage Δ
unittests	94.03% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.