fullcourtdefense-cli 1.21.40 → 1.22.0

package/dist/commands/cmdGuard.js

@@ -117,14 +117,15 @@ function buildGuardJs(nodePath, cliEntry) {
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();for(const r of rules){try{if(r.re.test(n)||r.re.test(line))return r;}catch{}}return null;}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
         `const line=args.join(' ');const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)delegate(args);`,
         `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');delegate(args);}`,
+        `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(1);`,

package/dist/commands/daemon.js

@@ -718,23 +718,22 @@ async function runDaemon(args, config) {
         executingActionIds.add(action.id);
         // Cryptographic gate: never execute an action the control plane didn't
         // sign — a Firestore/backend compromise must not become fleet-wide RCE.
-        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action);
+        // Machine binding is enforced too: a correctly signed action targeting a
+        // DIFFERENT machine is rejected (bundle fetches send this machine's id, so
+        // a mismatch means misrouting/replay, not normal operation). Legacy fleets
+        // whose enrolled fingerprint drifted can set FCD_MACHINE_ACTION_ANY_MACHINE_OK=1
+        // locally while they re-enroll.
+        const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
+        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId });
         if (!verdict.ok) {
             log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
-            await reportMachineAction(action.id, 'failed', { error: `Signature verification failed: ${verdict.reason}` });
+            await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` });
             executingActionIds.delete(action.id);
             await uploadLogTail();
             return;
         }
         if (verdict.reason)
-            log(`Remote action signature notice: ${verdict.reason}`);
-        const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
-        if (action.machineId && action.machineId !== localIdentity.machineId) {
-            // Warn-only for now: enrolled machines can carry legacy fingerprints that
-            // differ from the freshly computed identity. Tighten to reject once the
-            // fleet is fully on stable machine ids.
-            log(`Remote action machine-binding notice: action targets ${action.machineId}, local id is ${localIdentity.machineId}.`);
-        }
+            log(`Remote action verification notice: ${verdict.reason}`);
         await reportMachineAction(action.id, 'running');
         log(`Remote action started: ${action.type} (${action.id}).`);
         await uploadLogTail();

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,15 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot';
+/**
+ * Per-rule enforcement action (org-configured, shipped in the Local Safety
+ * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and
+ * older snapshots know, so mixed fleets stay fail-strict.
+ *  - 'block' — stop the action (today's behavior).
+ *  - 'warn'  — let the action proceed; surface + report the finding as a warning.
+ *  - 'mask'  — redact the matched secret where the surface can rewrite content
+ *    (MCP tool responses); surfaces that cannot rewrite treat it as block.
+ */
+export type LocalSafetyRuleAction = 'block' | 'warn' | 'mask';
 export interface DeterministicFinding {
     blocked: true;
     ruleId: string;
@@ -11,15 +21,26 @@ export interface DeterministicFinding {
     evidence: string;
     explanation?: string;
     policyHash?: string;
+    /** Org-configured enforcement action for the matched rule. Absent = 'block'. */
+    action?: LocalSafetyRuleAction;
+    /**
+     * The exact matched secret string, present only for secret_exfiltration
+     * findings — the seam 'mask' uses to redact tool responses. Never spooled.
+     */
+    matchedSecret?: string;
 }
 export interface LocalSafetyCustomBlock {
     id: string;
     categoryId: string;
     pattern: string;
     explanation?: string;
+    /** Absent = 'block'. */
+    action?: LocalSafetyRuleAction;
 }
 export interface LocalSafetyScanOptions {
     disabledBuiltInItemIds?: string[];
+    /** Built-in items with a NON-default action (absent item = 'block'). */
+    itemActions?: Record<string, LocalSafetyRuleAction>;
     customBlocks?: LocalSafetyCustomBlock[];
     policyHash?: string;
     cwd?: string;
@@ -37,3 +58,36 @@ export interface LocalSafetyScanOptions {
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
+export interface DeterministicScanOutcome {
+    /** The finding that stops the action, if any. */
+    blockingFinding?: DeterministicFinding;
+    /** warn-action findings that matched — the action proceeds; report these. */
+    warnings: DeterministicFinding[];
+}
+export interface DeterministicTextResponseOutcome extends DeterministicScanOutcome {
+    /** mask-action secret findings that WERE redacted from the text. */
+    maskFindings: DeterministicFinding[];
+    /** The response text with every masked secret redacted. */
+    maskedText: string;
+}
+/**
+ * Resolve a scan under per-rule actions WITHOUT letting a warn rule shadow a
+ * block rule. Scans return the FIRST match, so a single pass would let one
+ * warn-mode rule hide a second, block-mode rule matching the same value. This
+ * re-scans with each warn rule suppressed until a blocking finding surfaces or
+ * nothing matches. Default (no itemActions configured) is a single pass
+ * returning today's behavior exactly.
+ *
+ * 'mask' degrades to block here: these surfaces (tool calls, prompts, shell
+ * commands) cannot rewrite content, so mask can only fail strict.
+ */
+export declare function resolveDeterministicOutcome(scan: (options?: LocalSafetyScanOptions) => DeterministicFinding | undefined, options?: LocalSafetyScanOptions): DeterministicScanOutcome;
+/**
+ * Resolve a TOOL RESPONSE under per-rule actions. The response is the one
+ * surface that can be rewritten, so 'mask' redacts here: each masked secret is
+ * replaced in the text and the REDACTED text is rescanned — a second secret of
+ * the same type is still found (rule suppression would hide it). Warn rules
+ * are suppressed as in resolveDeterministicOutcome. Any 'block' rule match
+ * blocks regardless of what was masked before it.
+ */
+export declare function resolveDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicTextResponseOutcome;

package/dist/commands/deterministicGuard.js

@@ -36,6 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
+exports.resolveDeterministicOutcome = resolveDeterministicOutcome;
+exports.resolveDeterministicTextResponse = resolveDeterministicTextResponse;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -190,6 +192,15 @@ const DEFAULT_DISABLED_BUILT_INS = new Set([
     // IDE). Off by default — orgs opt in via the Local Safety console toggle,
     // which the runtime snapshot then applies on every machine.
     'contextual_secret',
+    // Cloud token printers / secret fetchers used constantly by LEGITIMATE
+    // deploy tooling and dev loops. Off by default; orgs with stricter posture
+    // opt in via the console. (The rarely-legitimate forms — gh auth token,
+    // git credential fill, keychain dumps — are ON by default.)
+    'gcloud_access_token_cmd',
+    'gcloud_secret_access_cmd',
+    'az_access_token_cmd',
+    'aws_secret_fetch_cmd',
+    'vault_read_cmd',
 ]);
 function evidence(value) {
     const compact = value.replace(/\s+/g, ' ').trim();
@@ -247,6 +258,10 @@ function disabled(options) {
 function isEnabled(itemId, options) {
     return !disabled(options).has(itemId);
 }
+function actionFor(itemId, options) {
+    const action = options?.itemActions?.[itemId];
+    return action === 'warn' || action === 'mask' ? action : 'block';
+}
 function builtIn(itemId, categoryId, category, ruleId, reason, findingEvidence, explanation, options) {
     if (!isEnabled(itemId, options))
         return undefined;
@@ -261,6 +276,7 @@ function builtIn(itemId, categoryId, category, ruleId, reason, findingEvidence,
         evidence: evidence(findingEvidence),
         explanation,
         policyHash: options?.policyHash,
+        action: actionFor(itemId, options),
     };
 }
 /**
@@ -301,6 +317,7 @@ function honeypotTouch(value, options) {
                 reason: 'Blocked access to a decoy credential file (honeypot). No legitimate tool uses this file — this indicates credential-hunting behavior.',
                 evidence: evidence(value),
                 policyHash: options?.policyHash,
+                action: actionFor('honeypot_decoy_access', options),
             };
         }
     }
@@ -323,6 +340,7 @@ function customBlock(value, options) {
             evidence: evidence(value),
             explanation: block.explanation,
             policyHash: options?.policyHash,
+            action: block.action === 'warn' || block.action === 'mask' ? block.action : 'block',
         };
     }
     return undefined;
@@ -348,6 +366,20 @@ function containsSensitiveCredentialPath(value) {
         { itemId: 'aws_credentials', label: 'AWS credentials', re: /(?:^|\/)\.aws\/(?:credentials|config)(?:$|[/?#\s'"])/ },
         { itemId: 'kube_config', label: 'Kubernetes config', re: /(?:^|\/)\.kube\/config(?:$|[/?#\s'"])/ },
         { itemId: 'docker_auth', label: 'Docker auth config', re: /(?:^|\/)\.docker\/config\.json(?:$|[/?#\s'"])/ },
+        // GitHub CLI stores its OAuth token in hosts.yml — ~/.config/gh/ on Unix,
+        // AppData/Roaming/GitHub CLI/ on Windows (normalized+lowercased upstream).
+        { itemId: 'github_cli_token', label: 'GitHub CLI token', re: /(?:^|\/)(?:gh|github cli)\/hosts\.yml(?:$|[/?#\s'"])/ },
+        { itemId: 'git_credentials', label: 'Git plaintext credentials', re: /(?:^|\/)\.git-credentials(?:$|[/?#\s'"])/ },
+        { itemId: 'gcloud_credentials', label: 'gcloud credential store', re: /(?:^|\/)gcloud\/(?:credentials\.db|access_tokens\.db|legacy_credentials)(?:$|[/?#\s'"])/ },
+        { itemId: 'azure_tokens', label: 'Azure token cache', re: /(?:^|\/)\.azure\/(?:msal_token_cache|accesstokens\.json)/ },
+        { itemId: 'gnupg_private_keys', label: 'GnuPG private keys', re: /(?:^|\/)\.gnupg\/(?:private-keys-v1\.d|secring\.gpg)(?:$|[/?#\s'"])/ },
+        { itemId: 'pgpass', label: 'PostgreSQL password file', re: /(?:^|\/)(?:\.pgpass|pgpass\.conf)(?:$|[/?#\s'"])/ },
+        { itemId: 'mysql_cnf', label: 'MySQL credentials file', re: /(?:^|\/)\.my\.cnf(?:$|[/?#\s'"])/ },
+        { itemId: 'terraform_credentials', label: 'Terraform credentials', re: /credentials\.tfrc\.json(?:$|[/?#\s'"])/ },
+        { itemId: 'huggingface_token', label: 'Hugging Face token', re: /(?:^|\/)\.?huggingface\/token(?:$|[/?#\s'"])/ },
+        { itemId: 'cargo_credentials', label: 'Cargo registry credentials', re: /(?:^|\/)\.cargo\/credentials(?:\.toml)?(?:$|[/?#\s'"])/ },
+        { itemId: 'gem_credentials', label: 'RubyGems credentials', re: /(?:^|\/)\.gem\/credentials(?:$|[/?#\s'"])/ },
+        { itemId: 'composer_auth', label: 'Composer auth tokens', re: /(?:^|\/)\.composer\/auth\.json(?:$|[/?#\s'"])/ },
         { itemId: 'npmrc', label: 'npm credentials', re: /(?:^|\/)\.npmrc(?:$|[/?#\s'"])/ },
         { itemId: 'pypirc', label: 'PyPI credentials', re: /(?:^|\/)\.pypirc(?:$|[/?#\s'"])/ },
         { itemId: 'netrc', label: 'netrc credentials', re: /(?:^|\/)\.netrc(?:$|[/?#\s'"])/ },
@@ -369,6 +401,47 @@ function containsSensitiveCredentialPath(value) {
     }
     return undefined;
 }
+/**
+ * Commands that PRINT stored credentials to stdout — the file-path rules are
+ * useless against them because the secret never comes from a watched file
+ * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
+ * rarely-legitimate-for-agents forms are on by default; cloud token printers
+ * that legitimate deploy tooling uses constantly are strict (off by default).
+ */
+function credentialCommandReason(value) {
+    const lower = normalizeForCommand(value).toLowerCase();
+    if (/\bgh\s+auth\s+token\b/.test(lower) || (/\bgh\s+auth\s+status\b/.test(lower) && /(?:--show-token|\s-t\b)/.test(lower))) {
+        return { itemId: 'gh_auth_token_cmd', reason: 'GitHub CLI token print (gh auth token)' };
+    }
+    if (/\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b/.test(lower)) {
+        return { itemId: 'git_credential_fill', reason: 'git credential helper dump' };
+    }
+    if (/\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b/.test(lower) || /\bsecurity\s+dump-keychain\b/.test(lower)) {
+        return { itemId: 'macos_keychain_dump', reason: 'macOS keychain password dump' };
+    }
+    if (/\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b/.test(lower)) {
+        return { itemId: 'kubectl_config_raw', reason: 'raw kubeconfig dump (kubectl config view --raw)' };
+    }
+    if (/\baws\s+configure\s+export-credentials\b/.test(lower) || /\baws\s+configure\s+get\b[^\n;|&]*secret/.test(lower)) {
+        return { itemId: 'aws_export_credentials', reason: 'AWS secret access key export' };
+    }
+    if (/\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b/.test(lower)) {
+        return { itemId: 'gcloud_access_token_cmd', reason: 'gcloud access-token print' };
+    }
+    if (/\bgcloud\s+secrets\s+versions\s+access\b/.test(lower)) {
+        return { itemId: 'gcloud_secret_access_cmd', reason: 'GCP Secret Manager read' };
+    }
+    if (/\baz\s+account\s+get-access-token\b/.test(lower)) {
+        return { itemId: 'az_access_token_cmd', reason: 'Azure access-token print' };
+    }
+    if (/\baws\s+secretsmanager\s+get-secret-value\b/.test(lower) || /\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b/.test(lower)) {
+        return { itemId: 'aws_secret_fetch_cmd', reason: 'AWS secret fetch' };
+    }
+    if (/\bvault\s+(?:kv\s+get|read)\b/.test(lower)) {
+        return { itemId: 'vault_read_cmd', reason: 'Vault secret read' };
+    }
+    return undefined;
+}
 function destructiveCommandReason(value) {
     const text = normalizeForCommand(value);
     const lower = text.toLowerCase();
@@ -536,6 +609,12 @@ function scanTextValue(toolName, value, options) {
     if (reverseShell) {
         return builtIn(reverseShell.itemId, 'reverse_shells', 'reverse_shell', 'local-reverse-shell', `Blocked ${reverseShell.reason}.`, value, reverseShell.reason, options);
     }
+    const credentialCmd = credentialCommandReason(value);
+    if (credentialCmd) {
+        const finding = builtIn(credentialCmd.itemId, 'credential_commands', 'credential_command', 'local-credential-command', `Blocked credential-revealing command: ${credentialCmd.reason}.`, value, credentialCmd.reason, options);
+        if (finding)
+            return finding;
+    }
     const destructive = destructiveCommandReason(value);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
@@ -608,7 +687,8 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
                 || contextualSecretFromKeyPath(candidate.keyPath, candidate.value)
                 || findContextualSecret(candidate.value);
             if (secret) {
-                return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-exfiltration', `Blocked outbound data containing ${secret.label}.`, secret.value, secret.label, options);
+                const finding = builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-exfiltration', `Blocked outbound data containing ${secret.label}.`, secret.value, secret.label, options);
+                return finding ? { ...finding, matchedSecret: secret.value } : undefined;
             }
         }
     }
@@ -623,7 +703,8 @@ function scanDeterministicTextResponse(text, options) {
     const secret = findSecret(text) || findContextualSecret(text);
     if (!secret)
         return undefined;
-    return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-in-tool-response', `Blocked tool response containing ${secret.label}.`, secret.value, secret.label, options);
+    const finding = builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-in-tool-response', `Blocked tool response containing ${secret.label}.`, secret.value, secret.label, options);
+    return finding ? { ...finding, matchedSecret: secret.value } : undefined;
 }
 function looksLikeQuestion(value) {
     return /^(?:what|why|how|explain|describe|is|are|can you explain)\b/i.test(value.trim());
@@ -667,6 +748,12 @@ function scanDeterministicPrompt(text, options) {
         if (reverseShell) {
             return builtIn(reverseShell.itemId, 'reverse_shells', 'reverse_shell', 'local-prompt-reverse-shell', `Blocked prompt containing ${reverseShell.reason}.`, trimmed, reverseShell.reason, options);
         }
+        const credentialCmd = credentialCommandReason(trimmed);
+        if (credentialCmd) {
+            const finding = builtIn(credentialCmd.itemId, 'credential_commands', 'credential_command', 'local-prompt-credential-command', `Blocked prompt containing ${credentialCmd.reason}.`, trimmed, credentialCmd.reason, options);
+            if (finding)
+                return finding;
+        }
         const destructive = destructiveCommandReason(trimmed);
         if (destructive) {
             return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-prompt-destructive-command', `Blocked prompt containing ${destructive.reason}.`, trimmed, destructive.reason, options);
@@ -706,6 +793,9 @@ function referencedScripts(command, cwd) {
     const tokens = splitCommand(command);
     const scripts = [];
     const runners = new Set(['bash', 'sh', 'zsh', 'python', 'python3', 'node', 'pwsh']);
+    // Wrappers that still EXECUTE the script that follows them ("sudo ./x.sh").
+    const execPrefixes = new Set(['sudo', 'time', 'nohup', 'exec', 'call', 'source', '.']);
+    const startsNewCommand = (prev) => prev === undefined || /[;&|]$/.test(prev) || execPrefixes.has(path.basename(prev).toLowerCase());
     for (let i = 0; i < tokens.length; i++) {
         const token = path.basename(tokens[i]).toLowerCase();
         if (runners.has(token)) {
@@ -719,9 +809,16 @@ function referencedScripts(command, cwd) {
             if (resolved)
                 scripts.push(resolved);
         }
-        const direct = safeResolveScriptPath(tokens[i], cwd);
-        if (direct)
-            scripts.push(direct);
+        // A bare script path only EXECUTES when it is the command word itself
+        // ("./deploy.sh --prod", "sudo ./x.sh", "a.sh && b.sh"). A script path that
+        // is an ARGUMENT of another command ("git add guard.test.js",
+        // "code scripts/x.py") is inert — content-scanning those blocked ordinary
+        // version-control and editor commands on our own test fixtures.
+        if (startsNewCommand(tokens[i - 1])) {
+            const direct = safeResolveScriptPath(tokens[i], cwd);
+            if (direct)
+                scripts.push(direct);
+        }
     }
     if (tokens[0]?.toLowerCase() === 'npm' && tokens[1]?.toLowerCase() === 'run' && tokens[2]) {
         const pkg = path.resolve(cwd || process.cwd(), 'package.json');
@@ -817,3 +914,83 @@ function scanReferencedScript(command, cwd, options) {
     }
     return undefined;
 }
+const MAX_ACTION_PASSES = 10;
+function withRuleSuppressed(options, finding) {
+    if (finding.source === 'custom') {
+        return {
+            ...(options || {}),
+            customBlocks: (options?.customBlocks || []).filter(block => block.id !== finding.itemId),
+        };
+    }
+    const baseDisabled = options?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+    return { ...(options || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
+}
+function findingAction(finding) {
+    return finding.action === 'warn' || finding.action === 'mask' ? finding.action : 'block';
+}
+/**
+ * Resolve a scan under per-rule actions WITHOUT letting a warn rule shadow a
+ * block rule. Scans return the FIRST match, so a single pass would let one
+ * warn-mode rule hide a second, block-mode rule matching the same value. This
+ * re-scans with each warn rule suppressed until a blocking finding surfaces or
+ * nothing matches. Default (no itemActions configured) is a single pass
+ * returning today's behavior exactly.
+ *
+ * 'mask' degrades to block here: these surfaces (tool calls, prompts, shell
+ * commands) cannot rewrite content, so mask can only fail strict.
+ */
+function resolveDeterministicOutcome(scan, options) {
+    const warnings = [];
+    let current = options;
+    for (let pass = 0; pass < MAX_ACTION_PASSES; pass++) {
+        const finding = scan(current);
+        if (!finding)
+            return { warnings };
+        if (findingAction(finding) !== 'warn')
+            return { blockingFinding: finding, warnings };
+        warnings.push(finding);
+        current = withRuleSuppressed(current, finding);
+    }
+    // Pass budget exhausted with matches still appearing — fail strict.
+    const last = scan(current);
+    return last ? { blockingFinding: last, warnings } : { warnings };
+}
+/**
+ * Resolve a TOOL RESPONSE under per-rule actions. The response is the one
+ * surface that can be rewritten, so 'mask' redacts here: each masked secret is
+ * replaced in the text and the REDACTED text is rescanned — a second secret of
+ * the same type is still found (rule suppression would hide it). Warn rules
+ * are suppressed as in resolveDeterministicOutcome. Any 'block' rule match
+ * blocks regardless of what was masked before it.
+ */
+function resolveDeterministicTextResponse(text, options) {
+    const warnings = [];
+    const maskFindings = [];
+    let currentOptions = options;
+    let currentText = text;
+    for (let pass = 0; pass < MAX_ACTION_PASSES; pass++) {
+        const finding = scanDeterministicTextResponse(currentText, currentOptions);
+        if (!finding)
+            return { warnings, maskFindings, maskedText: currentText };
+        const action = findingAction(finding);
+        if (action === 'block')
+            return { blockingFinding: finding, warnings, maskFindings, maskedText: currentText };
+        if (action === 'mask') {
+            if (!finding.matchedSecret || !currentText.includes(finding.matchedSecret)) {
+                // Nothing concrete to redact — mask degrades to block, never to allow.
+                return { blockingFinding: finding, warnings, maskFindings, maskedText: currentText };
+            }
+            maskFindings.push(finding);
+            currentText = currentText.split(finding.matchedSecret).join(`[REDACTED:${finding.itemId}]`);
+        }
+        else {
+            warnings.push(finding);
+            currentOptions = withRuleSuppressed(currentOptions, finding);
+        }
+    }
+    // Pass budget exhausted with matches still appearing — fail strict.
+    const last = scanDeterministicTextResponse(currentText, currentOptions);
+    return last
+        ? { blockingFinding: last, warnings, maskFindings, maskedText: currentText }
+        : { warnings, maskFindings, maskedText: currentText };
+}

package/dist/commands/hook.js

@@ -545,7 +545,7 @@ function localBlockUserMessage(finding) {
 }
 function spoolLocalFinding(input) {
     (0, telemetry_1.spoolEvent)({
-        decision: 'block',
+        decision: input.decision || 'block',
         toolName: input.toolName,
         operation: input.operation,
         reason: input.finding.reason,
@@ -561,6 +561,16 @@ function spoolLocalFinding(input) {
     });
     (0, telemetry_1.triggerFlush)(true);
 }
+/**
+ * warn-action rule matches: the action PROCEEDS — spool each finding as a
+ * 'warn' event so it lands in the org console/timeline without stopping work.
+ */
+function spoolLocalWarnings(warnings, toolName, operation) {
+    for (const finding of warnings) {
+        dbg({ phase: 'local_deterministic_warn', tool: toolName, ruleId: finding.ruleId, itemId: finding.itemId });
+        spoolLocalFinding({ finding, toolName, operation, decision: 'warn' });
+    }
+}
 async function hookCommand(args, config) {
     // Mode is server-authoritative (pulled from the cached runtime bundle), with
     // local flags as explicit overrides. Resolved after creds below.
@@ -768,7 +778,9 @@ async function hookCommand(args, config) {
             machineName: os.hostname(),
             expectedPolicyHash: effectivePolicyHash,
         });
-        const localBlock = (0, deterministicGuard_1.scanDeterministicPrompt)(text, (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+        const promptOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicPrompt)(text, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+        spoolLocalWarnings(promptOutcome.warnings, 'prompt', 'prompt');
+        const localBlock = promptOutcome.blockingFinding;
         if (localBlock) {
             dbg({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
             if (shadow) {
@@ -809,10 +821,12 @@ async function enforceActionPolicy(ctx) {
         machineName: os.hostname(),
         expectedPolicyHash: effectivePolicyHash,
     });
-    const localBlock = (0, deterministicGuard_1.scanDeterministicToolCall)(call.toolName, call.toolArgs, (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot, {
+    const toolOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(call.toolName, call.toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot, {
         cwd: typeof call.toolArgs.cwd === 'string' ? call.toolArgs.cwd : process.cwd(),
         inspectScripts: event === 'shell',
     }));
+    spoolLocalWarnings(toolOutcome.warnings, call.toolName, event);
+    const localBlock = toolOutcome.blockingFinding;
     if (localBlock) {
         dbg({ phase: 'local_deterministic_block', event, tool: call.toolName, ruleId: localBlock.ruleId, category: localBlock.category });
         if (shadow) {

package/dist/commands/mcpGateway.js

@@ -310,6 +310,43 @@ function contentToText(result) {
         return String(result);
     }
 }
+/**
+ * Redact mask-action secrets from an MCP tool result IN PLACE of blocking it.
+ * Only the shapes contentToText() reads are rewritable (plain string, text
+ * content items); anything else reports fullyMasked=false and the caller
+ * blocks — mask must never leak the secret it exists to hide.
+ */
+function maskToolResult(result, maskFindings) {
+    const secrets = maskFindings
+        .map(finding => ({ secret: finding.matchedSecret, replacement: `[REDACTED:${finding.itemId}]` }))
+        .filter((entry) => Boolean(entry.secret));
+    const redact = (text) => {
+        let out = text;
+        for (const { secret, replacement } of secrets)
+            out = out.split(secret).join(replacement);
+        return out;
+    };
+    let masked = result;
+    if (typeof result === 'string') {
+        masked = redact(result);
+    }
+    else {
+        const content = result?.content;
+        if (Array.isArray(content)) {
+            masked = {
+                ...result,
+                content: content.map(item => (item?.type === 'text' && typeof item.text === 'string')
+                    ? { ...item, text: redact(item.text) }
+                    : item),
+            };
+        }
+    }
+    // Fail-strict verification: every masked secret must be gone from what a
+    // client would actually read out of this result.
+    const remaining = contentToText(masked);
+    const fullyMasked = secrets.every(({ secret }) => !remaining.includes(secret));
+    return { masked, fullyMasked };
+}
 class StdioMcpClient {
     child;
     buffer = '';
@@ -748,9 +785,9 @@ class McpGatewayServer {
         await this.downstreamReady;
     }
     /** Spool a locally-enforced deterministic block so it reaches Live Enforcement even offline. */
-    spoolLocalFinding(finding, toolName, operation) {
+    spoolLocalFinding(finding, toolName, operation, decision = 'block') {
         (0, telemetry_1.spoolEvent)({
-            decision: 'block',
+            decision,
             toolName,
             operation,
             reason: finding.reason,
@@ -764,7 +801,7 @@ class McpGatewayServer {
             policyHash: finding.policyHash,
             offlineEnforced: true,
         });
-        (0, telemetry_1.triggerFlush)(true);
+        (0, telemetry_1.triggerFlush)(decision === 'block');
     }
     async handleToolCall(params) {
         await this.ensureDownstream();
@@ -833,7 +870,12 @@ class McpGatewayServer {
                 machineName: os.hostname(),
                 expectedPolicyHash,
             });
-            const localBlock = (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+            const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+            for (const warning of requestOutcome.warnings) {
+                this.spoolLocalFinding(warning, toolName, operation, 'warn');
+                process.stderr.write(`AgentGuard warning (${warning.itemId}): ${warning.reason}\n`);
+            }
+            const localBlock = requestOutcome.blockingFinding;
             if (localBlock) {
                 this.spoolLocalFinding(localBlock, toolName, operation);
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
@@ -933,13 +975,34 @@ class McpGatewayServer {
                     throw new Error(parts.join(' | '));
                 }
             }
-            const rawResult = await this.downstream.callTool(toolName, toolArgs);
-            const localResponseBlock = (0, deterministicGuard_1.scanDeterministicTextResponse)(contentToText(rawResult), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+            let rawResult = await this.downstream.callTool(toolName, toolArgs);
+            const responseOutcome = (0, deterministicGuard_1.resolveDeterministicTextResponse)(contentToText(rawResult), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
+            for (const warning of responseOutcome.warnings) {
+                this.spoolLocalFinding(warning, toolName, operation, 'warn');
+                process.stderr.write(`AgentGuard warning (${warning.itemId}): ${warning.reason}\n`);
+            }
+            const localResponseBlock = responseOutcome.blockingFinding;
             if (localResponseBlock) {
                 this.spoolLocalFinding(localResponseBlock, toolName, operation);
                 const responseOrigin = localResponseBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
                 throw new Error(`${localResponseBlock.reason} (${responseOrigin} "${localResponseBlock.itemId}", ${localResponseBlock.ruleId}: ${localResponseBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
             }
+            if (responseOutcome.maskFindings.length > 0) {
+                // mask-action rules: redact the matched secrets in place. If the result
+                // shape cannot be rewritten (secret hidden in a non-text payload), fail
+                // strict and block — a mask rule must never leak what it was set to hide.
+                const { masked, fullyMasked } = maskToolResult(rawResult, responseOutcome.maskFindings);
+                if (!fullyMasked) {
+                    const finding = responseOutcome.maskFindings[0];
+                    this.spoolLocalFinding(finding, toolName, operation);
+                    throw new Error(`${finding.reason} (rule "${finding.itemId}" is set to mask, but this tool response could not be rewritten — blocked instead.)`);
+                }
+                rawResult = masked;
+                for (const finding of responseOutcome.maskFindings) {
+                    this.spoolLocalFinding(finding, toolName, operation, 'mask');
+                    process.stderr.write(`AgentGuard masked a ${finding.itemId} in the ${toolName} response.\n`);
+                }
+            }
             const finalResult = this.gatewayConfig.scanResponse
                 ? await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult })
                 : rawResult;

package/dist/commands/posixShellGuard.js

@@ -103,8 +103,8 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();for(const r of rules){try{if(r.re.test(n)||r.re.test(line))return r;}catch{}}return null;}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
@@ -113,6 +113,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)process.exit(0);`,
         `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');process.exit(0);}`,
+        `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(BLOCK_CODE);`,

package/dist/commands/shellGuard.d.ts

@@ -8,6 +8,13 @@ export interface ShellGuardRule {
     pattern: string;
     reason: string;
     source: 'builtin' | 'custom';
+    /**
+     * Per-rule enforcement action from the console (Local Safety). Absent =
+     * 'block'. 'warn' → yellow notice, the command still runs (like monitor
+     * mode, but for this one rule). 'mask' is meaningless for a typed command
+     * and degrades to block.
+     */
+    action?: 'block' | 'warn';
 }
 interface ShellGuardRulesFile {
     updatedAt: string;

package/dist/commands/shellGuard.js

@@ -287,6 +287,44 @@ function cachedDisabledItemIds() {
     catch { /* no snapshot cache yet */ }
     return disabled;
 }
+/**
+ * Per-item enforcement actions from the cached local-safety snapshots. Only
+ * 'warn' survives here: 'mask' cannot rewrite a typed command (degrades to
+ * block by omission), and cross-snapshot conflicts resolve fail-strict — an
+ * explicit 'block' anywhere wins over a 'warn' elsewhere.
+ */
+function cachedItemActions() {
+    const warn = new Set();
+    const blocked = new Set();
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const actions = parsed?.snapshot?.itemActions;
+                if (!actions || typeof actions !== 'object')
+                    continue;
+                for (const [itemId, action] of Object.entries(actions)) {
+                    if (typeof itemId !== 'string' || !itemId)
+                        continue;
+                    if (action === 'warn')
+                        warn.add(itemId);
+                    else
+                        blocked.add(itemId);
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    const result = new Map();
+    for (const itemId of warn) {
+        if (!blocked.has(itemId))
+            result.set(itemId, 'warn');
+    }
+    return result;
+}
 /** Org custom block patterns from the cached local-safety snapshots (offline read). */
 function cachedCustomRules() {
     const rules = [];
@@ -311,6 +349,8 @@ function cachedCustomRules() {
                         pattern: escapeDotNetRegex(block.pattern.trim()),
                         reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
                         source: 'custom',
+                        // 'mask' cannot rewrite a typed command — only 'warn' relaxes here.
+                        ...(block.action === 'warn' ? { action: 'warn' } : {}),
                     });
                 }
             }
@@ -328,21 +368,27 @@ function cachedCustomRules() {
         return true;
     });
 }
+/** Builtins minus dashboard-disabled, with per-rule console actions applied. */
+function effectiveBuiltinRules() {
+    const disabled = cachedDisabledItemIds();
+    const itemActions = cachedItemActions();
+    return BUILTIN_RULES
+        .filter(rule => !disabled.has(rule.id))
+        .map(rule => itemActions.get(rule.id) === 'warn' ? { ...rule, action: 'warn' } : rule);
+}
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
 function writeShellGuardRules() {
-    const disabled = cachedDisabledItemIds();
     const data = {
         updatedAt: new Date().toISOString(),
         mode: cachedMode(),
-        rules: [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()],
+        rules: [...effectiveBuiltinRules(), ...cachedCustomRules()],
     };
     fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
     return data;
 }
 /** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
 function activeShellGuardRules() {
-    const disabled = cachedDisabledItemIds();
-    return [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()];
+    return [...effectiveBuiltinRules(), ...cachedCustomRules()];
 }
 /**
  * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
@@ -428,6 +474,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `          Severity = [string]$_.severity`,
         `          Reason   = [string]$_.reason`,
         `          Source   = [string]$_.source`,
+        `          Action   = $(if ([string]$_.action -eq 'warn') { 'warn' } else { 'block' })`,
         `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
         `        }`,
         `      } catch { $null }`,
@@ -439,12 +486,17 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  param([string]$CommandLine)`,
         `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
         `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  $warnHit = $null`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
-        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) { return $rule }`,
+        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) {`,
+        `        # A block rule always outranks a warn rule matching the same line.`,
+        `        if ($rule.Action -ne 'warn') { return $rule }`,
+        `        if ($null -eq $warnHit) { $warnHit = $rule }`,
+        `      }`,
         `    } catch { }`,
         `  }`,
-        `  return $null`,
+        `  return $warnHit`,
         `}`,
         ``,
         `function global:Write-FcdGuardEvent {`,
@@ -495,6 +547,14 @@ function buildGuardPs1(nodePath, cliEntry) {
         `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
         `        return`,
         `      }`,
+        `      # Per-rule 'warn' action from the console: notice + the command runs.`,
+        `      if ($hit.Action -eq 'warn') {`,
+        `        Write-Host ''`,
+        `        Write-Host ('[FullCourtDefense] warning [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ') — allowed by org policy, reported to your security dashboard.') -ForegroundColor Yellow`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'warn'`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `        return`,
+        `      }`,
         `      [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
         `      Write-Host ''`,
         `      Write-Host ('[FullCourtDefense] BLOCKED [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,

package/dist/localSafetySnapshot.d.ts

@@ -1,7 +1,9 @@
-import { LocalSafetyCustomBlock, LocalSafetyScanOptions } from './commands/deterministicGuard';
+import { LocalSafetyCustomBlock, LocalSafetyRuleAction, LocalSafetyScanOptions } from './commands/deterministicGuard';
 export interface LocalSafetySnapshot {
     policyHash: string;
     disabledBuiltInItemIds: string[];
+    /** Built-in items with a NON-default enforcement action (absent = 'block'). */
+    itemActions?: Record<string, LocalSafetyRuleAction>;
     customBlocks: LocalSafetyCustomBlock[];
     /** Org-managed trusted script paths — content scanning skipped under these. */
     trustedScriptPaths?: string[];

package/dist/localSafetySnapshot.js

@@ -67,14 +67,29 @@ function writeCache(file, snapshot) {
     }
     catch { /* best-effort */ }
 }
+function toRuleAction(value) {
+    return value === 'warn' || value === 'mask' ? value : undefined;
+}
 function toSnapshot(data) {
     if (!data || typeof data !== 'object')
         return undefined;
+    // Only non-default ('warn'/'mask') entries are kept — anything unrecognized
+    // falls back to 'block', so a malformed value can only fail strict.
+    let itemActions;
+    if (data.itemActions && typeof data.itemActions === 'object' && !Array.isArray(data.itemActions)) {
+        for (const [itemId, raw] of Object.entries(data.itemActions)) {
+            const action = toRuleAction(raw);
+            if (!action)
+                continue;
+            (itemActions ||= {})[itemId] = action;
+        }
+    }
     return {
         policyHash: typeof data.policyHash === 'string' ? data.policyHash : '',
         disabledBuiltInItemIds: Array.isArray(data.disabledBuiltInItemIds)
             ? data.disabledBuiltInItemIds.filter((item) => typeof item === 'string')
             : [],
+        itemActions,
         customBlocks: Array.isArray(data.customBlocks)
             ? data.customBlocks
                 .filter((item) => item && typeof item.pattern === 'string')
@@ -83,6 +98,7 @@ function toSnapshot(data) {
                 categoryId: String(item.categoryId || 'custom'),
                 pattern: String(item.pattern),
                 explanation: typeof item.explanation === 'string' ? item.explanation : undefined,
+                action: toRuleAction(item.action),
             }))
             : [],
         trustedScriptPaths: Array.isArray(data.trustedScriptPaths)
@@ -134,6 +150,7 @@ async function loadLocalSafetySnapshot(input) {
 function snapshotToScanOptions(snapshot, extra = {}) {
     return {
         disabledBuiltInItemIds: snapshot?.disabledBuiltInItemIds,
+        itemActions: snapshot?.itemActions,
         customBlocks: snapshot?.customBlocks,
         trustedScriptPaths: snapshot?.trustedScriptPaths,
         policyHash: snapshot?.policyHash,

package/dist/machineActionVerify.d.ts

@@ -35,11 +35,24 @@ export interface MachineActionVerdict {
     ok: boolean;
     reason?: string;
 }
+export interface MachineActionVerifyContext {
+    /**
+     * The local machine's computed identity. When provided, a signed action bound
+     * to a DIFFERENT machineId is rejected — a valid control-plane signature for
+     * machine A must never execute on machine B (misrouted bundle, replay, or a
+     * compromised delivery path). Actions without a machineId binding (legacy)
+     * are unaffected.
+     */
+    localMachineId?: string;
+}
 /**
  * Verify a machine action before execution. Rejects when:
  *  - the signature is missing (unless the local escape hatch is set),
  *  - the signature's keyId is unknown,
  *  - the Ed25519 verification fails (any signed field was tampered with),
- *  - the action is already expired.
+ *  - the action is already expired,
+ *  - the action is bound to a different machineId than this machine
+ *    (when `context.localMachineId` is provided; escape hatch:
+ *    FCD_MACHINE_ACTION_ANY_MACHINE_OK=1 for legacy-fingerprint fleets).
  */
-export declare function verifyMachineAction(action: VerifiableMachineAction): MachineActionVerdict;
+export declare function verifyMachineAction(action: VerifiableMachineAction, context?: MachineActionVerifyContext): MachineActionVerdict;

package/dist/machineActionVerify.js

@@ -92,21 +92,44 @@ function resolvePublicKeyPem(keyId) {
 function unsignedAllowed() {
     return process.env.FCD_MACHINE_ACTION_UNSIGNED_OK === '1';
 }
+function anyMachineAllowed() {
+    return process.env.FCD_MACHINE_ACTION_ANY_MACHINE_OK === '1';
+}
 /**
  * Verify a machine action before execution. Rejects when:
  *  - the signature is missing (unless the local escape hatch is set),
  *  - the signature's keyId is unknown,
  *  - the Ed25519 verification fails (any signed field was tampered with),
- *  - the action is already expired.
+ *  - the action is already expired,
+ *  - the action is bound to a different machineId than this machine
+ *    (when `context.localMachineId` is provided; escape hatch:
+ *    FCD_MACHINE_ACTION_ANY_MACHINE_OK=1 for legacy-fingerprint fleets).
  */
-function verifyMachineAction(action) {
+function verifyMachineAction(action, context) {
     const expiresAt = Date.parse(action.expiresAt);
     if (Number.isFinite(expiresAt) && expiresAt <= Date.now()) {
         return { ok: false, reason: 'Action is expired.' };
     }
+    // Machine binding is enforced BEFORE signature checks so the rejection reason
+    // is precise: the machineId is part of the signed canonical payload, so a
+    // mismatch here means a correctly signed action was delivered to the WRONG
+    // machine — not a forgery, but never something this machine may run.
+    if (context?.localMachineId && action.machineId && action.machineId !== context.localMachineId) {
+        if (anyMachineAllowed()) {
+            return verifySignatureOnly(action, `MACHINE-ID MISMATCH accepted via FCD_MACHINE_ACTION_ANY_MACHINE_OK=1 (action targets ${action.machineId}, local id is ${context.localMachineId}).`);
+        }
+        return {
+            ok: false,
+            reason: `Action is bound to machine ${action.machineId}, but this machine's id is ${context.localMachineId}. Rejected: signed remote actions only run on the machine they target. If this machine was re-imaged or its fingerprint changed, re-enroll it (\`fullcourtdefense onboard\`) or set FCD_MACHINE_ACTION_ANY_MACHINE_OK=1 as a temporary, local escape hatch.`,
+        };
+    }
+    return verifySignatureOnly(action);
+}
+/** Signature/expiry portion of verification (machine binding handled by the caller above). */
+function verifySignatureOnly(action, notice) {
     if (!action.signature?.signature) {
         if (unsignedAllowed()) {
-            return { ok: true, reason: 'UNSIGNED action accepted via FCD_MACHINE_ACTION_UNSIGNED_OK=1.' };
+            return { ok: true, reason: withNotice('UNSIGNED action accepted via FCD_MACHINE_ACTION_UNSIGNED_OK=1.', notice) };
         }
         return {
             ok: false,
@@ -125,10 +148,13 @@ function verifyMachineAction(action) {
         const key = crypto.createPublicKey(publicKeyPem);
         const valid = crypto.verify(null, canonicalPayload(action), key, Buffer.from(signature.signature, 'base64'));
         return valid
-            ? { ok: true }
+            ? { ok: true, ...(notice ? { reason: notice } : {}) }
             : { ok: false, reason: 'Invalid signature — the action payload does not match what the control plane signed.' };
     }
     catch (error) {
         return { ok: false, reason: `Signature verification error: ${error.message}` };
     }
 }
+function withNotice(base, notice) {
+    return notice ? `${notice} ${base}` : base;
+}

package/dist/telemetry.d.ts

@@ -1,7 +1,7 @@
 export interface SpoolEvent {
     eventId: string;
     type: 'verdict';
-    decision: 'allow' | 'block' | 'approval' | 'mask';
+    decision: 'allow' | 'block' | 'approval' | 'warn' | 'mask';
     toolName?: string;
     operation?: string;
     reason?: string;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.40"
+  "version": "1.22.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.40",
+  "version": "1.22.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {