fullcourtdefense-cli 1.24.2 → 1.25.0

package/README.md

@@ -24,7 +24,7 @@ fullcourtdefense onboard --token <fleet-enrollment-token>
 # or: set FCD_ENROLL_TOKEN and run `fullcourtdefense onboard`
 ```
 
-Then restart your AI clients (Cursor, Claude, VS Code, ...) so they pick up the wrapped configs. The machine reports to your org's AI Fleet in monitor-first mode until an admin enables enforcement.
+Then restart your AI clients (Cursor, Claude, VS Code, ...) so they pick up the wrapped configs. The machine reports to your org's AI Fleet in **monitor mode** first — every agent action is recorded and analyzed (including what *would* have been blocked), but nothing breaks the developer's workflow while the fleet baselines the machine. An admin promotes the machine to **blocking mode** from the fleet console once the baseline looks clean.
 
 Onboarding is a resumable local transaction. Its non-secret status journal is
 stored at `~/.fullcourtdefense/onboarding.json`; use `--resume` after an
@@ -266,7 +266,7 @@ fullcourtdefense scan --local
 Expected `doctor` output:
 
 ```text
-BotGuard outbound diagnostic
+FullCourtDefense outbound diagnostic
 Target: https://api.fullcourtdefense.ai
 
 PASS outbound HTTPS open (200, 487ms)
@@ -368,7 +368,7 @@ fullcourtdefense scan --local --type mcp --mcp-url "https://mcp.internal.company
 
 ### MCP Gateway Install Examples
 
-Use the MCP gateway when you want Cursor, Claude Code, or Claude Desktop tool calls checked against AgentGuard runtime/action policies before they reach the real MCP server.
+Use the MCP gateway when you want Cursor, Claude Code, or Claude Desktop tool calls checked against FullCourtDefense runtime/action policies before they reach the real MCP server.
 
 Cursor project install:
 
@@ -712,7 +712,7 @@ For GitHub Actions, use [botguardai/security-scan](https://github.com/botguardai
 
 ## Related
 
-- [BotGuard](https://fullcourtdefense.ai) — Automated red-teaming & real-time firewall for AI agents
+- [FullCourtDefense](https://fullcourtdefense.ai) — Automated red-teaming & real-time firewall for AI agents
 - [GitHub Action](https://github.com/botguardai/security-scan) — CI/CD security scanning
 - [Attack Library](https://github.com/botguardai/llm-attacks) — 229+ open-source LLM attack templates
 

package/dist/commands/agentCi.js

@@ -213,7 +213,7 @@ function agentFileRemediation(tags) {
     if (tags.includes('broad_filesystem'))
         fixes.push('limit file access to approved project paths and deny secrets/home/system paths');
     if (tags.includes('destructive_actions'))
-        fixes.push('require an AgentGuard Action Policy for delete, payment, transfer, email, Slack, or other side-effecting actions');
+        fixes.push('require a FullCourtDefense Action Policy for delete, payment, transfer, email, Slack, or other side-effecting actions');
     if (tags.includes('weak_guardrails'))
         fixes.push('delete bypass language such as always allow, never block, disable security, or skip validation');
     if (tags.includes('embedded_secret_ref'))
@@ -258,7 +258,7 @@ function evaluateAgentGate(args) {
                 title: `Missing approval policy evidence for ${server.name}`,
                 detail: `Risky tool signals need approval/block policy before merge: ${missingControls.join(', ')}.`,
                 filePath: server.filePath,
-                remediation: 'Add an AgentGuard action policy requiring approval/block for this tool class, then route through the gateway.',
+                remediation: 'Add a FullCourtDefense action policy requiring approval/block for this tool class, then route through the gateway.',
             }));
         }
     }
@@ -399,16 +399,16 @@ async function agentCiCommand(args, config) {
                         ci: buildCiMetadata(),
                     },
                 }, config);
-                console.error('AgentGuard evidence upload: uploaded to AI Fleet / discovery posture inventory.');
+                console.error('FullCourtDefense evidence upload: uploaded to AI Fleet / discovery posture inventory.');
             }
             catch (error) {
-                console.error(`AgentGuard evidence upload: failed (${error instanceof Error ? error.message : String(error)})`);
+                console.error(`FullCourtDefense evidence upload: failed (${error instanceof Error ? error.message : String(error)})`);
                 if (args.requireUpload === 'true')
                     process.exit(1);
             }
         }
         else {
-            console.error('AgentGuard evidence upload: missing credentials. Run fullcourtdefense login or pass FULLCOURTDEFENSE_API_KEY.');
+            console.error('FullCourtDefense evidence upload: missing credentials. Run fullcourtdefense login or pass FULLCOURTDEFENSE_API_KEY.');
             if (args.requireUpload === 'true')
                 process.exit(1);
         }

package/dist/commands/cmdGuard.js

@@ -117,7 +117,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,

package/dist/commands/daemon.js

@@ -472,7 +472,7 @@ async function runDaemon(args, config) {
             if (!quiet) {
                 (0, notify_1.notifyOs)({
                     title: 'FullCourtDefense re-protected this machine',
-                    message: 'An MCP or hook config changed; the AgentGuard gateway was re-applied.',
+                    message: 'An MCP or hook config changed; the FullCourtDefense gateway was re-applied.',
                     url: (0, notify_1.consoleUrl)('/agent-security/users?view=desktop'),
                 });
             }
@@ -851,7 +851,7 @@ async function runDaemon(args, config) {
                     throw new Error(`Repair completed but verification still reports: ${verification.reasons.join(', ')}`);
                 }
                 log(`Repair protection: verified (${verification.protectedMcpConfigs}/${verification.discoveredMcpConfigs} MCP configs wrapped).`);
-                resultSummary = 'AgentGuard hooks, gateways, and protection configuration were repaired and verified.';
+                resultSummary = 'FullCourtDefense hooks, gateways, and protection configuration were repaired and verified.';
             }
             else if (action.type === 'upgrade_cli') {
                 // Explicit version in the action reason wins; otherwise the org

package/dist/commands/deterministicGuard.js

@@ -52,7 +52,7 @@ const SECRET_PATTERNS = [
     { itemId: 'slack_token', label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
     { itemId: 'stripe_live_key', label: 'Stripe live key', re: /\b[rs]k_live_[0-9a-zA-Z]{24,}\b/ },
     { itemId: 'google_api_key', label: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
-    { itemId: 'huggingface_token', label: 'HuggingFace token', re: /\bhf_[A-Za-z0-9]{30,}\b/ },
+    { itemId: 'huggingface_token_secret', label: 'HuggingFace token', re: /\bhf_[A-Za-z0-9]{30,}\b/ },
     { itemId: 'database_url_password', label: 'database URL with password', re: /\b(?:postgres(?:ql)?|mongodb(?:\+srv)?|mysql):\/\/[^/\s'":]+:[^@\s'"]+@/i },
 ];
 // Contextual secret detection: bare high-entropy strings (hex app secrets,
@@ -230,6 +230,160 @@ function normalizeForPath(value) {
 function normalizeForCommand(value) {
     return decodeLoosely(value).replace(/\s+/g, ' ').trim();
 }
+/** Strip shell quoting/escaping that carries no semantic weight but defeats a
+ * naive substring/regex scan: de"l" /s /q, "C:\", 'rm' -rf /, i`e`x. Only used
+ * to build alternate COMMAND-matching variants — never for secret/path rules,
+ * where quotes can be meaningful. */
+function stripShellQuoting(text) {
+    return text.replace(/["'`]/g, '').replace(/\s+/g, ' ').trim();
+}
+/** Drop Windows executable suffixes so `gh.exe`, `del.exe`, `powershell.exe`,
+ * `foo.cmd` match the same rules as their bare command word. Scoped to real
+ * script-host extensions so it cannot maul URLs/filenames (`evil.com` is left
+ * intact). */
+function stripExeSuffix(text) {
+    return text.replace(/\.(?:exe|cmd|bat|ps1)\b/gi, '');
+}
+/** cmd.exe treats `^` as an escape for the NEXT character, so `r^m -rf /` runs
+ * `rm -rf /` and `powershe^ll` runs powershell. `^^` is a literal caret —
+ * protect it before stripping so we don't delete both. Variant-only transform. */
+function stripCmdCarets(text) {
+    return text.replace(/\^\^/g, '\u0000').replace(/\^/g, '').replace(/\u0000/g, '^');
+}
+/** POSIX shell token evasions (PayloadsAllTheThings "Filter Bypasses"):
+ *  - `${IFS}` / `$IFS` / `${IFS%??}` whitespace substitution: `rm${IFS}-rf${IFS}/`
+ *  - brace expansion word-splitting: `{rm,-rf,/}` -> `rm -rf /`
+ *  - backslash escaping of ordinary chars: `r\m -rf /` -> `rm -rf /`
+ * Variant-only (raw is always kept), so a benign command whose de-obfuscated
+ * form is harmless simply yields a non-matching extra surface. */
+function deobfuscateShellTokens(text) {
+    let out = text.replace(/\$\{IFS[^}]*\}/g, ' ').replace(/\$IFS\b/g, ' ');
+    for (let i = 0; i < 3 && /\{[^{}]*,[^{}]*\}/.test(out); i++) {
+        out = out.replace(/\{([^{}]*,[^{}]*)\}/g, (_m, body) => body.split(',').join(' '));
+    }
+    out = out.replace(/\\(?=[A-Za-z0-9])/g, '');
+    return out.replace(/\s+/g, ' ').trim();
+}
+/** bash/zsh ANSI-C quoting: `$'\x72\x6d'` IS `rm`. Decode `\xHH`, `\uHHHH`,
+ * octal, and single-char escapes, splicing plain text back into the command. */
+function decodeAnsiCQuoting(text) {
+    return text.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_m, body) => body.replace(/\\(x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{1,4}|[0-7]{1,3}|.)/g, (_e, esc) => {
+        if (esc[0] === 'x' || esc[0] === 'u')
+            return String.fromCharCode(parseInt(esc.slice(1), 16));
+        if (/^[0-7]/.test(esc))
+            return String.fromCharCode(parseInt(esc, 8));
+        const map = { n: '\n', t: '\t', r: '\r', a: '\x07', b: '\b', f: '\f', v: '\v', e: '\x1b', '\\': '\\', "'": "'" };
+        return map[esc] ?? esc;
+    }));
+}
+/** Decode a base64 blob to printable text, UTF-16LE (PowerShell) then UTF-8.
+ * Returns nothing for binary garbage so we never feed noise into the rules. */
+function decodeBase64Blob(b64) {
+    const out = [];
+    for (const enc of ['utf16le', 'utf8']) {
+        try {
+            const decoded = Buffer.from(b64, 'base64').toString(enc);
+            if (decoded && /[\x20-\x7e]/.test(decoded) && !/\u0000/.test(decoded))
+                out.push(decoded);
+        }
+        catch { /* not valid base64 for this encoding */ }
+    }
+    return out;
+}
+/** Extract hidden script payloads from one command string: PowerShell
+ * `-EncodedCommand <b64>`, `FromBase64String('<b64>')` cradles, and
+ * `echo <b64> | base64 -d | sh` pipelines. Short flags `-e`/`-ec`/`-en` are
+ * ambiguous (`docker run -e`, `node -e`) — only decoded in a real PowerShell
+ * context; `-enc` and longer are accepted anywhere. */
+function decodeEncodedPayloads(text) {
+    const out = [];
+    const push = (b64) => { for (const d of decodeBase64Blob(b64))
+        if (out.length < 8)
+            out.push(d); };
+    const hasPwsh = /\b(?:powershell|pwsh)\b/i.test(text);
+    const psEnc = /-(e(?:c|n(?:c(?:o(?:d(?:e(?:d(?:c(?:o(?:m(?:m(?:a(?:n(?:d)?)?)?)?)?)?)?)?)?)?)?)?)?)\s+([A-Za-z0-9+/=]{16,})/gi;
+    let match;
+    while ((match = psEnc.exec(text)) && out.length < 8) {
+        if (match[1].toLowerCase().length < 3 && !hasPwsh)
+            continue;
+        push(match[2]);
+    }
+    const fromB64 = /frombase64string\(\s*["']([A-Za-z0-9+/=]{16,})["']/gi;
+    while ((match = fromB64.exec(text)) && out.length < 8)
+        push(match[1]);
+    if (/\bbase64\s+(?:-d|-D|--decode)\b/.test(text) || /\bopenssl\s+(?:enc\s+.*-d|base64\s+-d)/.test(text)) {
+        // Decoder present => intentional payload; >=8 covers short commands like
+        // `rm -rf /` (12 b64 chars) that the speculative >=16 floor missed.
+        const loose = /(?:^|["'\s|;&=])([A-Za-z0-9+/]{8,}={0,2})(?=["'\s|;&]|$)/g;
+        while ((match = loose.exec(text)) && out.length < 8)
+            push(match[1]);
+    }
+    return out;
+}
+/**
+ * Obfuscation-resistant command expansion. A single-string regex scan is blind
+ * to the standard evasions attackers (and prompt-injected agents) use: base64
+ * `-EncodedCommand` / `FromBase64String` / `base64 -d` payloads (nested up to
+ * two levels), wrapper quoting (`de"l"`, `'rm' -rf`), cmd caret escapes
+ * (`r^m`), bash ANSI-C quoting (`$'\x72\x6d'`), POSIX token evasions
+ * (`${IFS}`, `{rm,-rf,/}`, `r\m`), and executable-suffix aliasing (`gh.exe`).
+ * Wrapper commands (wsl, docker exec, bash -c, ssh) need no special handling —
+ * the inner command survives as a substring of the dequoted variant.
+ *
+ * Bounded by design (decode depth 2, capped variant count, length guard).
+ * Known static limits (documented, covered by taint/approval layers instead):
+ * runtime-only values such as `%VAR%` / `$VAR` concatenation, `${PATH:0:1}`
+ * substrings, and `eval` of computed strings cannot be resolved statically.
+ */
+function commandVariants(value) {
+    const variants = new Set();
+    const add = (s) => { if (s && s.length <= 8000 && variants.size < 48)
+        variants.add(s); };
+    const addSurfaces = (seed) => {
+        const s = normalizeForCommand(seed);
+        add(s);
+        const dequoted = stripShellQuoting(s);
+        add(dequoted);
+        add(stripExeSuffix(s));
+        add(stripExeSuffix(dequoted));
+        const deob = deobfuscateShellTokens(s);
+        if (deob !== s) {
+            add(deob);
+            add(stripShellQuoting(deob));
+        }
+        // ANSI-C decode MUST run before token de-obfuscation: the backslash-strip in
+        // deobfuscateShellTokens would otherwise eat the `\xHH` escapes.
+        add(normalizeForCommand(stripExeSuffix(stripShellQuoting(deobfuscateShellTokens(stripCmdCarets(decodeAnsiCQuoting(s)))))));
+    };
+    const base = normalizeForCommand(value);
+    addSurfaces(base);
+    // Nested encodes: decode payloads of the base, then decode payloads of what
+    // came out (powershell -enc wrapping another -enc / FromBase64String).
+    let frontier = [base];
+    for (let depth = 0; depth < 2 && frontier.length > 0 && variants.size < 48; depth++) {
+        const next = [];
+        for (const source of frontier) {
+            for (const decoded of decodeEncodedPayloads(source)) {
+                addSurfaces(decoded);
+                next.push(normalizeForCommand(decoded));
+            }
+        }
+        frontier = next;
+    }
+    return Array.from(variants);
+}
+/** Run a command matcher across every de-obfuscated variant, returning the
+ * first hit. Callers keep passing the RAW value — variant expansion is the
+ * single seam every command rule shares, so a new evasion is defeated in one
+ * place instead of per-rule. */
+function matchCommand(value, test) {
+    for (const variant of commandVariants(value)) {
+        const hit = test(variant, variant.toLowerCase());
+        if (hit)
+            return hit;
+    }
+    return undefined;
+}
 function collectStrings(value, keyPath = 'args', out = [], depth = 0) {
     if (depth > 6 || value === null || value === undefined)
         return out;
@@ -424,121 +578,148 @@ function containsSensitiveCredentialPath(value) {
  * that legitimate deploy tooling uses constantly are strict (off by default).
  */
 function credentialCommandReason(value) {
-    const lower = normalizeForCommand(value).toLowerCase();
-    if (/\bgh\s+auth\s+token\b/.test(lower) || (/\bgh\s+auth\s+status\b/.test(lower) && /(?:--show-token|\s-t\b)/.test(lower))) {
-        return { itemId: 'gh_auth_token_cmd', reason: 'GitHub CLI token print (gh auth token)' };
-    }
-    if (/\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b/.test(lower)) {
-        return { itemId: 'git_credential_fill', reason: 'git credential helper dump' };
-    }
-    if (/\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b/.test(lower) || /\bsecurity\s+dump-keychain\b/.test(lower)) {
-        return { itemId: 'macos_keychain_dump', reason: 'macOS keychain password dump' };
-    }
-    if (/\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b/.test(lower)) {
-        return { itemId: 'kubectl_config_raw', reason: 'raw kubeconfig dump (kubectl config view --raw)' };
-    }
-    if (/\baws\s+configure\s+export-credentials\b/.test(lower) || /\baws\s+configure\s+get\b[^\n;|&]*secret/.test(lower)) {
-        return { itemId: 'aws_export_credentials', reason: 'AWS secret access key export' };
-    }
-    if (/\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b/.test(lower)) {
-        return { itemId: 'gcloud_access_token_cmd', reason: 'gcloud access-token print' };
-    }
-    if (/\bgcloud\s+secrets\s+versions\s+access\b/.test(lower)) {
-        return { itemId: 'gcloud_secret_access_cmd', reason: 'GCP Secret Manager read' };
-    }
-    if (/\baz\s+account\s+get-access-token\b/.test(lower)) {
-        return { itemId: 'az_access_token_cmd', reason: 'Azure access-token print' };
-    }
-    if (/\baws\s+secretsmanager\s+get-secret-value\b/.test(lower) || /\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b/.test(lower)) {
-        return { itemId: 'aws_secret_fetch_cmd', reason: 'AWS secret fetch' };
-    }
-    if (/\bvault\s+(?:kv\s+get|read)\b/.test(lower)) {
-        return { itemId: 'vault_read_cmd', reason: 'Vault secret read' };
-    }
-    return undefined;
+    return matchCommand(value, (_text, lower) => {
+        if (/\bgh\s+auth\s+token\b/.test(lower) || (/\bgh\s+auth\s+status\b/.test(lower) && /(?:--show-token|\s-t\b)/.test(lower))) {
+            return { itemId: 'gh_auth_token_cmd', reason: 'GitHub CLI token print (gh auth token)' };
+        }
+        if (/\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b/.test(lower)) {
+            return { itemId: 'git_credential_fill', reason: 'git credential helper dump' };
+        }
+        if (/\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b/.test(lower) || /\bsecurity\s+dump-keychain\b/.test(lower)) {
+            return { itemId: 'macos_keychain_dump', reason: 'macOS keychain password dump' };
+        }
+        if (/\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b/.test(lower)) {
+            return { itemId: 'kubectl_config_raw', reason: 'raw kubeconfig dump (kubectl config view --raw)' };
+        }
+        if (/\baws\s+configure\s+export-credentials\b/.test(lower) || /\baws\s+configure\s+get\b[^\n;|&]*secret/.test(lower)) {
+            return { itemId: 'aws_export_credentials', reason: 'AWS secret access key export' };
+        }
+        if (/\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b/.test(lower)) {
+            return { itemId: 'gcloud_access_token_cmd', reason: 'gcloud access-token print' };
+        }
+        if (/\bgcloud\s+secrets\s+versions\s+access\b/.test(lower)) {
+            return { itemId: 'gcloud_secret_access_cmd', reason: 'GCP Secret Manager read' };
+        }
+        if (/\baz\s+account\s+get-access-token\b/.test(lower)) {
+            return { itemId: 'az_access_token_cmd', reason: 'Azure access-token print' };
+        }
+        if (/\baws\s+secretsmanager\s+get-secret-value\b/.test(lower) || /\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b/.test(lower)) {
+            return { itemId: 'aws_secret_fetch_cmd', reason: 'AWS secret fetch' };
+        }
+        if (/\bvault\s+(?:kv\s+get|read)\b/.test(lower)) {
+            return { itemId: 'vault_read_cmd', reason: 'Vault secret read' };
+        }
+        return undefined;
+    });
 }
 function destructiveCommandReason(value) {
-    const text = normalizeForCommand(value);
-    const lower = text.toLowerCase();
-    if (/\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?\/["']?|\*)(?:\s|$|[;&|])/.test(lower))
-        return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-    if (/\bsudo\s+rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?\/["']?|\*)(?:\s|$|[;&|])/.test(lower))
-        return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-    if (/\b(?:del|erase)\s+\/[a-z]*s[a-z]*\s+\/[a-z]*q[a-z]*\s+[a-z]:\\(?:\s|$)/i.test(text))
-        return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
-    // Drive-ROOT Remove-Item only: the bare drive (C:\) must be an argument of
-    // the SAME Remove-Item command (no ;|& between them). The previous loose
-    // drive-letter match flagged ANY text containing Remove-Item -Recurse
-    // -Force plus an unrelated "x: " pattern — e.g. our own installer's
-    // legitimate cleanup script, blocking a customer's git command that merely
-    // referenced it.
-    if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force')
-        && /remove-item\b[^;|&]{0,80}?["']?\b[a-z]:[\\/]?["']?(?=\s|$|[;&|])/i.test(text)) {
-        return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
-    }
-    if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
-        return { itemId: 'fork_bomb', reason: 'fork bomb' };
-    if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
-        return { itemId: 'mkfs_device', reason: 'filesystem format command' };
-    if (/\bdd\b(?=.*\bof=\/dev\/(?:sd|xvd|hd|nvme|disk))/i.test(text))
-        return { itemId: 'dd_disk_overwrite', reason: 'raw disk overwrite command' };
-    if (/\bchmod\s+-r\s+777\s+\/(?:\s|$)/i.test(text))
-        return { itemId: 'chmod_root_777', reason: 'recursive permission change on root' };
-    if (/\bgit\s+(?:reset\s+--hard|clean\s+-f(?:d|x|dx)?\b)/i.test(text))
-        return { itemId: 'git_clean_force', reason: 'destructive git clean/reset' };
-    return undefined;
+    return matchCommand(value, (text, lower) => {
+        // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`), and the target
+        // may be the root `/`, the root wildcard `/*`, or a bare `*`.
+        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+        // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
+        // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
+        // handles `"C:\"`. rd/rmdir are the same wipe under a different verb — the
+        // old rule only knew del/erase in a fixed flag order.
+        if (/\b(?:del|erase|rd|rmdir)\b(?=[^\n;|&]*\s\/[a-z]*s\b)(?=[^\n;|&]*\s\/[a-z]*q\b)[^\n;|&]*\s[a-z]:(?:\\|"|\s|$)/i.test(text)) {
+            return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
+        }
+        // Drive-ROOT Remove-Item only: the bare drive (C:\) must be an argument of
+        // the SAME Remove-Item command (no ;|& between them). The previous loose
+        // drive-letter match flagged ANY text containing Remove-Item -Recurse
+        // -Force plus an unrelated "x: " pattern — e.g. our own installer's
+        // legitimate cleanup script, blocking a customer's git command that merely
+        // referenced it.
+        if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force')
+            && /remove-item\b[^;|&]{0,80}?["']?\b[a-z]:[\\/]?["']?(?=\s|$|[;&|])/i.test(text)) {
+            return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
+        }
+        if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
+            return { itemId: 'fork_bomb', reason: 'fork bomb' };
+        if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
+            return { itemId: 'mkfs_device', reason: 'filesystem format command' };
+        if (/\bdd\b(?=.*\bof=\/dev\/(?:sd|xvd|hd|nvme|disk))/i.test(text))
+            return { itemId: 'dd_disk_overwrite', reason: 'raw disk overwrite command' };
+        if (/\bchmod\s+-r\s+777\s+\/(?:\s|$)/i.test(text))
+            return { itemId: 'chmod_root_777', reason: 'recursive permission change on root' };
+        if (/\bgit\s+(?:reset\s+--hard|clean\s+-f(?:d|x|dx)?\b)/i.test(text))
+            return { itemId: 'git_clean_force', reason: 'destructive git clean/reset' };
+        return undefined;
+    });
 }
 function reverseShellReason(value) {
-    const text = normalizeForCommand(value);
-    if (/\bbash\s+-i\b.*\/dev\/tcp\//i.test(text))
-        return { itemId: 'bash_dev_tcp', reason: 'bash reverse shell' };
-    if (/\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
-        return { itemId: 'netcat_exec', reason: 'netcat reverse shell' };
-    if (/\bsocat\b.*\bexec:(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
-        return { itemId: 'socat_exec', reason: 'socat reverse shell' };
-    if (/\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b/i.test(text))
-        return { itemId: 'curl_pipe_shell', reason: 'remote script piped to shell' };
-    if (/\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)/i.test(text))
-        return { itemId: 'python_socket_subprocess', reason: 'python reverse shell' };
-    return undefined;
+    return matchCommand(value, (text) => {
+        if (/\bbash\s+-i\b.*\/dev\/tcp\//i.test(text))
+            return { itemId: 'bash_dev_tcp', reason: 'bash reverse shell' };
+        if (/\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
+            return { itemId: 'netcat_exec', reason: 'netcat reverse shell' };
+        if (/\bsocat\b.*\bexec:(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
+            return { itemId: 'socat_exec', reason: 'socat reverse shell' };
+        if (/\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b/i.test(text))
+            return { itemId: 'curl_pipe_shell', reason: 'remote script piped to shell' };
+        // PowerShell download-and-execute cradle: Invoke-Expression / iex fed by a
+        // downloader (iwr/irm/Invoke-WebRequest/Invoke-RestMethod/DownloadString/
+        // DownloadFile/Net.WebClient/Start-BitsTransfer, or a bare `... | iex`).
+        // This is the Windows equivalent of `curl … | sh`, so it rides the same
+        // catalog toggle (curl_pipe_shell).
+        if (/\b(?:iex|invoke-expression)\b/i.test(text)
+            && /\b(?:iwr|irm|invoke-webrequest|invoke-restmethod|curl|wget|downloadstring|downloadfile|net\.webclient|start-bitstransfer)\b/i.test(text)) {
+            return { itemId: 'curl_pipe_shell', reason: 'remote script downloaded and executed (PowerShell cradle)' };
+        }
+        if (/\|\s*(?:iex|invoke-expression)\b/i.test(text)) {
+            return { itemId: 'curl_pipe_shell', reason: 'remote script piped to shell (PowerShell iex)' };
+        }
+        if (/\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)/i.test(text))
+            return { itemId: 'python_socket_subprocess', reason: 'python reverse shell' };
+        return undefined;
+    });
 }
 function destructiveSqlReason(value) {
-    const text = normalizeForCommand(value);
-    if (/\bdrop\s+database\b/i.test(text))
-        return { itemId: 'drop_database', reason: 'DROP DATABASE' };
-    if (/\bdrop\s+schema\b/i.test(text))
-        return { itemId: 'drop_schema', reason: 'DROP SCHEMA' };
-    if (/\btruncate\s+table\b/i.test(text))
-        return { itemId: 'truncate_table', reason: 'TRUNCATE TABLE' };
-    return undefined;
+    return matchCommand(value, (text) => {
+        if (/\bdrop\s+database\b/i.test(text))
+            return { itemId: 'drop_database', reason: 'DROP DATABASE' };
+        if (/\bdrop\s+schema\b/i.test(text))
+            return { itemId: 'drop_schema', reason: 'DROP SCHEMA' };
+        if (/\btruncate\s+table\b/i.test(text))
+            return { itemId: 'truncate_table', reason: 'TRUNCATE TABLE' };
+        return undefined;
+    });
 }
 function infraDestroyReason(value) {
-    const text = normalizeForCommand(value);
-    if (/\bterraform\s+destroy\b(?=.*--auto-approve)/i.test(text))
-        return { itemId: 'terraform_destroy_auto', reason: 'terraform destroy with auto-approve' };
-    if (/\bpulumi\s+destroy\b(?=.*(?:--yes|-y))/i.test(text))
-        return { itemId: 'pulumi_destroy_yes', reason: 'pulumi destroy with auto-approve' };
-    if (/\bkubectl\s+delete\s+namespace\b/i.test(text))
-        return { itemId: 'kubectl_delete_namespace', reason: 'destructive kubectl namespace delete' };
-    if (/\bkubectl\s+delete\s+(?:clusterrole|secret)\b/i.test(text))
-        return { itemId: 'generic_kubectl_delete', reason: 'destructive kubectl delete' };
-    if (/\bkubectl\s+delete\s+all\b(?=.*--all)/i.test(text))
-        return { itemId: 'kubectl_delete_all_all', reason: 'broad kubectl delete all' };
-    if (/\bgcloud\s+projects\s+delete\b/i.test(text))
-        return { itemId: 'gcloud_project_delete', reason: 'GCP project deletion' };
-    if (/\bgcloud\s+sql\s+instances\s+delete\b/i.test(text))
-        return { itemId: 'gcloud_sql_delete', reason: 'GCP SQL instance deletion' };
-    if (/\baws\s+s3\s+rm\s+s3:\/\/\S+\s+--recursive\b/i.test(text))
-        return { itemId: 'aws_s3_recursive_rm', reason: 'recursive S3 deletion' };
-    if (/\baws\s+cloudformation\s+delete-stack\b/i.test(text))
-        return { itemId: 'aws_cloudformation_delete_stack', reason: 'CloudFormation stack deletion' };
-    if (/\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)/i.test(text))
-        return { itemId: 'aws_iam_admin_policy', reason: 'IAM administrator privilege grant' };
-    if (/\baws\s+iam\s+create-access-key\b/i.test(text))
-        return { itemId: 'aws_iam_access_key', reason: 'IAM access key creation' };
-    if (/\baz\s+group\s+delete\b(?=.*(?:--yes|-y))/i.test(text))
-        return { itemId: 'az_group_delete_yes', reason: 'Azure resource group deletion' };
-    return undefined;
+    return matchCommand(value, (text) => {
+        if (/\bterraform\s+destroy\b(?=.*-{1,2}auto-approve)/i.test(text))
+            return { itemId: 'terraform_destroy_auto', reason: 'terraform destroy with auto-approve' };
+        if (/\bpulumi\s+destroy\b(?=.*(?:--yes|-y))/i.test(text))
+            return { itemId: 'pulumi_destroy_yes', reason: 'pulumi destroy with auto-approve' };
+        // Specific kubectl deletes first (default-on), then the broad catch-all
+        // (generic_kubectl_delete, default-OFF). The generic rule now matches any
+        // `kubectl delete` as its catalog description advertises — previously it
+        // only fired on clusterrole|secret, silently under-delivering the toggle.
+        if (/\bkubectl\s+delete\s+namespace\b/i.test(text))
+            return { itemId: 'kubectl_delete_namespace', reason: 'destructive kubectl namespace delete' };
+        if (/\bkubectl\s+delete\s+all\b(?=.*--all)/i.test(text))
+            return { itemId: 'kubectl_delete_all_all', reason: 'broad kubectl delete all' };
+        if (/\bkubectl\s+delete\b/i.test(text))
+            return { itemId: 'generic_kubectl_delete', reason: 'destructive kubectl delete' };
+        if (/\bgcloud\s+projects\s+delete\b/i.test(text))
+            return { itemId: 'gcloud_project_delete', reason: 'GCP project deletion' };
+        if (/\bgcloud\s+sql\s+instances\s+delete\b/i.test(text))
+            return { itemId: 'gcloud_sql_delete', reason: 'GCP SQL instance deletion' };
+        if (/\baws\s+s3\s+rm\s+s3:\/\/\S+\s+--recursive\b/i.test(text))
+            return { itemId: 'aws_s3_recursive_rm', reason: 'recursive S3 deletion' };
+        if (/\baws\s+cloudformation\s+delete-stack\b/i.test(text))
+            return { itemId: 'aws_cloudformation_delete_stack', reason: 'CloudFormation stack deletion' };
+        if (/\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)/i.test(text))
+            return { itemId: 'aws_iam_admin_policy', reason: 'IAM administrator privilege grant' };
+        if (/\baws\s+iam\s+create-access-key\b/i.test(text))
+            return { itemId: 'aws_iam_access_key', reason: 'IAM access key creation' };
+        if (/\baz\s+group\s+delete\b(?=.*(?:--yes|-y))/i.test(text))
+            return { itemId: 'az_group_delete_yes', reason: 'Azure resource group deletion' };
+        return undefined;
+    });
 }
 /**
  * Local file editors (Write / StrReplace / edit_file / EditNotebook / apply_patch ...)

package/dist/commands/hook.js

@@ -621,11 +621,13 @@ async function hookCommand(args, config) {
     // machine applies it on the next poll. Cached locally (stale-while-error), so
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
+    let modeResolved = false; // add this line
     if (!forceMonitor && !forceEnforce && shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname() });
             if (bundle.source !== 'default') {
                 shadow = bundle.mode !== 'block'; // 'monitor'/'shadow' => report-only
+                modeResolved = true; // add this line
                 effectivePolicyHash = bundle.policyHash || bundle.version;
                 // Cached org policies: hash-covered by the bundle ETag, evaluated
                 // locally when the policy gate is unreachable (offline enforcement).
@@ -642,6 +644,11 @@ async function hookCommand(args, config) {
         }
         catch { /* keep the local default */ }
     }
+    // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
+    if (!modeResolved && !forceEnforce) {
+        shadow = true;
+        dbg({ phase: 'mode_default_monitor_first', shadow });
+    }
     if (forceEnforce)
         shadow = false;
     // Keep device liveness fresh during active use (throttled, detached — never blocks).

package/dist/commands/mcpGateway.d.ts

@@ -1,6 +1,6 @@
 import { BotGuardConfig } from '../config';
-type AgentClient = 'cursor' | 'claude-code' | 'claude-desktop' | 'codex' | 'gemini-cli' | 'windsurf' | 'vscode';
-export type GatewayClient = AgentClient;
+/** Clients with a dedicated install-*-mcp-gateway command. */
+export type GatewayClient = 'cursor' | 'claude-code' | 'claude-desktop' | 'codex' | 'gemini-cli' | 'windsurf' | 'vscode';
 export declare const ALL_GATEWAY_CLIENTS: GatewayClient[];
 export interface McpGatewayArgs {
     mcpCommand?: string;
@@ -117,4 +117,3 @@ export declare function installCodexMcpGatewayCommand(args: InstallCodexMcpGatew
 export declare function installGeminiMcpGatewayCommand(args: InstallGeminiMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installWindsurfMcpGatewayCommand(args: InstallWindsurfMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
 export declare function installVscodeMcpGatewayCommand(args: InstallVscodeMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
-export {};

package/dist/commands/mcpGateway.js

@@ -86,6 +86,8 @@ const CLIENT_LABELS = {
     'gemini-cli': 'Gemini CLI',
     windsurf: 'Windsurf',
     vscode: 'VS Code',
+    kiro: 'Kiro',
+    other: 'an MCP client',
 };
 /**
  * Default configured-context template per client. Single source of truth —
@@ -148,6 +150,8 @@ function normalizeAgentClient(value, fallback) {
         gemini: 'gemini-cli',
         windsurf: 'windsurf',
         vscode: 'vscode',
+        kiro: 'kiro',
+        other: 'other',
     };
     if (value && map[value])
         return map[value];
@@ -731,7 +735,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `FullCourtDefense API error (${resp.status})` };
         return data;
     }
     async get(pathValue, timeoutMs = 10_000) {
@@ -742,7 +746,7 @@ class AgentGuardApi {
         });
         const data = await resp.json().catch(() => ({}));
         if (!resp.ok)
-            return { success: false, status: resp.status, error: data.error || `AgentGuard API error (${resp.status})` };
+            return { success: false, status: resp.status, error: data.error || `FullCourtDefense API error (${resp.status})` };
         return data;
     }
     headers() {
@@ -800,7 +804,7 @@ class McpGatewayServer {
                 this.respond(message.id, {
                     tools: tools.map(tool => ({
                         ...tool,
-                        description: `[AgentGuard protected] ${tool.description || ''}`.trim(),
+                        description: `[FullCourtDefense protected] ${tool.description || ''}`.trim(),
                     })),
                 });
                 return;
@@ -864,7 +868,9 @@ class McpGatewayServer {
             // fallback: when the policy service is unreachable, tool calls are checked
             // locally with the same engine the server runs (actionPolicyEngine.ts).
             let cachedPolicies;
-            let reportOnlyMode = false;
+            // Monitor unless a server/cache bundle explicitly says 'block': a machine
+            // with no signal (fresh install + offline, wiped cache) must never block.
+            let reportOnlyMode = true;
             let machineRole;
             try {
                 const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
@@ -916,13 +922,25 @@ class McpGatewayServer {
             const requestOutcome = (0, deterministicGuard_1.resolveDeterministicOutcome)(opts => (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, opts), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             for (const warning of requestOutcome.warnings) {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
-                process.stderr.write(`AgentGuard warning (${warning.itemId}): ${warning.reason}\n`);
+                process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
             const localBlock = requestOutcome.blockingFinding;
             if (localBlock) {
-                this.spoolLocalFinding(localBlock, toolName, operation);
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
-                throw new Error(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
+                if (reportOnlyMode) {
+                    // MONITOR CONTRACT: a monitor/shadow machine (or one with no bundle
+                    // signal at all) must NEVER hard-block. Online, the server already
+                    // serves warn-downgraded rules to monitor machines — this branch is
+                    // the client-side belt for offline/no-cache/stale-cache states,
+                    // where the scan can still yield block-action findings. Record the
+                    // would-block and let the call through.
+                    this.spoolLocalFinding({ ...localBlock, reason: `[monitor] ${localBlock.reason}` }, toolName, operation, 'warn');
+                    process.stderr.write(`FullCourtDefense (monitor) would block ${toolName}: ${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId})\n`);
+                }
+                else {
+                    this.spoolLocalFinding(localBlock, toolName, operation);
+                    throw new Error(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
+                }
             }
             // --- Machine-role session amount limits (pre-call: operation counts) ---
             // The role's verb rules ride actionPolicies; this enforces the AMOUNTS.
@@ -945,7 +963,7 @@ class McpGatewayServer {
                     if (machineRole.stage === 'monitor' || reportOnlyMode) {
                         (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: inferredOp, reason: `[monitor] ${reason}`, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
                         (0, telemetry_1.triggerFlush)(false);
-                        process.stderr.write(`AgentGuard (monitor): ${reason}\n`);
+                        process.stderr.write(`FullCourtDefense (monitor): ${reason}\n`);
                     }
                     else {
                         (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation: inferredOp, reason, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
@@ -991,18 +1009,22 @@ class McpGatewayServer {
                         : `local policy allow (offline): ${detail}`;
                     (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation: localOperation, reason: localReason, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
-                    process.stderr.write(`AgentGuard offline: policy service unreachable (${detail}); ${toolName} checked against locally cached org policies → ${blocking ? `${local.verdict} (report-only)` : 'allow'}.\n`);
+                    process.stderr.write(`FullCourtDefense offline: policy service unreachable (${detail}); ${toolName} checked against locally cached org policies → ${blocking ? `${local.verdict} (report-only)` : 'allow'}.\n`);
                     preflight = { allowed: true, decision: 'allow', operation: localOperation };
                 }
-                else if (this.gatewayConfig.failClosed) {
+                else if (this.gatewayConfig.failClosed && (!reportOnlyMode || this.gatewayConfig.failClosedExplicit)) {
+                    // Fail-closed only bites when the machine is actually in block mode
+                    // (or the operator passed --fail-closed explicitly at install time).
+                    // A monitor machine must never hard-block — not even during an
+                    // outage with a bundle-supplied failClosed=true left over.
                     (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason: `fail-closed: ${detail}`, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(true);
-                    throw new Error(`AgentGuard policy service unreachable and fail-closed mode is on (${detail}). Tool call blocked.`);
+                    throw new Error(`FullCourtDefense policy service unreachable and fail-closed mode is on (${detail}). Tool call blocked.`);
                 }
                 else {
                     (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, operation, reason: `degraded: ${detail}`, offlineEnforced: true });
                     (0, telemetry_1.triggerFlush)(false);
-                    process.stderr.write(`AgentGuard degraded mode: policy service unreachable (${detail}); allowing ${toolName} per fail-open config.\n`);
+                    process.stderr.write(`FullCourtDefense degraded mode: policy service unreachable (${detail}); allowing ${toolName} per fail-open config.\n`);
                     preflight = { allowed: true, decision: 'allow', operation: operation || '' };
                 }
             }
@@ -1013,7 +1035,7 @@ class McpGatewayServer {
                     if (!approvalActionId)
                         throw new Error('Policy requires approval, but no approval request id was returned.');
                     const queueUrl = (0, notify_1.approvalsConsoleUrl)();
-                    process.stderr.write(`AgentGuard approval required for ${toolName}. Waiting for human review (${approvalActionId})... Approve at ${queueUrl}\n`);
+                    process.stderr.write(`FullCourtDefense approval required for ${toolName}. Waiting for human review (${approvalActionId})... Approve at ${queueUrl}\n`);
                     // Gateway stderr is invisible inside most MCP clients — surface the
                     // wait with a native OS toast so a human knows to open the console.
                     (0, notify_1.notifyOs)({
@@ -1054,28 +1076,45 @@ class McpGatewayServer {
             const responseOutcome = (0, deterministicGuard_1.resolveDeterministicTextResponse)(contentToText(rawResult), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             for (const warning of responseOutcome.warnings) {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
-                process.stderr.write(`AgentGuard warning (${warning.itemId}): ${warning.reason}\n`);
+                process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
             const localResponseBlock = responseOutcome.blockingFinding;
             if (localResponseBlock) {
-                this.spoolLocalFinding(localResponseBlock, toolName, operation);
                 const responseOrigin = localResponseBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
-                throw new Error(`${localResponseBlock.reason} (${responseOrigin} "${localResponseBlock.itemId}", ${localResponseBlock.ruleId}: ${localResponseBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
+                if (reportOnlyMode) {
+                    // MONITOR CONTRACT (see request-side block above): record, never block.
+                    this.spoolLocalFinding({ ...localResponseBlock, reason: `[monitor] ${localResponseBlock.reason}` }, toolName, operation, 'warn');
+                    process.stderr.write(`FullCourtDefense (monitor) would block the ${toolName} response: ${localResponseBlock.reason} (${responseOrigin} "${localResponseBlock.itemId}", ${localResponseBlock.ruleId})\n`);
+                }
+                else {
+                    this.spoolLocalFinding(localResponseBlock, toolName, operation);
+                    throw new Error(`${localResponseBlock.reason} (${responseOrigin} "${localResponseBlock.itemId}", ${localResponseBlock.ruleId}: ${localResponseBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
+                }
             }
             if (responseOutcome.maskFindings.length > 0) {
-                // mask-action rules: redact the matched secrets in place. If the result
-                // shape cannot be rewritten (secret hidden in a non-text payload), fail
-                // strict and block — a mask rule must never leak what it was set to hide.
+                // mask-action rules: redact the matched secrets in place. Masking is
+                // monitor-compatible (a redaction is not a block), so it applies in
+                // every mode. If the result shape cannot be rewritten (secret hidden
+                // in a non-text payload), fail strict and block — a mask rule must
+                // never leak what it was set to hide — except under monitor, where
+                // the contract is observe-only: record the would-block and pass the
+                // response through with whatever partial masking was possible.
                 const { masked, fullyMasked } = maskToolResult(rawResult, responseOutcome.maskFindings);
                 if (!fullyMasked) {
                     const finding = responseOutcome.maskFindings[0];
-                    this.spoolLocalFinding(finding, toolName, operation);
-                    throw new Error(`${finding.reason} (rule "${finding.itemId}" is set to mask, but this tool response could not be rewritten — blocked instead.)`);
+                    if (reportOnlyMode) {
+                        this.spoolLocalFinding({ ...finding, reason: `[monitor] ${finding.reason}` }, toolName, operation, 'warn');
+                        process.stderr.write(`FullCourtDefense (monitor) would block the ${toolName} response: mask rule "${finding.itemId}" could not rewrite this payload.\n`);
+                    }
+                    else {
+                        this.spoolLocalFinding(finding, toolName, operation);
+                        throw new Error(`${finding.reason} (rule "${finding.itemId}" is set to mask, but this tool response could not be rewritten — blocked instead.)`);
+                    }
                 }
                 rawResult = masked;
                 for (const finding of responseOutcome.maskFindings) {
                     this.spoolLocalFinding(finding, toolName, operation, 'mask');
-                    process.stderr.write(`AgentGuard masked a ${finding.itemId} in the ${toolName} response.\n`);
+                    process.stderr.write(`FullCourtDefense masked a ${finding.itemId} in the ${toolName} response.\n`);
                 }
             }
             // --- Machine-role session amount limits (post-call: response volume) ---
@@ -1097,7 +1136,7 @@ class McpGatewayServer {
                     if (machineRole.stage === 'monitor' || reportOnlyMode) {
                         (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] ${reason}`, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
                         (0, telemetry_1.triggerFlush)(false);
-                        process.stderr.write(`AgentGuard (monitor): ${reason}\n`);
+                        process.stderr.write(`FullCourtDefense (monitor): ${reason}\n`);
                     }
                     else {
                         (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
@@ -1157,7 +1196,7 @@ async function mcpGatewayCommand(args, config) {
         };
     const server = new McpGatewayServer(gatewayConfig, spec);
     const downstreamLabel = spec.kind === 'http' ? spec.url : `${spec.command} ${spec.args.join(' ')}`;
-    process.stderr.write(`AgentGuard MCP Gateway running for ${gatewayConfig.agentName}. Downstream: ${downstreamLabel}\n`);
+    process.stderr.write(`FullCourtDefense MCP Gateway running for ${gatewayConfig.agentName}. Downstream: ${downstreamLabel}\n`);
     server.start();
 }
 function cursorMcpPath(projectScope) {
@@ -1465,7 +1504,7 @@ async function installCursorMcpGatewayCommand(args, config) {
     const downstream = resolveDownstreamSpec(args);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstream, INSTALL_GATEWAY_ARGS);
     writeMcpServerConfig(file, serverName, nodeExe, commandArgs);
-    console.log(`AgentGuard MCP Gateway installed for Cursor (${projectScope ? 'project' : 'global'}).`);
+    console.log(`FullCourtDefense MCP Gateway installed for Cursor (${projectScope ? 'project' : 'global'}).`);
     console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);
     console.log(`Downstream: ${downstreamSpecLabel(downstream)}`);
@@ -1501,7 +1540,7 @@ async function installMcpGatewayCommand(args, config) {
         if (clients.length > 1)
             console.log('');
     }
-    console.log('AgentGuard gateway install summary:');
+    console.log('FullCourtDefense gateway install summary:');
     console.log(`  ✓ ${successes.length > 0 ? successes.join(', ') : 'none'}`);
     if (failures.length > 0) {
         console.log('  ✗ Failed:');
@@ -1550,9 +1589,11 @@ const CLIENT_KEY_TO_AGENT = {
     gemini_cli: 'gemini-cli',
     windsurf: 'windsurf',
     vscode: 'vscode',
+    kiro: 'kiro',
+    other: 'other',
 };
 function newWrapStats() { return { wrapped: [], healed: [], skippedManaged: [], skippedRemote: [] }; }
-/** True when an MCP server entry already runs through the AgentGuard gateway. */
+/** True when an MCP server entry already runs through the FullCourtDefense gateway. */
 function isGatewayWrappedEntry(entry) {
     if (!entry || typeof entry !== 'object')
         return false;
@@ -2230,7 +2271,9 @@ async function protectAllCommand(args, config) {
     const presentClientKeys = new Set();
     for (const file of files) {
         presentClientKeys.add(file.clientKey);
-        const agentClient = CLIENT_KEY_TO_AGENT[file.clientKey] || 'cursor';
+        // Unknown clientKeys stamp `other`, never Cursor — the log must not lie
+        // about which app a wrapped config belongs to.
+        const agentClient = CLIENT_KEY_TO_AGENT[file.clientKey] || 'other';
         const isToml = /\.toml$/i.test(file.path);
         const stats = isToml
             ? transformCodexToml(file.path, 'wrap', gatewayConfig, dryRun)
@@ -2344,7 +2387,7 @@ async function installClaudeCodeMcpGatewayCommand(args, config) {
         }
     }
     if (result.status === 0) {
-        console.log(`AgentGuard MCP Gateway installed for Claude Code (${scope}).`);
+        console.log(`FullCourtDefense MCP Gateway installed for Claude Code (${scope}).`);
         console.log(`Server: ${serverName}`);
         console.log(`Downstream: ${downstreamSpecLabel(downstream)}`);
         if (!includeShieldKey && gatewayConfig.shieldKey) {
@@ -2382,7 +2425,7 @@ async function installClaudeDesktopMcpGatewayCommand(args, config) {
     for (const target of targets) {
         writeMcpServerConfig(target.file, serverName, nodeExe, commandArgs);
     }
-    console.log('AgentGuard MCP Gateway installed for Claude Desktop.');
+    console.log('FullCourtDefense MCP Gateway installed for Claude Desktop.');
     for (const target of targets) {
         console.log(`Config: ${target.file} (${target.source})`);
     }
@@ -2403,7 +2446,7 @@ async function installCodexMcpGatewayCommand(args, config) {
     const downstream = resolveDownstreamSpec(args);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstream, INSTALL_GATEWAY_ARGS);
     writeCodexMcpServer(file, serverName, nodeExe, commandArgs);
-    console.log(`AgentGuard MCP Gateway installed for Codex (${projectScope ? 'project' : 'global'}).`);
+    console.log(`FullCourtDefense MCP Gateway installed for Codex (${projectScope ? 'project' : 'global'}).`);
     console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);
     console.log('Restart Codex or reload MCP servers. Project config requires a trusted project.');
@@ -2421,7 +2464,7 @@ async function installGeminiMcpGatewayCommand(args, config) {
     const downstream = resolveDownstreamSpec(args);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstream, INSTALL_GATEWAY_ARGS);
     writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
-    console.log(`AgentGuard MCP Gateway installed for Gemini CLI (${projectScope ? 'project' : 'user'}).`);
+    console.log(`FullCourtDefense MCP Gateway installed for Gemini CLI (${projectScope ? 'project' : 'user'}).`);
     console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);
     console.log('Restart Gemini CLI to load the protected tools.');
@@ -2438,7 +2481,7 @@ async function installWindsurfMcpGatewayCommand(args, config) {
     const downstream = resolveDownstreamSpec(args);
     const commandArgs = buildGatewayCommandArgs(gatewayConfig, downstream, INSTALL_GATEWAY_ARGS);
     writeJsonMcpServer(file, serverName, nodeExe, commandArgs);
-    console.log('AgentGuard MCP Gateway installed for Windsurf.');
+    console.log('FullCourtDefense MCP Gateway installed for Windsurf.');
     console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);
     console.log('Restart Windsurf to load the protected tools.');
@@ -2465,7 +2508,7 @@ async function installVscodeMcpGatewayCommand(args, config) {
     for (const file of targets) {
         writeVscodeMcpServer(file, serverName, nodeExe, commandArgs);
     }
-    console.log('AgentGuard MCP Gateway installed for VS Code.');
+    console.log('FullCourtDefense MCP Gateway installed for VS Code.');
     for (const file of targets)
         console.log(`Config: ${file}`);
     console.log(`Server: ${serverName}`);

package/dist/commands/onboard.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.onboardCommand = onboardCommand;
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -57,6 +58,33 @@ const envDiagnostics_1 = require("../envDiagnostics");
 const runtimeConfig_1 = require("../runtimeConfig");
 const daemonForensics_1 = require("../daemonForensics");
 const onboardingJournal_1 = require("./onboardingJournal");
+/**
+ * Best-effort: which AI client apps are running RIGHT NOW. Apps launched before
+ * onboarding keep their old, unwrapped config in memory until restarted — the
+ * single biggest "it says protected but isn't" trust gap, so the final message
+ * names the exact apps that still need a restart. Failure returns [] silently.
+ */
+function detectRunningAiClients() {
+    const targets = [
+        { names: ['cursor.exe', 'cursor'], label: 'Cursor' },
+        { names: ['code.exe', 'code'], label: 'VS Code' },
+        { names: ['claude.exe', 'claude'], label: 'Claude Desktop' },
+        { names: ['windsurf.exe', 'windsurf'], label: 'Windsurf' },
+    ];
+    try {
+        const raw = process.platform === 'win32'
+            ? (0, child_process_1.execSync)('tasklist /FO CSV /NH', { encoding: 'utf8', timeout: 10_000, windowsHide: true })
+            : (0, child_process_1.execSync)('ps -A -o comm=', { encoding: 'utf8', timeout: 10_000 });
+        const running = new Set(raw.split(/\r?\n/).map(line => {
+            const name = process.platform === 'win32' ? (line.match(/^"([^"]+)"/)?.[1] ?? '') : line.trim();
+            return path.basename(name).toLowerCase();
+        }).filter(Boolean));
+        return targets.filter(target => target.names.some(name => running.has(name))).map(target => target.label);
+    }
+    catch {
+        return [];
+    }
+}
 const GREEN = '\x1b[32m';
 const RED = '\x1b[31m';
 const YELLOW = '\x1b[33m';
@@ -277,7 +305,11 @@ async function onboardCommand(args, config) {
             console.log(JSON.stringify({ ok: !Object.values(journal.steps).some(step => step.critical && step.status === 'failed'), journalPath: journalFile, ...journal }));
     };
     console.log(`\n${BOLD}\x1b[36mFullCourtDefense — machine onboarding${RESET}`);
-    console.log(`${DIM}Connectivity -> enrollment -> protection -> verification. One command.${RESET}\n`);
+    console.log(`${DIM}Connectivity -> enrollment -> protection -> verification. One command.${RESET}`);
+    // Stated up front, before consent: enrollment starts in monitor (detect-only)
+    // mode so nothing in the developer's workflow breaks while the fleet baselines
+    // this machine. Admins promote it to blocking mode from the fleet console.
+    console.log(`${DIM}New machines start in ${RESET}${BOLD}monitor mode${RESET}${DIM} — every agent action is recorded and analyzed, nothing is blocked yet. Your admin promotes the machine to blocking mode from the fleet console once its workflow is baselined.${RESET}\n`);
     // Trust disclosure first — nothing touches the machine before consent.
     // Dry runs report the plan without changing anything, so no prompt there.
     if (!dryRun && !(await confirmTrustDisclosure(args))) {
@@ -623,14 +655,29 @@ async function onboardCommand(args, config) {
     for (const check of checks)
         printCheck(check);
     const requiredFailures = checks.filter(check => !check.ok && !check.optional);
-    const dashboard = (0, notify_1.consoleUrl)('/agent-security/users?view=desktop');
+    const dashboard = (0, notify_1.consoleUrl)('/agent-security/users?view=machines');
     console.log('');
     if (requiredFailures.length === 0) {
-        console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet and enforces your policies in blocking mode — dangerous actions are stopped, not just logged.`);
+        // Honest final state: installation is verified, but AI apps that were
+        // already open still run their OLD (unwrapped) configuration until they
+        // restart. Never print an unconditional green "protected" before that.
+        const runningClients = dryRun ? [] : detectRunningAiClients();
+        console.log(`${GREEN}${BOLD}Protection is installed and verified.${RESET} This machine reports to your org's AI Fleet in monitor mode — actions are recorded and analyzed while the fleet baselines this machine. An admin can promote it to blocking mode from the console.`);
+        if (runningClients.length > 0) {
+            console.log('');
+            console.log(`${YELLOW}${BOLD}  ! ACTION REQUIRED — restart ${runningClients.join(', ')}.${RESET}`);
+            console.log(`${YELLOW}    ${runningClients.length === 1 ? 'This app is' : 'These apps are'} running with the configuration from before onboarding — agent actions inside ${runningClients.length === 1 ? 'it are' : 'them are'} NOT protected until restarted. Anything launched from now on is protected automatically.${RESET}`);
+        }
+        else {
+            console.log('');
+            console.log(`${YELLOW}${BOLD}  ! One step left:${RESET} ${YELLOW}restart any AI apps that were open during onboarding (Cursor, Claude, VS Code, …) so they load the protected configuration. Apps launched from now on are protected automatically.${RESET}`);
+        }
+        console.log('');
         console.log(`${DIM}Fleet view: ${dashboard}${RESET}`);
-        console.log(`${DIM}Restart your AI clients (Cursor, Claude, VS Code, …) so they pick up the wrapped configs.${RESET}`);
         mark('verification', 'completed');
-        report('Onboarding complete. Restart AI clients to load protected configurations.');
+        report(runningClients.length > 0
+            ? `Onboarding complete. Restart required: ${runningClients.join(', ')} still run the pre-onboarding configuration.`
+            : 'Onboarding complete. Restart AI clients to load protected configurations.');
     }
     else {
         console.log(`${YELLOW}${BOLD}Onboarding finished with ${requiredFailures.length} unresolved surface(s).${RESET} Fix the ✗ lines above and re-run ${BOLD}fullcourtdefense onboard${RESET}.`);

package/dist/commands/posixShellGuard.js

@@ -103,7 +103,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,

package/dist/commands/shellGuard.js

@@ -254,10 +254,13 @@ function cachedMode() {
         const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
         entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
         const mode = entries[0]?.mode;
-        return mode === 'monitor' || mode === 'shadow' ? 'monitor' : 'block';
+        // Enforce only on an explicit cached 'block'; missing/unknown = monitor.
+        // A machine that has never been told to enforce must not block typed
+        // commands (fresh install before the first bundle fetch, wiped cache).
+        return mode === 'block' ? 'block' : 'monitor';
     }
     catch {
-        return 'block';
+        return 'monitor';
     }
 }
 /**
@@ -459,13 +462,13 @@ function buildGuardPs1(nodePath, cliEntry) {
         `$global:FcdSpoolPath = ${psQuote(SPOOL_PATH)}`,
         `$global:FcdNodePath  = ${psQuote(nodePath)}`,
         `$global:FcdCliEntry  = ${psQuote(cliEntry)}`,
-        `$global:FcdGuardMode = 'block'`,
+        `$global:FcdGuardMode = 'monitor'`,
         `$global:FcdGuardRules = @()`,
         ``,
         `try {`,
         `  if (Test-Path $global:FcdRulesPath) {`,
         `    $fcdRaw = Get-Content -Raw -Path $global:FcdRulesPath | ConvertFrom-Json`,
-        `    if ($fcdRaw.mode -eq 'monitor') { $global:FcdGuardMode = 'monitor' }`,
+        `    if ($fcdRaw.mode -eq 'block') { $global:FcdGuardMode = 'block' }`,
         `    $global:FcdGuardRules = @($fcdRaw.rules | ForEach-Object {`,
         `      try {`,
         `        [pscustomobject]@{`,

package/dist/commands/taintLedger.d.ts

@@ -26,7 +26,13 @@ export interface TaintFinding {
     source: TaintSource;
     sink: TaintSink;
 }
-/** Whether taint tracking is enabled (opt-out via env). */
+/**
+ * Whether taint tracking is enabled. OPT-IN for now (FCD_TAINT_ENFORCED=1):
+ * the session taint guard held benign commands in invisible approve-once waits
+ * (e.g. a health ping to the org's own API), which reads as a frozen terminal.
+ * Default OFF until it understands trusted destinations and the hold is visible.
+ * FCD_TAINT_DISABLED=1 still force-disables (back-compat).
+ */
 export declare function taintEnabled(): boolean;
 export declare function loadLedger(sessionId: string): TaintLedger;
 /** Record the developer's prompt text so sink actions can be checked against it. */

package/dist/commands/taintLedger.js

@@ -74,9 +74,17 @@ const path = __importStar(require("path"));
 const LEDGER_TTL_MS = 24 * 60 * 60 * 1000; // sessions older than 24h are pruned
 const MAX_PROMPTS = 30;
 const MAX_SOURCES = 50;
-/** Whether taint tracking is enabled (opt-out via env). */
+/**
+ * Whether taint tracking is enabled. OPT-IN for now (FCD_TAINT_ENFORCED=1):
+ * the session taint guard held benign commands in invisible approve-once waits
+ * (e.g. a health ping to the org's own API), which reads as a frozen terminal.
+ * Default OFF until it understands trusted destinations and the hold is visible.
+ * FCD_TAINT_DISABLED=1 still force-disables (back-compat).
+ */
 function taintEnabled() {
-    return process.env.FCD_TAINT_DISABLED !== 'true' && process.env.FCD_TAINT_DISABLED !== '1';
+    if (process.env.FCD_TAINT_DISABLED === 'true' || process.env.FCD_TAINT_DISABLED === '1')
+        return false;
+    return process.env.FCD_TAINT_ENFORCED === 'true' || process.env.FCD_TAINT_ENFORCED === '1';
 }
 function taintDir() {
     return path.join(os.homedir(), '.fullcourtdefense', 'taint');

package/dist/output.js

@@ -63,7 +63,7 @@ function formatTable(result) {
     const failed = attacks.length - passed;
     const lines = [];
     lines.push('');
-    lines.push(`${BOLD}${CYAN}  BotGuard Security Scan${RESET}`);
+    lines.push(`${BOLD}${CYAN}  FullCourtDefense Security Scan${RESET}`);
     lines.push(`  ${DIM}${line('─', 50)}${RESET}`);
     lines.push('');
     // Score
@@ -256,7 +256,7 @@ function formatJson(result) {
 function formatCredits(credits) {
     const lines = [];
     lines.push('');
-    lines.push(`${BOLD}${CYAN}  BotGuard Credits${RESET}`);
+    lines.push(`${BOLD}${CYAN}  FullCourtDefense Credits${RESET}`);
     lines.push(`  ${DIM}${line('─', 40)}${RESET}`);
     lines.push(`  Plan:      ${BOLD}${credits.plan}${RESET}`);
     lines.push(`  Used:      ${credits.creditsUsed} / ${credits.monthlyCredits}`);

package/dist/runtimeConfig.js

@@ -179,7 +179,12 @@ async function getRuntimeBundle(input) {
     if (cached) {
         return cachedToEffective(cached);
     }
-    return { mode: 'block', version: '', source: 'default' };
+    // No cache and no server: there is NO evidence this machine was ever told to
+    // enforce. Default to monitor — a fresh install with a network hiccup must
+    // not hard-block the developer. Machines that WERE told to enforce keep
+    // enforcement through the stale-while-error cache above, and explicit
+    // install-time --enforce/--fail-closed flags still win in the callers.
+    return { mode: 'monitor', version: '', source: 'default' };
 }
 /**
  * Prove the machine's credentials actually WORK against the backend — a

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.24.2"
+  "version": "1.25.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.24.2",
+  "version": "1.25.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {