fullcourtdefense-cli 1.13.0 → 1.14.1

package/dist/commands/cmdGuard.js

@@ -60,12 +60,33 @@ const AUTORUN_BAT_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-autorun.
 const CMD_AUTORUN_KEY = 'HKCU\\Software\\Microsoft\\Command Processor';
 const AUTORUN_VALUE = 'AutoRun';
 const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
-/** cmd builtins / exes we intercept via doskey (first token of the typed line). */
+/**
+ * cmd builtins / exes we intercept via doskey (first token of the typed line).
+ *
+ * cmd.exe has NO general pre-execution hook (unlike PowerShell PSReadLine or the
+ * zsh/bash whole-line hooks), so coverage here is by enumeration: every command
+ * name that anchors a dangerous rule must be listed or its rule can never fire in
+ * interactive cmd. This is the known residual gap — a command whose leading name
+ * is not below runs unchecked. Keep in sync with the builtin rule command anchors
+ * in shellGuard.ts. Only leading-token names matter (doskey is first-token only),
+ * so pipes/`&&` chains where the dangerous command is not first are NOT caught by
+ * cmd (they ARE under PowerShell/zsh/bash and `shell-guard-check`).
+ */
 const INTERCEPTED_COMMANDS = [
-    'del', 'erase', 'rd', 'rmdir', 'format',
-    'curl', 'wget', 'powershell', 'pwsh',
-    'terraform', 'kubectl', 'aws', 'gcloud', 'az',
-    'vssadmin', 'certutil', 'bitsadmin', 'reg', 'net', 'sc',
+    // Destructive filesystem / disk
+    'del', 'erase', 'rd', 'rmdir', 'format', 'cipher', 'diskpart', 'fsutil',
+    'robocopy', 'xcopy', 'takeown', 'icacls', 'attrib', 'compact',
+    // Backup / recovery / shadow-copy tampering (ransomware patterns)
+    'vssadmin', 'wbadmin', 'bcdedit', 'wevtutil',
+    // Interpreters / download-and-exec vectors
+    'powershell', 'pwsh', 'curl', 'wget', 'certutil', 'bitsadmin', 'mshta',
+    'rundll32', 'regsvr32', 'wscript', 'cscript', 'wmic', 'wsl',
+    // Service / firewall / registry / accounts
+    'reg', 'net', 'net1', 'sc', 'netsh', 'schtasks', 'taskkill',
+    // Infra / cloud CLIs
+    'terraform', 'pulumi', 'kubectl', 'aws', 'gcloud', 'az', 'docker',
+    // VCS + database clients
+    'git', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
 ];
 function regString(key, value) {
     try {

package/dist/commands/hook.js

@@ -456,7 +456,7 @@ async function hookCommand(args, config) {
     const failClosed = args.failClosed === 'true';
     const timeoutMs = Number(args.timeout) > 0 ? Number(args.timeout) : 8000;
     const approvalMode = args.approvalMode === 'block' ? 'block' : 'wait';
-    const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000;
+    const approvalTimeoutMs = Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 900000;
     const approvalPollMs = Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000);
     const creds = (0, config_1.resolveCliCredentials)(config, {
         shieldId: args.shieldId,

package/dist/commands/mcpGateway.js

@@ -191,7 +191,7 @@ function resolveGatewayConfig(args, config, defaults = {}) {
         userObjective: args.userObjective || process.env.FCD_USER_OBJECTIVE || defaults.userObjective || 'Developer requested this action from Cursor.',
         authority: args.authority || process.env.FCD_AUTHORITY || 'developer',
         approvalMode: args.approvalMode === 'block' ? 'block' : 'wait',
-        approvalTimeoutMs: Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 300000,
+        approvalTimeoutMs: Number(args.approvalTimeoutMs) > 0 ? Number(args.approvalTimeoutMs) : 900000,
         approvalPollMs: Math.max(1000, Number(args.approvalPollMs) > 0 ? Number(args.approvalPollMs) : 3000),
         scanResponse: args.scanResponse === 'true',
         failClosed: args.failClosed !== 'false',

package/dist/commands/posixShellGuard.js

@@ -52,18 +52,23 @@ const shellGuard_1 = require("./shellGuard");
  * everywhere.
  *
  * Two hook mechanisms, one shared Node checker (~/.fullcourtdefense-posix-guard.js).
- * Each shell gets its OWN sourced file (never cross-parsed — zsh-only expansions
- * would otherwise break bash at source time):
+ * Both are COMMAND-AGNOSTIC — they inspect the WHOLE typed line against every
+ * rule, so any command in any position is covered (not a fixed watchlist of
+ * names). Each shell gets its OWN sourced file (never cross-parsed — zsh-only
+ * expansions would otherwise break bash at source time):
  *   - zsh (macOS default), ~/.fullcourtdefense-shell-guard.zsh: a ZLE
- *     `accept-line` widget inspects the WHOLE typed line before it runs — the
- *     strongest form (catches pipes, e.g. `curl … | sh`). Block mode → the line
- *     is not accepted (never executes); monitor → warning + the line runs.
+ *     `accept-line` widget inspects the whole typed line before it runs (catches
+ *     pipes, e.g. `curl … | sh`, and chained `foo && rm -rf /`). Block mode → the
+ *     line is not accepted (never executes); monitor → warning + the line runs.
  *     Analogous to the PowerShell PSReadLine hook.
- *   - bash, ~/.fullcourtdefense-shell-guard.bash: function wrappers for a
- *     watchlist of high-risk command names (rm, dd, chmod, sudo, curl, kubectl…) —
- *     the same model as the cmd.exe doskey guard. Per-command (does not see the
- *     full pipeline), so pipe-to-shell is only fully covered under zsh; the
- *     flagship cases (rm -rf /, sudo rm, dd, infra destroy…) are covered under both.
+ *   - bash, ~/.fullcourtdefense-shell-guard.bash: a `DEBUG`-trap preexec hook
+ *     (bash-preexec style) reads the full command line from history right before
+ *     it runs and, with `extdebug`, skips it on an explicit block (checker exit
+ *     97). Whole-line, command-agnostic — the bash analogue of zsh's accept-line.
+ *
+ * Cost of whole-line coverage: the Node checker runs once per typed command. Off
+ * with `export FCD_SHELL_GUARD=off`. Benign lines exit the checker in ~1ms after
+ * regex matching; the only real overhead is Node startup per command.
  *
  * Safety: every layer fails OPEN. If the checker is missing or errors, the command
  * runs — a guard bug must never brick a developer's shell. Only an explicit block
@@ -82,19 +87,6 @@ const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
 const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
 const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
 const BLOCK_CODE = 97;
-/**
- * Leading command names that trigger the checker. Everything else runs with zero
- * overhead. Each name maps to at least one builtin rule anchor. (No `node`/`git` —
- * too common, no destructive builtin rule anchors on them.)
- */
-const WATCHLIST = [
-    'rm', 'rmdir', 'dd', 'mkfs', 'chmod', 'chown', 'sudo',
-    'bash', 'sh', 'zsh', 'nc', 'ncat', 'netcat', 'socat',
-    'curl', 'wget', 'python', 'python2', 'python3', 'perl', 'php', 'ruby',
-    'terraform', 'pulumi', 'kubectl', 'gcloud', 'aws', 'az', 'docker',
-    'diskutil', 'csrutil', 'spctl', 'iptables', 'ufw', 'systemctl', 'service',
-    'launchctl', 'chattr', 'scp', 'psql', 'mysql', 'mongo', 'mongosh', 'crontab',
-];
 function isPosixPlatform() {
     return process.platform === 'darwin' || process.platform === 'linux';
 }
@@ -129,7 +121,6 @@ function buildGuardJs(nodePath, cliEntry) {
 }
 /** zsh guard — sourced ONLY from .zshrc (contains zsh-specific ZLE syntax). */
 function buildGuardZsh(nodePath) {
-    const watch = ` ${WATCHLIST.join(' ')} `;
     return [
         `# FullCourtDefense interactive shell guard for zsh (installed by fullcourtdefense-cli).`,
         `# Disable for one session:  export FCD_SHELL_GUARD=off`,
@@ -139,27 +130,21 @@ function buildGuardZsh(nodePath) {
         ``,
         `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
         `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
-        `__fcd_watch=${shSingleQuote(watch)}`,
         ``,
-        `# Inspect the WHOLE typed line before accepting it (catches pipes too).`,
+        `# Inspect the WHOLE typed line against every rule before accepting it`,
+        `# (command-agnostic: catches any command, pipes, and chained segments).`,
         `__fcd_zle_accept_line() {`,
         `  emulate -L zsh`,
         `  local __fcd_line=$BUFFER`,
-        `  if [[ -n "$__fcd_line" && "\${FCD_SHELL_GUARD:-}" != "off" ]]; then`,
-        `    local __fcd_first="\${\${(z)__fcd_line}[1]:t}"`,
-        `    if [[ "$__fcd_first" == "sudo" ]]; then`,
-        `      __fcd_first="\${\${(z)__fcd_line}[2]:t}"`,
-        `    fi`,
-        `    if [[ -x "$FCD_GUARD_NODE" && -f "$FCD_GUARD_JS" && "$__fcd_watch" == *" $__fcd_first "* ]]; then`,
-        `      local __fcd_out`,
-        `      __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
-        `      local __fcd_rc=$?`,
-        `      if [[ $__fcd_rc -eq 97 ]]; then`,
-        `        zle -M -- "$__fcd_out"`,
-        `        return`,
-        `      fi`,
-        `      [[ -n "$__fcd_out" ]] && print -u2 -r -- "$__fcd_out"`,
+        `  if [[ -n "$__fcd_line" && "\${FCD_SHELL_GUARD:-}" != "off" && -x "$FCD_GUARD_NODE" && -f "$FCD_GUARD_JS" ]]; then`,
+        `    local __fcd_out`,
+        `    __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `    local __fcd_rc=$?`,
+        `    if [[ $__fcd_rc -eq 97 ]]; then`,
+        `      zle -M -- "$__fcd_out"`,
+        `      return`,
         `    fi`,
+        `    [[ -n "$__fcd_out" ]] && print -u2 -r -- "$__fcd_out"`,
         `  fi`,
         `  zle .accept-line`,
         `}`,
@@ -169,9 +154,19 @@ function buildGuardZsh(nodePath) {
         ``,
     ].join('\n');
 }
-/** bash guard — sourced ONLY from .bashrc/.bash_profile (pure bash/POSIX syntax). */
+/**
+ * bash guard — sourced ONLY from .bashrc/.bash_profile (pure bash syntax).
+ *
+ * Command-agnostic whole-line hook via a DEBUG trap (bash-preexec style). The
+ * trap fires before each command; it reads the FULL interactive line the user
+ * typed from `history` (so pipelines like `curl … | sh` and chained lines like
+ * `foo && rm -rf /` are evaluated as one string, exactly like zsh's accept-line
+ * BUFFER — not per-simple-command). It de-duplicates so the checker runs once
+ * per typed line. With `extdebug` enabled, returning 1 from the DEBUG trap
+ * SKIPS the command — so an explicit block (checker exit 97) prevents execution.
+ * A missing/erroring checker returns 0 → the command runs (fail open).
+ */
 function buildGuardBash(nodePath) {
-    const watch = ` ${WATCHLIST.join(' ')} `;
     return [
         `# FullCourtDefense interactive shell guard for bash (installed by fullcourtdefense-cli).`,
         `# Disable for one session:  export FCD_SHELL_GUARD=off`,
@@ -181,23 +176,41 @@ function buildGuardBash(nodePath) {
         ``,
         `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
         `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
-        `__fcd_watch=${shSingleQuote(watch)}`,
+        `__fcd_last_line=""`,
         ``,
-        `# Wrap a high-risk command. Blocks only on an explicit checker verdict (97);`,
-        `# a missing/erroring checker runs the command (fail open).`,
-        `__fcd_wrap() {`,
-        `  local __fcd_cmd="$1"; shift`,
-        `  if [ "\${FCD_SHELL_GUARD:-}" = "off" ] || [ ! -x "$FCD_GUARD_NODE" ] || [ ! -f "$FCD_GUARD_JS" ]; then`,
-        `    command "$__fcd_cmd" "$@"; return $?`,
+        `# Run the shared checker on one full line. Returns 1 to cancel (extdebug).`,
+        `__fcd_check_line() {`,
+        `  local __fcd_line="$1"`,
+        `  [ -z "$__fcd_line" ] && return 0`,
+        `  [ "\${FCD_SHELL_GUARD:-}" = "off" ] && return 0`,
+        `  if [ ! -x "$FCD_GUARD_NODE" ] || [ ! -f "$FCD_GUARD_JS" ]; then return 0; fi`,
+        `  local __fcd_out __fcd_rc`,
+        `  __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `  __fcd_rc=$?`,
+        `  [ -n "$__fcd_out" ] && printf '%s\\n' "$__fcd_out" >&2`,
+        `  [ "$__fcd_rc" -eq 97 ] && return 1`,
+        `  return 0`,
+        `}`,
+        ``,
+        `# DEBUG trap: skip completions and the guard functions, then read the whole`,
+        `# typed line from history (number stripped) and check it once per line.`,
+        `__fcd_debug_trap() {`,
+        `  [ -n "\${COMP_LINE:-}" ] && return 0`,
+        `  case "$BASH_COMMAND" in __fcd_*|__fcd_debug_trap) return 0 ;; esac`,
+        `  local __fcd_hist __fcd_num __fcd_line HISTTIMEFORMAT=`,
+        `  __fcd_hist=$(builtin history 1 2>/dev/null)`,
+        `  read -r __fcd_num __fcd_line <<< "$__fcd_hist"`,
+        `  [ -z "$__fcd_line" ] && return 0`,
+        `  if [ "$__fcd_line" != "$__fcd_last_line" ]; then`,
+        `    __fcd_last_line="$__fcd_line"`,
+        `    __fcd_check_line "$__fcd_line" || return 1`,
         `  fi`,
-        `  "$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_cmd $*"`,
-        `  if [ "$?" -eq 97 ]; then return 1; fi`,
-        `  command "$__fcd_cmd" "$@"`,
+        `  return 0`,
         `}`,
-        `for __fcd_c in $__fcd_watch; do`,
-        `  eval "\${__fcd_c}() { __fcd_wrap \${__fcd_c} \\"\\$@\\"; }"`,
-        `done`,
-        `unset __fcd_c`,
+        `if [ "\${FCD_SHELL_GUARD:-}" != "off" ]; then`,
+        `  shopt -s extdebug 2>/dev/null || true`,
+        `  trap '__fcd_debug_trap' DEBUG`,
+        `fi`,
         ``,
     ].join('\n');
 }

package/dist/commands/shellGuard.d.ts

@@ -16,6 +16,23 @@ interface ShellGuardRulesFile {
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
 export declare function writeShellGuardRules(): ShellGuardRulesFile;
+/** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
+export declare function activeShellGuardRules(): ShellGuardRule[];
+export interface ShellGuardMatch {
+    rule: ShellGuardRule;
+    /** The command segment that matched (chained commands are split on ; & |). */
+    segment: string;
+}
+/**
+ * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
+ * behind `shell-guard-check`. Uses the exact same rules + JS regex engine as the
+ * live cmd/posix checkers (equivalent to .NET for these patterns). Also splits
+ * chained commands (`a && del /s c:\`) and tests each segment, so combinations
+ * are caught even when the dangerous part is not first.
+ *
+ * Returns ALL matches (one per matched segment/rule), first-match-per-segment.
+ */
+export declare function evaluateShellCommand(line: string, rules?: ShellGuardRule[]): ShellGuardMatch[];
 /**
  * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
  * console mode flip or new custom rule reaches interactive shells within ~30s.

package/dist/commands/shellGuard.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.writeShellGuardRules = writeShellGuardRules;
+exports.activeShellGuardRules = activeShellGuardRules;
+exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
@@ -134,6 +136,12 @@ const BUILTIN_RULES = [
         pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
     { id: 'vssadmin_delete_shadows', category: 'destructive_command', severity: 'critical', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
         pattern: String.raw `\bvssadmin\b(?=.*\bdelete\b)(?=.*\bshadows\b)` },
+    { id: 'wbadmin_delete_backup', category: 'destructive_command', severity: 'critical', reason: 'Windows backup catalog deletion (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bwbadmin\b(?=.*\bdelete\b)(?=.*\b(?:catalog|systemstatebackup|backup)\b)` },
+    { id: 'bcdedit_recovery_disable', category: 'security_tampering', severity: 'critical', reason: 'disabling Windows recovery/boot repair (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bbcdedit\b(?=.*(?:\brecoveryenabled\b\s+no\b|\bbootstatuspolicy\b\s+ignoreallfailures\b))` },
+    { id: 'cipher_wipe_disk', category: 'destructive_command', severity: 'high', reason: 'wiping deleted data from a drive (cipher /w)', source: 'builtin',
+        pattern: String.raw `\bcipher(?:\.exe)?\b(?=.*\s/w(?::|\b))` },
     { id: 'defender_disable', category: 'security_tampering', severity: 'high', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
         pattern: String.raw `\bset-mppreference\b(?=.*-disablerealtimemonitoring)(?=.*(?:\$true|\s1\b))` },
     // Reverse shells / droppers
@@ -330,6 +338,52 @@ function writeShellGuardRules() {
     fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
     return data;
 }
+/** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
+function activeShellGuardRules() {
+    const disabled = cachedDisabledItemIds();
+    return [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()];
+}
+/**
+ * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
+ * behind `shell-guard-check`. Uses the exact same rules + JS regex engine as the
+ * live cmd/posix checkers (equivalent to .NET for these patterns). Also splits
+ * chained commands (`a && del /s c:\`) and tests each segment, so combinations
+ * are caught even when the dangerous part is not first.
+ *
+ * Returns ALL matches (one per matched segment/rule), first-match-per-segment.
+ */
+function evaluateShellCommand(line, rules = activeShellGuardRules()) {
+    const compiled = rules.map(r => {
+        try {
+            return { rule: r, re: new RegExp(r.pattern, 'i') };
+        }
+        catch {
+            return null;
+        }
+    }).filter((x) => !!x);
+    // Whole line first (some rules intentionally span a pipe, e.g. curl | sh),
+    // then each &&/||/;/newline segment (catches "cleanup && del /s c:\").
+    const candidates = [line, ...line.split(/&&|\|\||[;&\n]|\|/).map(s => s.trim()).filter(Boolean)];
+    const seen = new Set();
+    const matches = [];
+    for (const candidate of candidates) {
+        const norm = candidate.replace(/\s+/g, ' ').trim();
+        for (const { rule, re } of compiled) {
+            try {
+                if (re.test(norm) || re.test(candidate)) {
+                    const key = `${rule.id}|${candidate}`;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    matches.push({ rule, segment: candidate });
+                    break; // first rule per segment is enough
+                }
+            }
+            catch { /* skip bad regex */ }
+        }
+    }
+    return matches;
+}
 /**
  * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
  * console mode flip or new custom rule reaches interactive shells within ~30s.

package/dist/index.js

@@ -69,6 +69,7 @@ function readCliVersion() {
 const VERSION = readCliVersion();
 function parseArgs(argv) {
     const flags = {};
+    const positional = [];
     let command = '';
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
@@ -76,6 +77,10 @@ function parseArgs(argv) {
             command = arg;
             continue;
         }
+        if (command && !arg.startsWith('-')) {
+            positional.push(arg);
+            continue;
+        }
         if (arg.startsWith('--')) {
             const key = arg.slice(2);
             const eqIdx = key.indexOf('=');
@@ -105,7 +110,7 @@ function parseArgs(argv) {
             }
         }
     }
-    return { command, flags };
+    return { command, flags, positional };
 }
 function printHelp() {
     console.log(`
@@ -134,6 +139,9 @@ function printHelp() {
                 uninstall-shell-guard removes it; shell-guard-status shows coverage.
     install-cmd-guard      Block dangerous commands typed in cmd.exe (Command Prompt).
                 uninstall-cmd-guard removes it; cmd-guard-status shows coverage.
+    shell-guard-check      Dry-run: test whether a command (or a file/stdin list of
+                commands) would be blocked — nothing is executed. Splits chained
+                commands (a && del /s c:\). --file <path>, --json; exits 1 if any block.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
@@ -350,7 +358,7 @@ function printHelp() {
 `);
 }
 async function main() {
-    const { command, flags } = parseArgs(process.argv.slice(2));
+    const { command, flags, positional } = parseArgs(process.argv.slice(2));
     const buildInstallArgs = () => ({
         clients: flags.clients,
         cursorProject: flags['cursor-project'],
@@ -656,6 +664,62 @@ async function main() {
             console.log('');
             break;
         }
+        case 'shell-guard-check': {
+            // Dry-run classifier — evaluate command(s) against the guard rules WITHOUT
+            // executing anything. Positional args are one command; --file reads one
+            // command per line; no args reads stdin. Exit 1 if ANY command is blocked
+            // (so it can gate CI). --json for machine output.
+            const asJson = flags.json === 'true' || flags.json === '';
+            const lines = [];
+            if (flags.file) {
+                try {
+                    lines.push(...fs.readFileSync(flags.file, 'utf8').split(/\r?\n/));
+                }
+                catch (e) {
+                    console.error(`Cannot read --file: ${e instanceof Error ? e.message : String(e)}`);
+                    process.exit(2);
+                }
+            }
+            else if (positional.length > 0) {
+                lines.push(positional.join(' '));
+            }
+            else if (!process.stdin.isTTY) {
+                lines.push(...fs.readFileSync(0, 'utf8').split(/\r?\n/));
+            }
+            else {
+                console.log('Usage: fullcourtdefense shell-guard-check "<command>"   |   --file cmds.txt   |   echo "<cmd>" | fullcourtdefense shell-guard-check');
+                break;
+            }
+            const cmds = lines.map(l => l.trim()).filter(Boolean);
+            const rules = (0, shellGuard_1.activeShellGuardRules)();
+            let blocked = 0;
+            const results = cmds.map(cmd => {
+                const matches = (0, shellGuard_1.evaluateShellCommand)(cmd, rules);
+                if (matches.length)
+                    blocked++;
+                return { command: cmd, blocked: matches.length > 0, matches: matches.map(m => ({ ruleId: m.rule.id, severity: m.rule.severity, category: m.rule.category, reason: m.rule.reason, segment: m.segment })) };
+            });
+            if (asJson) {
+                console.log(JSON.stringify({ total: cmds.length, blocked, ruleCount: rules.length, results }, null, 2));
+            }
+            else {
+                console.log(`\nEvaluated ${cmds.length} command(s) against ${rules.length} rules (dry-run — nothing executed):\n`);
+                for (const r of results) {
+                    if (r.blocked) {
+                        const m = r.matches[0];
+                        console.log(`  \x1b[31mBLOCK\x1b[0m [\x1b[1m${m.severity}\x1b[0m] ${r.command}`);
+                        console.log(`        \x1b[2m${m.reason} (rule ${m.ruleId})${r.matches.length > 1 ? ` +${r.matches.length - 1} more` : ''}\x1b[0m`);
+                    }
+                    else {
+                        console.log(`  \x1b[32mALLOW\x1b[0m ${r.command}`);
+                    }
+                }
+                console.log(`\n${blocked} blocked, ${cmds.length - blocked} allowed.`);
+            }
+            if (blocked > 0)
+                process.exit(1);
+            break;
+        }
         case 'install-cmd-guard': {
             await (0, cmdGuard_1.installCmdGuardCommand)();
             break;

package/dist/telemetry.js

@@ -155,8 +155,12 @@ async function flushSpool(input) {
         const body = await resp.json().catch(() => ({}));
         if (!body.success)
             return null;
-        // Successfully delivered → drop the flushed events, keep any overflow.
-        rewriteSpool(overflow);
+        // Successfully delivered → drop ONLY the events we actually sent. The spool
+        // may have gained new events while the POST was in flight (e.g. a terminal
+        // guard block landing mid-flush) — rewriting with the pre-flush snapshot
+        // (`overflow`) would silently discard them.
+        const flushedIds = new Set(batch.map(e => e.eventId));
+        rewriteSpool(readSpool().filter(e => !flushedIds.has(e.eventId)));
         return body.data || { accepted: batch.length, deduped: 0 };
     }
     catch {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.13.0"
+  "version": "1.14.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.13.0",
+  "version": "1.14.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {