fullcourtdefense-cli 1.11.0 → 1.14.0

package/dist/commands/cmdGuard.js

@@ -60,12 +60,33 @@ const AUTORUN_BAT_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-autorun.
 const CMD_AUTORUN_KEY = 'HKCU\\Software\\Microsoft\\Command Processor';
 const AUTORUN_VALUE = 'AutoRun';
 const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
-/** cmd builtins / exes we intercept via doskey (first token of the typed line). */
+/**
+ * cmd builtins / exes we intercept via doskey (first token of the typed line).
+ *
+ * cmd.exe has NO general pre-execution hook (unlike PowerShell PSReadLine or the
+ * zsh/bash whole-line hooks), so coverage here is by enumeration: every command
+ * name that anchors a dangerous rule must be listed or its rule can never fire in
+ * interactive cmd. This is the known residual gap — a command whose leading name
+ * is not below runs unchecked. Keep in sync with the builtin rule command anchors
+ * in shellGuard.ts. Only leading-token names matter (doskey is first-token only),
+ * so pipes/`&&` chains where the dangerous command is not first are NOT caught by
+ * cmd (they ARE under PowerShell/zsh/bash and `shell-guard-check`).
+ */
 const INTERCEPTED_COMMANDS = [
-    'del', 'erase', 'rd', 'rmdir', 'format',
-    'curl', 'wget', 'powershell', 'pwsh',
-    'terraform', 'kubectl', 'aws', 'gcloud', 'az',
-    'vssadmin', 'certutil', 'bitsadmin', 'reg', 'net', 'sc',
+    // Destructive filesystem / disk
+    'del', 'erase', 'rd', 'rmdir', 'format', 'cipher', 'diskpart', 'fsutil',
+    'robocopy', 'xcopy', 'takeown', 'icacls', 'attrib', 'compact',
+    // Backup / recovery / shadow-copy tampering (ransomware patterns)
+    'vssadmin', 'wbadmin', 'bcdedit', 'wevtutil',
+    // Interpreters / download-and-exec vectors
+    'powershell', 'pwsh', 'curl', 'wget', 'certutil', 'bitsadmin', 'mshta',
+    'rundll32', 'regsvr32', 'wscript', 'cscript', 'wmic', 'wsl',
+    // Service / firewall / registry / accounts
+    'reg', 'net', 'net1', 'sc', 'netsh', 'schtasks', 'taskkill',
+    // Infra / cloud CLIs
+    'terraform', 'pulumi', 'kubectl', 'aws', 'gcloud', 'az', 'docker',
+    // VCS + database clients
+    'git', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
 ];
 function regString(key, value) {
     try {
@@ -95,15 +116,15 @@ function buildGuardJs(nodePath, cliEntry) {
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
         `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();for(const r of rules){try{if(r.re.test(n)||r.re.test(line))return r;}catch{}}return null;}`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
+        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
         `const line=args.join(' ');const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)delegate(args);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block - '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');delegate(args);}`,
-        `console.error('[FullCourtDefense] BLOCKED: '+hit.reason+' (rule '+hit.id+')');`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');delegate(args);}`,
+        `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(1);`,
         ``,

package/dist/commands/installAll.d.ts

@@ -13,6 +13,7 @@ export interface InstallAllArgs extends ProtectAllArgs {
     windowsAudit?: string;
     shellGuard?: string;
     cmdGuard?: string;
+    posixGuard?: string;
 }
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor

package/dist/commands/installAll.js

@@ -12,6 +12,7 @@ const restartNotice_1 = require("./restartNotice");
 const windowsAudit_1 = require("./windowsAudit");
 const shellGuard_1 = require("./shellGuard");
 const cmdGuard_1 = require("./cmdGuard");
+const posixShellGuard_1 = require("./posixShellGuard");
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor
  * hooks for built-in Cursor actions, optional self-heal and fleet upload.
@@ -117,6 +118,18 @@ async function installAllCommand(args, config) {
             console.log(`\x1b[33m⚠ Warning: cmd guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
         }
     }
+    // Interactive macOS/Linux guard — same rules, zsh accept-line widget + bash
+    // function wrappers, from the local cache (no admin, no network hot path).
+    // Gated to darwin/linux so Windows install-all behavior is unchanged.
+    if ((process.platform === 'darwin' || process.platform === 'linux') && args.posixGuard !== 'false') {
+        console.log('\n\x1b[1mInstalling interactive shell guard (bash + zsh)…\x1b[0m');
+        try {
+            await (0, posixShellGuard_1.installPosixShellGuardCommand)();
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: shell guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
     if (args.autoProtect === 'true') {
         console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
         await (0, autoProtect_1.autoProtectCommand)({

package/dist/commands/posixShellGuard.d.ts

@@ -0,0 +1,26 @@
+export interface PosixShellGuardStatus {
+    supported: boolean;
+    installed: boolean;
+    rcFiles: Array<{
+        shell: string;
+        rcPath: string;
+        installed: boolean;
+    }>;
+    rulesPresent: boolean;
+    ruleCount?: number;
+    mode?: string;
+}
+/** Read-only probe. Never throws. */
+export declare function getPosixShellGuardStatus(): PosixShellGuardStatus;
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+export declare function isPosixShellGuardInstalled(): boolean;
+export interface InstallPosixShellGuardArgs {
+    /** 'false' to write the guard scripts + rules without wiring rc files. */
+    profiles?: string;
+}
+/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+export declare function installPosixShellGuardCommand(args?: InstallPosixShellGuardArgs): Promise<void>;
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+export declare function uninstallPosixShellGuardCommand(): Promise<void>;
+/** Refresh the shared rules JSON when the POSIX guard is installed. Never throws. */
+export declare function refreshPosixShellGuardRules(): void;

package/dist/commands/posixShellGuard.js

@@ -0,0 +1,393 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPosixShellGuardStatus = getPosixShellGuardStatus;
+exports.isPosixShellGuardInstalled = isPosixShellGuardInstalled;
+exports.installPosixShellGuardCommand = installPosixShellGuardCommand;
+exports.uninstallPosixShellGuardCommand = uninstallPosixShellGuardCommand;
+exports.refreshPosixShellGuardRules = refreshPosixShellGuardRules;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const shellGuard_1 = require("./shellGuard");
+/**
+ * Interactive macOS/Linux shell guard — real-time blocking of dangerous commands
+ * TYPED by a human into bash or zsh (inside or outside the IDE).
+ *
+ * Shares the exact ruleset the PowerShell/cmd guards use (writeShellGuardRules):
+ * the deterministic dangerous-command families + the org's cached custom blocks +
+ * the Shield mode (block vs monitor). One dashboard toggle disables a rule
+ * everywhere.
+ *
+ * Two hook mechanisms, one shared Node checker (~/.fullcourtdefense-posix-guard.js).
+ * Both are COMMAND-AGNOSTIC — they inspect the WHOLE typed line against every
+ * rule, so any command in any position is covered (not a fixed watchlist of
+ * names). Each shell gets its OWN sourced file (never cross-parsed — zsh-only
+ * expansions would otherwise break bash at source time):
+ *   - zsh (macOS default), ~/.fullcourtdefense-shell-guard.zsh: a ZLE
+ *     `accept-line` widget inspects the whole typed line before it runs (catches
+ *     pipes, e.g. `curl … | sh`, and chained `foo && rm -rf /`). Block mode → the
+ *     line is not accepted (never executes); monitor → warning + the line runs.
+ *     Analogous to the PowerShell PSReadLine hook.
+ *   - bash, ~/.fullcourtdefense-shell-guard.bash: a `DEBUG`-trap preexec hook
+ *     (bash-preexec style) reads the full command line from history right before
+ *     it runs and, with `extdebug`, skips it on an explicit block (checker exit
+ *     97). Whole-line, command-agnostic — the bash analogue of zsh's accept-line.
+ *
+ * Cost of whole-line coverage: the Node checker runs once per typed command. Off
+ * with `export FCD_SHELL_GUARD=off`. Benign lines exit the checker in ~1ms after
+ * regex matching; the only real overhead is Node startup per command.
+ *
+ * Safety: every layer fails OPEN. If the checker is missing or errors, the command
+ * runs — a guard bug must never brick a developer's shell. Only an explicit block
+ * (checker exit code 97) stops a command. Disable for a session with
+ * `export FCD_SHELL_GUARD=off`.
+ *
+ * Rules/mode refresh opportunistically on every telemetry flush (offline caches
+ * only — never blocks a shell). Blocks are spooled and reported to the fleet
+ * dashboard as `shell_terminal` events.
+ */
+const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
+const GUARD_JS_PATH = path.join(os.homedir(), '.fullcourtdefense-posix-guard.js');
+const GUARD_ZSH_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.zsh');
+const GUARD_BASH_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.bash');
+const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
+const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
+const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
+const BLOCK_CODE = 97;
+function isPosixPlatform() {
+    return process.platform === 'darwin' || process.platform === 'linux';
+}
+function shSingleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** The shared Node checker: exits 97 on a confirmed block, 0 otherwise (fail-open). */
+function buildGuardJs(nodePath, cliEntry) {
+    return [
+        `'use strict';`,
+        `const fs=require('fs');const crypto=require('crypto');const{spawn}=require('child_process');`,
+        `const RULES_PATH=${JSON.stringify(GUARD_RULES_PATH)};`,
+        `const SPOOL_PATH=${JSON.stringify(SPOOL_PATH)};`,
+        `const NODE_PATH=${JSON.stringify(nodePath)};`,
+        `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
+        `const BLOCK_CODE=${BLOCK_CODE};`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();for(const r of rules){try{if(r.re.test(n)||r.re.test(line))return r;}catch{}}return null;}`,
+        `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
+        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
+        `if(!line.trim())process.exit(0);`,
+        `if(process.env.FCD_SHELL_GUARD==='off')process.exit(0);`,
+        `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
+        `if(!hit)process.exit(0);`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');process.exit(0);}`,
+        `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
+        `console.error('This command was not executed. Reported to your security dashboard.');`,
+        `spoolEvent(hit,line,'block');process.exit(BLOCK_CODE);`,
+        ``,
+    ].join('\n');
+}
+/** zsh guard — sourced ONLY from .zshrc (contains zsh-specific ZLE syntax). */
+function buildGuardZsh(nodePath) {
+    return [
+        `# FullCourtDefense interactive shell guard for zsh (installed by fullcourtdefense-cli).`,
+        `# Disable for one session:  export FCD_SHELL_GUARD=off`,
+        `# Remove permanently:       fullcourtdefense uninstall-shell-guard`,
+        ``,
+        `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
+        ``,
+        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
+        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        ``,
+        `# Inspect the WHOLE typed line against every rule before accepting it`,
+        `# (command-agnostic: catches any command, pipes, and chained segments).`,
+        `__fcd_zle_accept_line() {`,
+        `  emulate -L zsh`,
+        `  local __fcd_line=$BUFFER`,
+        `  if [[ -n "$__fcd_line" && "\${FCD_SHELL_GUARD:-}" != "off" && -x "$FCD_GUARD_NODE" && -f "$FCD_GUARD_JS" ]]; then`,
+        `    local __fcd_out`,
+        `    __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `    local __fcd_rc=$?`,
+        `    if [[ $__fcd_rc -eq 97 ]]; then`,
+        `      zle -M -- "$__fcd_out"`,
+        `      return`,
+        `    fi`,
+        `    [[ -n "$__fcd_out" ]] && print -u2 -r -- "$__fcd_out"`,
+        `  fi`,
+        `  zle .accept-line`,
+        `}`,
+        `if [[ "\${FCD_SHELL_GUARD:-}" != "off" ]] && zle -l >/dev/null 2>&1; then`,
+        `  zle -N accept-line __fcd_zle_accept_line`,
+        `fi`,
+        ``,
+    ].join('\n');
+}
+/**
+ * bash guard — sourced ONLY from .bashrc/.bash_profile (pure bash syntax).
+ *
+ * Command-agnostic whole-line hook via a DEBUG trap (bash-preexec style). The
+ * trap fires before each command; it reads the FULL interactive line the user
+ * typed from `history` (so pipelines like `curl … | sh` and chained lines like
+ * `foo && rm -rf /` are evaluated as one string, exactly like zsh's accept-line
+ * BUFFER — not per-simple-command). It de-duplicates so the checker runs once
+ * per typed line. With `extdebug` enabled, returning 1 from the DEBUG trap
+ * SKIPS the command — so an explicit block (checker exit 97) prevents execution.
+ * A missing/erroring checker returns 0 → the command runs (fail open).
+ */
+function buildGuardBash(nodePath) {
+    return [
+        `# FullCourtDefense interactive shell guard for bash (installed by fullcourtdefense-cli).`,
+        `# Disable for one session:  export FCD_SHELL_GUARD=off`,
+        `# Remove permanently:       fullcourtdefense uninstall-shell-guard`,
+        ``,
+        `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
+        ``,
+        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
+        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        `__fcd_last_line=""`,
+        ``,
+        `# Run the shared checker on one full line. Returns 1 to cancel (extdebug).`,
+        `__fcd_check_line() {`,
+        `  local __fcd_line="$1"`,
+        `  [ -z "$__fcd_line" ] && return 0`,
+        `  [ "\${FCD_SHELL_GUARD:-}" = "off" ] && return 0`,
+        `  if [ ! -x "$FCD_GUARD_NODE" ] || [ ! -f "$FCD_GUARD_JS" ]; then return 0; fi`,
+        `  local __fcd_out __fcd_rc`,
+        `  __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `  __fcd_rc=$?`,
+        `  [ -n "$__fcd_out" ] && printf '%s\\n' "$__fcd_out" >&2`,
+        `  [ "$__fcd_rc" -eq 97 ] && return 1`,
+        `  return 0`,
+        `}`,
+        ``,
+        `# DEBUG trap: skip completions and the guard functions, then read the whole`,
+        `# typed line from history (number stripped) and check it once per line.`,
+        `__fcd_debug_trap() {`,
+        `  [ -n "\${COMP_LINE:-}" ] && return 0`,
+        `  case "$BASH_COMMAND" in __fcd_*|__fcd_debug_trap) return 0 ;; esac`,
+        `  local __fcd_hist __fcd_num __fcd_line HISTTIMEFORMAT=`,
+        `  __fcd_hist=$(builtin history 1 2>/dev/null)`,
+        `  read -r __fcd_num __fcd_line <<< "$__fcd_hist"`,
+        `  [ -z "$__fcd_line" ] && return 0`,
+        `  if [ "$__fcd_line" != "$__fcd_last_line" ]; then`,
+        `    __fcd_last_line="$__fcd_line"`,
+        `    __fcd_check_line "$__fcd_line" || return 1`,
+        `  fi`,
+        `  return 0`,
+        `}`,
+        `if [ "\${FCD_SHELL_GUARD:-}" != "off" ]; then`,
+        `  shopt -s extdebug 2>/dev/null || true`,
+        `  trap '__fcd_debug_trap' DEBUG`,
+        `fi`,
+        ``,
+    ].join('\n');
+}
+/** rc files we wire the guard into. .bash_profile only when it already exists. */
+function resolveRcTargets() {
+    const home = os.homedir();
+    const out = [
+        { shell: 'zsh', rcPath: path.join(home, '.zshrc'), guardPath: GUARD_ZSH_PATH },
+        { shell: 'bash', rcPath: path.join(home, '.bashrc'), guardPath: GUARD_BASH_PATH },
+    ];
+    const bashProfile = path.join(home, '.bash_profile');
+    if (fs.existsSync(bashProfile))
+        out.push({ shell: 'bash', rcPath: bashProfile, guardPath: GUARD_BASH_PATH });
+    return out;
+}
+function rcSnippet(guardPath) {
+    return [
+        MARKER_START,
+        `# Loads the FullCourtDefense dangerous-command guard for interactive sessions.`,
+        `[ -f ${shSingleQuote(guardPath)} ] && . ${shSingleQuote(guardPath)}`,
+        MARKER_END,
+    ].join('\n');
+}
+function addSnippetToRc(target) {
+    fs.mkdirSync(path.dirname(target.rcPath), { recursive: true });
+    let content = '';
+    try {
+        content = fs.readFileSync(target.rcPath, 'utf8');
+    }
+    catch { /* new rc */ }
+    if (content.includes(MARKER_START))
+        return 'already';
+    const sep = content && !content.endsWith('\n') ? '\n\n' : content ? '\n' : '';
+    fs.writeFileSync(target.rcPath, content + sep + rcSnippet(target.guardPath) + '\n', 'utf8');
+    return 'installed';
+}
+function removeSnippetFromRc(rcPath) {
+    try {
+        const content = fs.readFileSync(rcPath, 'utf8');
+        const start = content.indexOf(MARKER_START);
+        const end = content.indexOf(MARKER_END);
+        if (start === -1 || end === -1)
+            return false;
+        const cleaned = (content.slice(0, start) + content.slice(end + MARKER_END.length)).replace(/\n{3,}/g, '\n\n');
+        fs.writeFileSync(rcPath, cleaned, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read-only probe. Never throws. */
+function getPosixShellGuardStatus() {
+    if (!isPosixPlatform()) {
+        return { supported: false, installed: false, rcFiles: [], rulesPresent: false };
+    }
+    try {
+        const rcFiles = resolveRcTargets().map(entry => {
+            let installed = false;
+            try {
+                installed = fs.readFileSync(entry.rcPath, 'utf8').includes(MARKER_START);
+            }
+            catch { /* no rc */ }
+            return { shell: entry.shell, rcPath: entry.rcPath, installed };
+        });
+        let ruleCount;
+        let mode;
+        let rulesPresent = false;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(GUARD_RULES_PATH, 'utf8'));
+            rulesPresent = Array.isArray(parsed?.rules) && parsed.rules.length > 0;
+            ruleCount = Array.isArray(parsed?.rules) ? parsed.rules.length : undefined;
+            mode = typeof parsed?.mode === 'string' ? parsed.mode : undefined;
+        }
+        catch { /* not written yet */ }
+        return {
+            supported: true,
+            installed: rcFiles.some(r => r.installed) && (fs.existsSync(GUARD_ZSH_PATH) || fs.existsSync(GUARD_BASH_PATH)),
+            rcFiles,
+            rulesPresent,
+            ruleCount,
+            mode,
+        };
+    }
+    catch {
+        return { supported: true, installed: false, rcFiles: [], rulesPresent: false };
+    }
+}
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+function isPosixShellGuardInstalled() {
+    try {
+        if (!isPosixPlatform())
+            return false;
+        if (!fs.existsSync(GUARD_ZSH_PATH) && !fs.existsSync(GUARD_BASH_PATH))
+            return false;
+        for (const { rcPath } of resolveRcTargets()) {
+            try {
+                if (fs.readFileSync(rcPath, 'utf8').includes(MARKER_START))
+                    return true;
+            }
+            catch { /* keep looking */ }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+async function installPosixShellGuardCommand(args = {}) {
+    if (!isPosixPlatform()) {
+        console.log('The POSIX shell guard supports macOS and Linux (bash/zsh).');
+        return;
+    }
+    const rules = (0, shellGuard_1.writeShellGuardRules)();
+    const nodePath = process.execPath;
+    const cliEntry = process.argv[1] || '';
+    fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), { encoding: 'utf8', mode: 0o600 });
+    fs.writeFileSync(GUARD_ZSH_PATH, buildGuardZsh(nodePath), { encoding: 'utf8', mode: 0o600 });
+    fs.writeFileSync(GUARD_BASH_PATH, buildGuardBash(nodePath), { encoding: 'utf8', mode: 0o600 });
+    console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
+    if (args.profiles === 'false') {
+        console.log('Skipped rc wiring (--profiles false): guard scripts + rules written only.');
+        return;
+    }
+    let wired = 0;
+    for (const target of resolveRcTargets()) {
+        try {
+            const outcome = addSnippetToRc(target);
+            if (outcome === 'installed')
+                wired++;
+            console.log(outcome === 'installed'
+                ? `\x1b[32m✓ ${target.shell}: guard added\x1b[0m \x1b[2m(${target.rcPath})\x1b[0m`
+                : `\x1b[32m✓ ${target.shell}: guard already present\x1b[0m \x1b[2m(${target.rcPath})\x1b[0m`);
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ ${target.shell}: could not update ${target.rcPath} (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
+        }
+    }
+    console.log('\x1b[2mTakes effect in NEW terminals (or run: source ~/.zshrc). Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+    if (wired === 0) {
+        console.log('\x1b[33m⚠ Guard scripts written but no rc file was newly wired — check the entries above.\x1b[0m');
+    }
+}
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+async function uninstallPosixShellGuardCommand() {
+    if (!isPosixPlatform()) {
+        console.log('Nothing to remove on this OS.');
+        return;
+    }
+    let removed = 0;
+    for (const target of resolveRcTargets()) {
+        if (removeSnippetFromRc(target.rcPath)) {
+            removed++;
+            console.log(`Removed guard from ${target.shell} rc (${target.rcPath}).`);
+        }
+    }
+    try {
+        fs.unlinkSync(GUARD_ZSH_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(GUARD_BASH_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(GUARD_JS_PATH);
+    }
+    catch { /* not present */ }
+    console.log(removed > 0 ? 'Shell guard uninstalled. Open shells keep the guard until closed.' : 'Shell guard was not installed in any rc file.');
+}
+/** Refresh the shared rules JSON when the POSIX guard is installed. Never throws. */
+function refreshPosixShellGuardRules() {
+    try {
+        if (!isPosixShellGuardInstalled())
+            return;
+        (0, shellGuard_1.writeShellGuardRules)();
+    }
+    catch { /* best-effort */ }
+}

package/dist/commands/shellGuard.d.ts

@@ -1,7 +1,10 @@
+/** Blast-severity levels (shellfirm-style). Drives per-severity console policy. */
+export type ShellGuardSeverity = 'critical' | 'high' | 'medium' | 'low';
 export interface ShellGuardRule {
     id: string;
     category: string;
-    /** .NET-compatible regex, matched with IgnoreCase against the typed line. */
+    severity: ShellGuardSeverity;
+    /** Regex compiled with IgnoreCase in BOTH .NET (PowerShell) and JS (cmd/posix). */
     pattern: string;
     reason: string;
     source: 'builtin' | 'custom';
@@ -13,6 +16,23 @@ interface ShellGuardRulesFile {
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
 export declare function writeShellGuardRules(): ShellGuardRulesFile;
+/** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
+export declare function activeShellGuardRules(): ShellGuardRule[];
+export interface ShellGuardMatch {
+    rule: ShellGuardRule;
+    /** The command segment that matched (chained commands are split on ; & |). */
+    segment: string;
+}
+/**
+ * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
+ * behind `shell-guard-check`. Uses the exact same rules + JS regex engine as the
+ * live cmd/posix checkers (equivalent to .NET for these patterns). Also splits
+ * chained commands (`a && del /s c:\`) and tests each segment, so combinations
+ * are caught even when the dangerous part is not first.
+ *
+ * Returns ALL matches (one per matched segment/rule), first-match-per-segment.
+ */
+export declare function evaluateShellCommand(line: string, rules?: ShellGuardRule[]): ShellGuardMatch[];
 /**
  * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
  * console mode flip or new custom rule reaches interactive shells within ~30s.

package/dist/commands/shellGuard.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.writeShellGuardRules = writeShellGuardRules;
+exports.activeShellGuardRules = activeShellGuardRules;
+exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
@@ -67,7 +69,9 @@ const path = __importStar(require("path"));
  *
  * Scope honesty: this covers INTERACTIVE PowerShell (PSReadLine hosts, incl.
  * IDE-integrated terminals). Non-interactive scripts are covered by ScriptBlock
- * Logging (windowsAudit.ts). Native cmd.exe is covered separately (cmdGuard.ts).
+ * Logging (windowsAudit.ts). Native cmd.exe is covered separately (cmdGuard.ts),
+ * and macOS/Linux bash+zsh by posixShellGuard.ts — all three share the ruleset
+ * emitted by writeShellGuardRules() below.
  */
 const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
 const GUARD_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.ps1');
@@ -76,82 +80,168 @@ const RUNTIME_CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.js
 const SNAPSHOT_CACHE_DIR = path.join(os.homedir(), '.fullcourtdefense');
 const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
 const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
+/** Confine every lookahead to a single command segment (never span `;` `&` `|`). */
+const SEG = String.raw `[^;&|]*`;
+function compileSpec(spec) {
+    let pattern = String.raw `\b(?:${spec.command.join('|')})\b`;
+    for (const flag of spec.flags || [])
+        pattern += `(?=${SEG}\\s(?:${flag}))`;
+    for (const body of spec.extra || [])
+        pattern += `(?=${SEG}${body})`;
+    for (const n of spec.neg || [])
+        pattern += `(?!${SEG}(?:${n}))`;
+    if (spec.target && spec.target.length)
+        pattern += `(?=${SEG}\\s(?:${spec.target.join('|')}))`;
+    return { id: spec.id, category: spec.category, severity: spec.severity, reason: spec.reason, source: 'builtin', pattern };
+}
+// Reusable target fragments.
+const T_UNIX_ROOT = String.raw `["']?/["']?(?:\s|$|[;&|])|\*(?:\s|$|[;&|])`;
+const T_WIN_DRIVE = String.raw `["']?[a-z]:(?:[\\/](?:\*(?:\.\*)?)?)?["']?\s*(?:$|[;&|])`;
+const T_WIN_SYSDIR = String.raw `["']?[a-z]:[\\/](?:windows|program files(?: \(x86\))?|programdata|users)\b`;
 /**
- * Built-in dangerous-command rules — the shell-relevant subset of
- * deterministicGuard.ts, expressed as .NET-compatible regexes (PowerShell
- * compiles them with IgnoreCase). Item ids match the deterministic guard so
- * dashboard events line up across IDE hooks and terminal blocks.
+ * Built-in dangerous-command rules. Flag/target-bearing rules are compiled from
+ * specs (order-independent by construction); the rest are literal regexes. Item
+ * ids match the deterministic guard so dashboard events line up across IDE hooks
+ * and terminal blocks. Every rule carries a severity for console policy.
  */
 const BUILTIN_RULES = [
-    // Destructive filesystem
-    { id: 'rm_rf_root', category: 'destructive_command', reason: 'recursive force delete of filesystem root', source: 'builtin',
-        pattern: String.raw `\b(?:sudo\s+)?rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?/["']?|\*)(?:\s|$|[;&|])` },
-    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Windows drive delete', source: 'builtin',
-        pattern: String.raw `\b(?:del|erase)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\?(?:\s|$|[\\/])` },
-    { id: 'windows_drive_rmdir', category: 'destructive_command', reason: 'recursive Windows drive remove directory', source: 'builtin',
-        pattern: String.raw `\b(?:rd|rmdir)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\?(?:\s|$|[\\/])` },
-    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Remove-Item on a drive root', source: 'builtin',
-        pattern: String.raw `\bremove-item\b(?=.*-recurse)(?=.*-force)(?=.*\s[a-z]:[\\/]?(?:\s|$))` },
-    { id: 'format_drive', category: 'destructive_command', reason: 'drive format command', source: 'builtin',
+    // Destructive filesystem — spec-compiled (order-independent, optional flags not required).
+    compileSpec({ id: 'rm_rf_root', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of filesystem root',
+        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [T_UNIX_ROOT] }),
+    compileSpec({ id: 'rm_rf_home', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of the home directory',
+        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [String.raw `["']?(?:~|\$HOME)(?:/\S*)?["']?(?:\s|$|[;&|])`] }),
+    compileSpec({ id: 'windows_drive_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive delete',
+        command: ['del', 'erase'], flags: [String.raw `/s\b`], target: [T_WIN_DRIVE] }),
+    compileSpec({ id: 'windows_drive_rmdir', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive remove directory',
+        command: ['rd', 'rmdir'], flags: [String.raw `/s\b`], target: [String.raw `["']?[a-z]:[\\/]?["']?\s*(?:$|[;&|])`] }),
+    compileSpec({ id: 'windows_system_dir_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of a Windows system directory',
+        command: ['del', 'erase', 'rd', 'rmdir'], flags: [String.raw `/s\b`], target: [T_WIN_SYSDIR] }),
+    compileSpec({ id: 'remove_item_drive', category: 'destructive_command', severity: 'critical', reason: 'recursive Remove-Item on a drive root',
+        command: ['remove-item', 'ri'], flags: [String.raw `-recurse\w*`], target: [String.raw `["']?[a-z]:[\\/]?["']?(?:\s|$|[;&|])`] }),
+    compileSpec({ id: 'chmod_root_777', category: 'destructive_command', severity: 'high', reason: 'recursive world-writable permission change on root',
+        command: ['chmod'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`, String.raw `[0-7]?777`], target: [T_UNIX_ROOT] }),
+    compileSpec({ id: 'chown_root_recursive', category: 'destructive_command', severity: 'high', reason: 'recursive ownership change on the filesystem root',
+        command: ['chown'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [T_UNIX_ROOT] }),
+    compileSpec({ id: 'dd_disk_overwrite', category: 'destructive_command', severity: 'critical', reason: 'raw disk overwrite command',
+        command: ['dd'], target: [String.raw `of=/dev/(?:sd|xvd|hd|nvme|disk)\S*`] }),
+    { id: 'disk_device_overwrite', category: 'destructive_command', severity: 'critical', reason: 'redirecting output over a raw disk device', source: 'builtin',
+        pattern: String.raw `>\s*/dev/(?:sd|nvme|hd|disk|xvd|vd)[a-z0-9]*` },
+    { id: 'format_drive', category: 'destructive_command', severity: 'critical', reason: 'drive format command', source: 'builtin',
         pattern: String.raw `(?<![-\w])(?:format(?:\.com)?\s+[a-z]:(?:\s|$)|format-volume\b(?=.*-driveletter))` },
-    { id: 'fork_bomb', category: 'destructive_command', reason: 'fork bomb', source: 'builtin',
-        pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
-    { id: 'mkfs_device', category: 'destructive_command', reason: 'filesystem format command', source: 'builtin',
+    { id: 'mkfs_device', category: 'destructive_command', severity: 'critical', reason: 'filesystem format command', source: 'builtin',
         pattern: String.raw `\bmkfs(?:\.[a-z0-9]+)?\s+/dev/` },
-    { id: 'dd_disk_overwrite', category: 'destructive_command', reason: 'raw disk overwrite command', source: 'builtin',
-        pattern: String.raw `\bdd\b(?=.*\bof=/dev/(?:sd|xvd|hd|nvme|disk))` },
-    { id: 'chmod_root_777', category: 'destructive_command', reason: 'recursive permission change on root', source: 'builtin',
-        pattern: String.raw `\bchmod\s+-r\s+777\s+/(?:\s|$)` },
-    { id: 'vssadmin_delete_shadows', category: 'destructive_command', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
+    { id: 'macos_erase_disk', category: 'destructive_command', severity: 'critical', reason: 'erasing a macOS disk/volume', source: 'builtin',
+        pattern: String.raw `\bdiskutil\s+(?:erasedisk|erasevolume|reformat|zerodisk|secureerase)\b` },
+    { id: 'fork_bomb', category: 'destructive_command', severity: 'high', reason: 'fork bomb', source: 'builtin',
+        pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
+    { id: 'vssadmin_delete_shadows', category: 'destructive_command', severity: 'critical', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
         pattern: String.raw `\bvssadmin\b(?=.*\bdelete\b)(?=.*\bshadows\b)` },
-    { id: 'defender_disable', category: 'destructive_command', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
+    { id: 'wbadmin_delete_backup', category: 'destructive_command', severity: 'critical', reason: 'Windows backup catalog deletion (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bwbadmin\b(?=.*\bdelete\b)(?=.*\b(?:catalog|systemstatebackup|backup)\b)` },
+    { id: 'bcdedit_recovery_disable', category: 'security_tampering', severity: 'critical', reason: 'disabling Windows recovery/boot repair (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bbcdedit\b(?=.*(?:\brecoveryenabled\b\s+no\b|\bbootstatuspolicy\b\s+ignoreallfailures\b))` },
+    { id: 'cipher_wipe_disk', category: 'destructive_command', severity: 'high', reason: 'wiping deleted data from a drive (cipher /w)', source: 'builtin',
+        pattern: String.raw `\bcipher(?:\.exe)?\b(?=.*\s/w(?::|\b))` },
+    { id: 'defender_disable', category: 'security_tampering', severity: 'high', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
         pattern: String.raw `\bset-mppreference\b(?=.*-disablerealtimemonitoring)(?=.*(?:\$true|\s1\b))` },
     // Reverse shells / droppers
-    { id: 'bash_dev_tcp', category: 'reverse_shell', reason: 'bash reverse shell', source: 'builtin',
+    { id: 'bash_dev_tcp', category: 'reverse_shell', severity: 'critical', reason: 'bash reverse shell', source: 'builtin',
         pattern: String.raw `\bbash\s+-i\b.*(?:/dev/tcp/)` },
-    { id: 'netcat_exec', category: 'reverse_shell', reason: 'netcat reverse shell', source: 'builtin',
+    { id: 'netcat_exec', category: 'reverse_shell', severity: 'critical', reason: 'netcat reverse shell', source: 'builtin',
         pattern: String.raw `\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:/bin/)?(?:sh|bash|cmd(?:\.exe)?|powershell(?:\.exe)?)\b` },
-    { id: 'socat_exec', category: 'reverse_shell', reason: 'socat reverse shell', source: 'builtin',
+    { id: 'socat_exec', category: 'reverse_shell', severity: 'critical', reason: 'socat reverse shell', source: 'builtin',
         pattern: String.raw `\bsocat\b.*\bexec:(?:/bin/)?(?:sh|bash)\b` },
-    { id: 'curl_pipe_shell', category: 'reverse_shell', reason: 'remote script piped to shell', source: 'builtin',
+    { id: 'curl_pipe_shell', category: 'reverse_shell', severity: 'high', reason: 'remote script piped to shell', source: 'builtin',
         pattern: String.raw `\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b` },
-    { id: 'powershell_download_exec', category: 'reverse_shell', reason: 'download-and-execute (IEX + web download)', source: 'builtin',
+    { id: 'remote_pipe_interpreter', category: 'reverse_shell', severity: 'high', reason: 'remote script piped to an interpreter', source: 'builtin',
+        pattern: String.raw `\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:python[0-9.]*|perl|ruby|node|php)\b` },
+    { id: 'powershell_download_exec', category: 'reverse_shell', severity: 'high', reason: 'download-and-execute (IEX + web download)', source: 'builtin',
         pattern: String.raw `(?=.*\b(?:iex\b|invoke-expression\b))(?=.*(?:downloadstring|net\.webclient|invoke-webrequest\b|\biwr\b|invoke-restmethod\b|\birm\b))` },
-    { id: 'python_socket_subprocess', category: 'reverse_shell', reason: 'python reverse shell', source: 'builtin',
+    { id: 'python_socket_subprocess', category: 'reverse_shell', severity: 'high', reason: 'python reverse shell', source: 'builtin',
         pattern: String.raw `\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)` },
+    { id: 'perl_reverse_shell', category: 'reverse_shell', severity: 'high', reason: 'perl reverse shell', source: 'builtin',
+        pattern: String.raw `\bperl\s+-e\b(?=.*socket)(?=.*(?:exec|system|/bin/(?:sh|bash)))` },
+    { id: 'php_reverse_shell', category: 'reverse_shell', severity: 'high', reason: 'php reverse shell', source: 'builtin',
+        pattern: String.raw `\bphp\s+-r\b(?=.*fsockopen)` },
     // Cloud metadata / credential exfiltration
-    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', reason: 'request to cloud metadata endpoint', source: 'builtin',
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to cloud metadata endpoint', source: 'builtin',
         pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
-    { id: 'credential_exfiltration', category: 'secret_exfiltration', reason: 'credential file sent to the network', source: 'builtin',
+    { id: 'credential_exfiltration', category: 'secret_exfiltration', severity: 'critical', reason: 'credential file sent to the network', source: 'builtin',
         pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
-    // Infra destroy
-    { id: 'terraform_destroy_auto', category: 'infra_destroy', reason: 'terraform destroy with auto-approve', source: 'builtin',
-        pattern: String.raw `\bterraform\s+destroy\b(?=.*--auto-approve)` },
-    { id: 'pulumi_destroy_yes', category: 'infra_destroy', reason: 'pulumi destroy with auto-approve', source: 'builtin',
-        pattern: String.raw `\bpulumi\s+destroy\b(?=.*(?:--yes|\s-y\b))` },
-    { id: 'kubectl_delete_namespace', category: 'infra_destroy', reason: 'destructive kubectl namespace delete', source: 'builtin',
-        pattern: String.raw `\bkubectl\s+delete\s+namespace\b` },
-    { id: 'kubectl_delete_all_all', category: 'infra_destroy', reason: 'broad kubectl delete all', source: 'builtin',
-        pattern: String.raw `\bkubectl\s+delete\s+all\b(?=.*--all)` },
-    { id: 'gcloud_project_delete', category: 'infra_destroy', reason: 'GCP project deletion', source: 'builtin',
+    // Infra destroy — spec-compiled where flags matter (order-independent).
+    compileSpec({ id: 'terraform_destroy_auto', category: 'infra_destroy', severity: 'high', reason: 'terraform destroy with auto-approve',
+        command: ['terraform'], extra: [String.raw `\bdestroy\b`], flags: [String.raw `--auto-approve`] }),
+    compileSpec({ id: 'pulumi_destroy_yes', category: 'infra_destroy', severity: 'high', reason: 'pulumi destroy with auto-approve',
+        command: ['pulumi'], extra: [String.raw `\bdestroy\b`], flags: [String.raw `--yes|-y\b`] }),
+    compileSpec({ id: 'kubectl_delete_all_all', category: 'infra_destroy', severity: 'high', reason: 'broad kubectl delete all',
+        command: ['kubectl'], extra: [String.raw `\bdelete\b`, String.raw `\ball\b`], flags: [String.raw `--all`] }),
+    compileSpec({ id: 'aws_s3_recursive_rm', category: 'infra_destroy', severity: 'high', reason: 'recursive S3 deletion',
+        command: ['aws'], extra: [String.raw `\bs3\s+rm\b`], flags: [String.raw `--recursive`], target: [String.raw `s3://\S+`] }),
+    compileSpec({ id: 'aws_iam_admin_policy', category: 'infra_destroy', severity: 'high', reason: 'IAM administrator privilege grant',
+        command: ['aws'], extra: [String.raw `\biam\s+attach-user-policy\b`], flags: [String.raw `AdministratorAccess`] }),
+    compileSpec({ id: 'az_group_delete_yes', category: 'infra_destroy', severity: 'high', reason: 'Azure resource group deletion',
+        command: ['az'], extra: [String.raw `\bgroup\s+delete\b`], flags: [String.raw `--yes|-y\b`] }),
+    compileSpec({ id: 'az_vm_delete', category: 'infra_destroy', severity: 'high', reason: 'Azure VM deletion',
+        command: ['az'], extra: [String.raw `\bvm\s+delete\b`], flags: [String.raw `--yes|-y\b`] }),
+    compileSpec({ id: 'docker_prune_all', category: 'infra_destroy', severity: 'medium', reason: 'destructive docker prune (removes all images/volumes)',
+        command: ['docker'], extra: [String.raw `\b(?:system|volume|image)\s+prune\b`], flags: [String.raw `-a\b|--all|--volumes`] }),
+    compileSpec({ id: 'kubectl_delete_pvc_all', category: 'infra_destroy', severity: 'high', reason: 'kubectl delete all persistent volume claims',
+        command: ['kubectl'], extra: [String.raw `\bdelete\s+(?:pvc|persistentvolumeclaims?)\b`], flags: [String.raw `--all`] }),
+    { id: 'kubectl_delete_namespace', category: 'infra_destroy', severity: 'high', reason: 'destructive kubectl namespace delete', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+(?:namespace|ns)\b` },
+    { id: 'gcloud_project_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP project deletion', source: 'builtin',
         pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
-    { id: 'gcloud_sql_delete', category: 'infra_destroy', reason: 'GCP SQL instance deletion', source: 'builtin',
+    { id: 'gcloud_sql_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP SQL instance deletion', source: 'builtin',
         pattern: String.raw `\bgcloud\s+sql\s+instances\s+delete\b` },
-    { id: 'aws_s3_recursive_rm', category: 'infra_destroy', reason: 'recursive S3 deletion', source: 'builtin',
-        pattern: String.raw `\baws\s+s3\s+rm\s+s3://\S+\s+--recursive\b` },
-    { id: 'aws_cloudformation_delete_stack', category: 'infra_destroy', reason: 'CloudFormation stack deletion', source: 'builtin',
+    { id: 'gcloud_gke_delete', category: 'infra_destroy', severity: 'high', reason: 'GKE cluster deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+container\s+clusters\s+delete\b` },
+    { id: 'aws_cloudformation_delete_stack', category: 'infra_destroy', severity: 'high', reason: 'CloudFormation stack deletion', source: 'builtin',
         pattern: String.raw `\baws\s+cloudformation\s+delete-stack\b` },
-    { id: 'aws_iam_admin_policy', category: 'infra_destroy', reason: 'IAM administrator privilege grant', source: 'builtin',
-        pattern: String.raw `\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)` },
-    { id: 'aws_iam_access_key', category: 'infra_destroy', reason: 'IAM access key creation', source: 'builtin',
+    { id: 'aws_iam_access_key', category: 'infra_destroy', severity: 'medium', reason: 'IAM access key creation', source: 'builtin',
         pattern: String.raw `\baws\s+iam\s+create-access-key\b` },
-    { id: 'az_group_delete_yes', category: 'infra_destroy', reason: 'Azure resource group deletion', source: 'builtin',
-        pattern: String.raw `\baz\s+group\s+delete\b(?=.*(?:--yes|\s-y\b))` },
+    { id: 'aws_ec2_terminate', category: 'infra_destroy', severity: 'high', reason: 'EC2 instance termination', source: 'builtin',
+        pattern: String.raw `\baws\s+ec2\s+terminate-instances\b` },
+    { id: 'aws_dynamodb_delete_table', category: 'infra_destroy', severity: 'high', reason: 'DynamoDB table deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+dynamodb\s+delete-table\b` },
+    { id: 'aws_rds_delete', category: 'infra_destroy', severity: 'high', reason: 'RDS instance deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+rds\s+delete-db-instance\b` },
+    // Version-control footguns — imported from shellfirm / Sigma (git group).
+    compileSpec({ id: 'git_force_push', category: 'vcs_danger', severity: 'high', reason: 'git force push (overwrites remote history)',
+        command: ['git'], extra: [String.raw `\bpush\b`], flags: [String.raw `--force|-f\b`], neg: [String.raw `\s--force-with-lease`] }),
+    compileSpec({ id: 'git_reset_hard', category: 'vcs_danger', severity: 'medium', reason: 'git reset --hard (discards local changes)',
+        command: ['git'], extra: [String.raw `\breset\b`], flags: [String.raw `--hard`] }),
+    compileSpec({ id: 'git_clean_force', category: 'vcs_danger', severity: 'medium', reason: 'git clean -fd (deletes untracked files)',
+        command: ['git'], extra: [String.raw `\bclean\b`], flags: [String.raw `-[a-z]*f`, String.raw `-[a-z]*d`] }),
+    { id: 'git_branch_delete_force', category: 'vcs_danger', severity: 'low', reason: 'git force-delete branch', source: 'builtin',
+        pattern: String.raw `\bgit\s+branch\b(?=[^;&|]*\s-D\b)` },
+    // Anti-forensics / tamper
+    { id: 'clear_shell_history', category: 'anti_forensics', severity: 'medium', reason: 'clearing shell history', source: 'builtin',
+        pattern: String.raw `\bhistory\s+-c\b|\brm\b[^|;&]{0,80}\.(?:bash|zsh)_history\b` },
+    { id: 'windows_clear_eventlog', category: 'anti_forensics', severity: 'high', reason: 'clearing Windows event logs', source: 'builtin',
+        pattern: String.raw `\b(?:wevtutil\s+cl|clear-eventlog)\b` },
+    // Security-control tampering
+    { id: 'disable_firewall_windows', category: 'security_tampering', severity: 'high', reason: 'disabling the Windows firewall', source: 'builtin',
+        pattern: String.raw `\bnetsh\s+advfirewall\s+set\b(?=.*\bstate\s+off)` },
+    { id: 'disable_firewall_unix', category: 'security_tampering', severity: 'high', reason: 'disabling the host firewall', source: 'builtin',
+        pattern: String.raw `\bufw\s+disable\b|\biptables\s+-F\b|\bsystemctl\s+(?:stop|disable)\s+firewalld\b` },
+    { id: 'macos_disable_gatekeeper', category: 'security_tampering', severity: 'high', reason: 'disabling macOS Gatekeeper', source: 'builtin',
+        pattern: String.raw `\bspctl\s+--master-disable\b` },
+    { id: 'macos_disable_sip', category: 'security_tampering', severity: 'high', reason: 'disabling macOS System Integrity Protection', source: 'builtin',
+        pattern: String.raw `\bcsrutil\s+disable\b` },
+    // Persistence / backdoor
+    { id: 'crontab_from_stdin', category: 'persistence', severity: 'medium', reason: 'installing a crontab from stdin', source: 'builtin',
+        pattern: String.raw `\|\s*crontab\b` },
+    { id: 'authorized_keys_backdoor', category: 'persistence', severity: 'high', reason: 'appending an SSH authorized key', source: 'builtin',
+        pattern: String.raw `>>?\s*(?:~|\$HOME|/root|/home/\S+)?/?\.ssh/authorized_keys\b` },
     // Destructive SQL typed straight into a terminal client
-    { id: 'drop_database', category: 'destructive_sql', reason: 'DROP DATABASE', source: 'builtin',
+    { id: 'drop_database', category: 'destructive_sql', severity: 'high', reason: 'DROP DATABASE', source: 'builtin',
         pattern: String.raw `\bdrop\s+database\b` },
-    { id: 'drop_schema', category: 'destructive_sql', reason: 'DROP SCHEMA', source: 'builtin',
+    { id: 'drop_schema', category: 'destructive_sql', severity: 'high', reason: 'DROP SCHEMA', source: 'builtin',
         pattern: String.raw `\bdrop\s+schema\b` },
+    { id: 'truncate_table', category: 'destructive_sql', severity: 'medium', reason: 'TRUNCATE TABLE', source: 'builtin',
+        pattern: String.raw `\btruncate\s+table\b` },
+    { id: 'drop_table', category: 'destructive_sql', severity: 'medium', reason: 'DROP TABLE', source: 'builtin',
+        pattern: String.raw `\bdrop\s+table\b` },
 ];
 function escapeDotNetRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -211,9 +301,11 @@ function cachedCustomRules() {
                 for (const block of blocks.slice(0, 100)) {
                     if (!block || typeof block.pattern !== 'string' || !block.pattern.trim())
                         continue;
+                    const sev = String(block.severity || '').toLowerCase();
                     rules.push({
                         id: String(block.id || block.pattern).slice(0, 120),
                         category: String(block.categoryId || 'custom'),
+                        severity: (sev === 'critical' || sev === 'high' || sev === 'medium' || sev === 'low') ? sev : 'high',
                         // Snapshot custom blocks are substring matches — escape into a literal regex.
                         pattern: escapeDotNetRegex(block.pattern.trim()),
                         reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
@@ -246,6 +338,52 @@ function writeShellGuardRules() {
     fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
     return data;
 }
+/** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
+function activeShellGuardRules() {
+    const disabled = cachedDisabledItemIds();
+    return [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()];
+}
+/**
+ * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
+ * behind `shell-guard-check`. Uses the exact same rules + JS regex engine as the
+ * live cmd/posix checkers (equivalent to .NET for these patterns). Also splits
+ * chained commands (`a && del /s c:\`) and tests each segment, so combinations
+ * are caught even when the dangerous part is not first.
+ *
+ * Returns ALL matches (one per matched segment/rule), first-match-per-segment.
+ */
+function evaluateShellCommand(line, rules = activeShellGuardRules()) {
+    const compiled = rules.map(r => {
+        try {
+            return { rule: r, re: new RegExp(r.pattern, 'i') };
+        }
+        catch {
+            return null;
+        }
+    }).filter((x) => !!x);
+    // Whole line first (some rules intentionally span a pipe, e.g. curl | sh),
+    // then each &&/||/;/newline segment (catches "cleanup && del /s c:\").
+    const candidates = [line, ...line.split(/&&|\|\||[;&\n]|\|/).map(s => s.trim()).filter(Boolean)];
+    const seen = new Set();
+    const matches = [];
+    for (const candidate of candidates) {
+        const norm = candidate.replace(/\s+/g, ' ').trim();
+        for (const { rule, re } of compiled) {
+            try {
+                if (re.test(norm) || re.test(candidate)) {
+                    const key = `${rule.id}|${candidate}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    matches.push({ rule, segment: candidate });
+                    break; // first rule per segment is enough
+                }
+            }
+            catch { /* skip bad regex */ }
+        }
+    }
+    return matches;
+}
 /**
  * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
  * console mode flip or new custom rule reaches interactive shells within ~30s.
@@ -286,6 +424,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `        [pscustomobject]@{`,
         `          Id       = [string]$_.id`,
         `          Category = [string]$_.category`,
+        `          Severity = [string]$_.severity`,
         `          Reason   = [string]$_.reason`,
         `          Source   = [string]$_.source`,
         `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
@@ -321,6 +460,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      reason     = ('Shell guard: ' + $Rule.Reason)`,
         `      ruleId     = $Rule.Id`,
         `      category   = $Rule.Category`,
+        `      severity   = $Rule.Severity`,
         `      source     = $Rule.Source`,
         `      evidence   = $evidence`,
         `      occurredAt = (Get-Date).ToUniversalTime().ToString('o')`,
@@ -349,14 +489,14 @@ function buildGuardPs1(nodePath, cliEntry) {
         `    if ($null -ne $hit) {`,
         `      if ($global:FcdGuardMode -eq 'monitor') {`,
         `        Write-Host ''`,
-        `        Write-Host ('[FullCourtDefense] monitor: would block - ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-Host ('[FullCourtDefense] monitor: would block [' + $hit.Severity + '] ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
         `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow'`,
         `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
         `        return`,
         `      }`,
         `      [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
         `      Write-Host ''`,
-        `      Write-Host ('[FullCourtDefense] BLOCKED: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
+        `      Write-Host ('[FullCourtDefense] BLOCKED [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
         `      Write-Host 'This command was not executed. Reported to your security dashboard.' -ForegroundColor DarkGray`,
         `      Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block'`,
         `      [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,

package/dist/index.js

@@ -53,6 +53,7 @@ const autoProtect_1 = require("./commands/autoProtect");
 const windowsAudit_1 = require("./commands/windowsAudit");
 const shellGuard_1 = require("./commands/shellGuard");
 const cmdGuard_1 = require("./commands/cmdGuard");
+const posixShellGuard_1 = require("./commands/posixShellGuard");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -68,6 +69,7 @@ function readCliVersion() {
 const VERSION = readCliVersion();
 function parseArgs(argv) {
     const flags = {};
+    const positional = [];
     let command = '';
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
@@ -75,6 +77,10 @@ function parseArgs(argv) {
             command = arg;
             continue;
         }
+        if (command && !arg.startsWith('-')) {
+            positional.push(arg);
+            continue;
+        }
         if (arg.startsWith('--')) {
             const key = arg.slice(2);
             const eqIdx = key.indexOf('=');
@@ -104,7 +110,7 @@ function parseArgs(argv) {
             }
         }
     }
-    return { command, flags };
+    return { command, flags, positional };
 }
 function printHelp() {
     console.log(`
@@ -128,11 +134,14 @@ function printHelp() {
     install     Alias for install-all.
     windows-audit  Show Windows PowerShell audit coverage (ScriptBlock Logging +
                 Transcription). Use --enable to turn it on (one admin prompt).
-    install-shell-guard    Block dangerous commands typed in PowerShell terminals
-                (real-time, offline rule cache). uninstall-shell-guard removes it;
-                shell-guard-status shows coverage.
+    install-shell-guard    Block dangerous commands typed in a terminal (real-time,
+                offline rule cache): PowerShell on Windows, bash + zsh on macOS/Linux.
+                uninstall-shell-guard removes it; shell-guard-status shows coverage.
     install-cmd-guard      Block dangerous commands typed in cmd.exe (Command Prompt).
                 uninstall-cmd-guard removes it; cmd-guard-status shows coverage.
+    shell-guard-check      Dry-run: test whether a command (or a file/stdin list of
+                commands) would be blocked — nothing is executed. Splits chained
+                commands (a && del /s c:\). --file <path>, --json; exits 1 if any block.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
@@ -349,7 +358,7 @@ function printHelp() {
 `);
 }
 async function main() {
-    const { command, flags } = parseArgs(process.argv.slice(2));
+    const { command, flags, positional } = parseArgs(process.argv.slice(2));
     const buildInstallArgs = () => ({
         clients: flags.clients,
         cursorProject: flags['cursor-project'],
@@ -605,6 +614,7 @@ async function main() {
                 windowsAudit: flags['windows-audit'],
                 shellGuard: flags['shell-guard'],
                 cmdGuard: flags['cmd-guard'],
+                posixGuard: flags['posix-guard'],
             };
             await (0, installAll_1.installAllCommand)(args, config);
             break;
@@ -615,28 +625,101 @@ async function main() {
             break;
         }
         case 'install-shell-guard': {
-            await (0, shellGuard_1.installShellGuardCommand)({ profiles: flags.profiles });
+            if (process.platform === 'win32') {
+                await (0, shellGuard_1.installShellGuardCommand)({ profiles: flags.profiles });
+            }
+            else {
+                await (0, posixShellGuard_1.installPosixShellGuardCommand)({ profiles: flags.profiles });
+            }
             break;
         }
         case 'uninstall-shell-guard': {
-            await (0, shellGuard_1.uninstallShellGuardCommand)();
+            if (process.platform === 'win32') {
+                await (0, shellGuard_1.uninstallShellGuardCommand)();
+            }
+            else {
+                await (0, posixShellGuard_1.uninstallPosixShellGuardCommand)();
+            }
             break;
         }
         case 'shell-guard-status': {
-            const status = (0, shellGuard_1.getShellGuardStatus)();
-            if (!status.supported) {
-                console.log('Shell guard supports Windows PowerShell (bash/zsh planned).');
+            if (process.platform === 'win32') {
+                const status = (0, shellGuard_1.getShellGuardStatus)();
+                console.log(`\nInteractive PowerShell shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+                for (const profile of status.profiles) {
+                    console.log(`  ${profile.engine}: ${profile.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${profile.profilePath}\x1b[0m`);
+                }
+                if (status.rulesPresent)
+                    console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+                console.log('');
                 break;
             }
-            console.log(`\nInteractive PowerShell shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
-            for (const profile of status.profiles) {
-                console.log(`  ${profile.engine}: ${profile.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${profile.profilePath}\x1b[0m`);
+            const status = (0, posixShellGuard_1.getPosixShellGuardStatus)();
+            console.log(`\nInteractive shell guard (bash + zsh): ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+            for (const rc of status.rcFiles) {
+                console.log(`  ${rc.shell}: ${rc.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${rc.rcPath}\x1b[0m`);
             }
             if (status.rulesPresent)
                 console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
             console.log('');
             break;
         }
+        case 'shell-guard-check': {
+            // Dry-run classifier — evaluate command(s) against the guard rules WITHOUT
+            // executing anything. Positional args are one command; --file reads one
+            // command per line; no args reads stdin. Exit 1 if ANY command is blocked
+            // (so it can gate CI). --json for machine output.
+            const asJson = flags.json === 'true' || flags.json === '';
+            const lines = [];
+            if (flags.file) {
+                try {
+                    lines.push(...fs.readFileSync(flags.file, 'utf8').split(/\r?\n/));
+                }
+                catch (e) {
+                    console.error(`Cannot read --file: ${e instanceof Error ? e.message : String(e)}`);
+                    process.exit(2);
+                }
+            }
+            else if (positional.length > 0) {
+                lines.push(positional.join(' '));
+            }
+            else if (!process.stdin.isTTY) {
+                lines.push(...fs.readFileSync(0, 'utf8').split(/\r?\n/));
+            }
+            else {
+                console.log('Usage: fullcourtdefense shell-guard-check "<command>"   |   --file cmds.txt   |   echo "<cmd>" | fullcourtdefense shell-guard-check');
+                break;
+            }
+            const cmds = lines.map(l => l.trim()).filter(Boolean);
+            const rules = (0, shellGuard_1.activeShellGuardRules)();
+            let blocked = 0;
+            const results = cmds.map(cmd => {
+                const matches = (0, shellGuard_1.evaluateShellCommand)(cmd, rules);
+                if (matches.length)
+                    blocked++;
+                return { command: cmd, blocked: matches.length > 0, matches: matches.map(m => ({ ruleId: m.rule.id, severity: m.rule.severity, category: m.rule.category, reason: m.rule.reason, segment: m.segment })) };
+            });
+            if (asJson) {
+                console.log(JSON.stringify({ total: cmds.length, blocked, ruleCount: rules.length, results }, null, 2));
+            }
+            else {
+                console.log(`\nEvaluated ${cmds.length} command(s) against ${rules.length} rules (dry-run — nothing executed):\n`);
+                for (const r of results) {
+                    if (r.blocked) {
+                        const m = r.matches[0];
+                        console.log(`  \x1b[31mBLOCK\x1b[0m [\x1b[1m${m.severity}\x1b[0m] ${r.command}`);
+                        console.log(`        \x1b[2m${m.reason} (rule ${m.ruleId})${r.matches.length > 1 ? ` +${r.matches.length - 1} more` : ''}\x1b[0m`);
+                    }
+                    else {
+                        console.log(`  \x1b[32mALLOW\x1b[0m ${r.command}`);
+                    }
+                }
+                console.log(`\n${blocked} blocked, ${cmds.length - blocked} allowed.`);
+            }
+            if (blocked > 0)
+                process.exit(1);
+            break;
+        }
         case 'install-cmd-guard': {
             await (0, cmdGuard_1.installCmdGuardCommand)();
             break;

package/dist/telemetry.d.ts

@@ -9,6 +9,7 @@ export interface SpoolEvent {
     category?: string;
     categoryId?: string;
     itemId?: string;
+    severity?: 'critical' | 'high' | 'medium' | 'low';
     source?: 'builtin' | 'custom' | 'taint' | 'backend';
     evidence?: string;
     explanation?: string;

package/dist/telemetry.js

@@ -45,6 +45,7 @@ const machineIdentity_1 = require("./machineIdentity");
 const windowsAudit_1 = require("./commands/windowsAudit");
 const shellGuard_1 = require("./commands/shellGuard");
 const cmdGuard_1 = require("./commands/cmdGuard");
+const posixShellGuard_1 = require("./commands/posixShellGuard");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -72,6 +73,7 @@ function spoolEvent(event) {
             category: event.category,
             categoryId: event.categoryId,
             itemId: event.itemId,
+            severity: event.severity,
             source: event.source,
             evidence: event.evidence,
             explanation: event.explanation,
@@ -115,6 +117,7 @@ async function flushSpool(input) {
     // + new custom rules reach open shells within ~30s).
     (0, shellGuard_1.refreshShellGuardRules)();
     (0, cmdGuard_1.refreshCmdGuardRules)();
+    (0, posixShellGuard_1.refreshPosixShellGuardRules)();
     const all = readSpool();
     const batch = all.slice(0, MAX_BATCH);
     const overflow = all.slice(MAX_BATCH);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.11.0"
+  "version": "1.14.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.11.0",
+  "version": "1.14.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -19,6 +19,7 @@
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
+    "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },