fullcourtdefense-cli 1.25.3 → 1.25.5

package/dist/commands/cmdGuard.js

@@ -112,19 +112,26 @@ function batQuote(value) {
 function buildGuardJs(nodePath, cliEntry) {
     return [
         `'use strict';`,
-        `const fs=require('fs');const os=require('os');const path=require('path');const{spawnSync}=require('child_process');const crypto=require('crypto');`,
+        `const fs=require('fs');const os=require('os');const path=require('path');const{spawn,spawnSync}=require('child_process');const crypto=require('crypto');`,
         `const RULES_PATH=${JSON.stringify(GUARD_RULES_PATH)};`,
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
+        `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
+        `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
+        `// made the user's terminal wait for a full CLI process INCLUDING the network`,
+        `// flush after every finding. Monitor mode must never add synchronous latency.`,
+        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
         `const line=args.join(' ');const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)delegate(args);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');delegate(args);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,

package/dist/commands/deterministicGuard.d.ts

@@ -55,6 +55,7 @@ export interface LocalSafetyScanOptions {
      */
     trustedScriptPaths?: string[];
 }
+export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
@@ -615,10 +616,12 @@ function credentialCommandReason(value) {
 function destructiveCommandReason(value) {
     return matchCommand(value, (text, lower) => {
         // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`), and the target
-        // may be the root `/`, the root wildcard `/*`, or a bare `*`.
-        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        // may be the root `/`, the root wildcard `/*`, or a bare `*`. Terminators
+        // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
+        // outer command — is caught too.
+        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
@@ -779,13 +782,81 @@ function isSensitivePathContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return /(?:path|file|filename|dir|directory|target|source|src|dest|location|glob|pattern|uri|url)/i.test(lastKey);
 }
-function scanTextValue(toolName, value, options) {
-    const honeypot = honeypotTouch(value, options);
+// ---- execution view: message/document DATA inside a command is inert ---------
+// Industry-standard model (Sigma / EDR command-line parsing): detection matches
+// what EXECUTES — the command word and its argv — never free text riding inside
+// a data argument. Quoted spans containing whitespace are prose (commit
+// messages, issue/PR bodies, file contents via Set-Content/-Value, docs) and
+// are inert BY DEFAULT; code positions are the enumerated exception. This
+// inverts the old text-sink flag allowlist (-m/--body/-Value…), which lost
+// every time a new data flag appeared — code sinks are a small stable set,
+// data flags are infinite.
+//
+// Safety invariants (false-negative guards):
+//   1. NOTHING is stripped when the text can feed an interpreter (| sh, iex,
+//      eval, xargs, base64 -d, -EncodedCommand, FromBase64String) or invoke an
+//      interpreter code flag (bash -c, python -c) or a remote/nested executor
+//      (ssh, wsl, chroot, docker|kubectl|podman exec/run). A whole-line bailout
+//      is always FN-safe and also defeats quote-splitting obfuscation
+//      (`wsl -e bash -c ""r""m"…`) that per-span reasoning cannot survive.
+//   2. A double-quoted span containing $( … ) or real backtick command
+//      substitution is kept — substitution executes BEFORE the outer command.
+//      A single-char backtick pair (`n, `t) is a PowerShell ESCAPE, not code.
+//   3. Single-token quoted spans (rm -rf "/") are argv, not prose — kept.
+//   4. Quoted spans in a CODE POSITION (interpreter -c/-Command/-e flags, or a
+//      remote executor earlier in the same statement) are kept.
+//   5. Secret-literal rules and honeypot/custom rules never use this view —
+//      a token pasted into a commit message still leaks.
+const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+// $( … ) always executes; backtick pairs only with ≥2 chars of content
+// (PowerShell escapes like `n / `t are single-char and inert).
+const INTERPOLATES = /\$\(|`[^`]{2,}`/;
+const INERT_DATA = ' fcd_inert_data ';
+// Code position immediately before a quoted span: interpreter code flags or a
+// remote/nested executor earlier in the same statement (no ; & | between).
+const CODE_CONTEXT_BEFORE = /(?:(?:^|[;&|(]|\s)(?:-c|\/c|-e|-command|-scriptblock|-filter)[= ]\s*|(?:^|[;&|(]\s*)(?:\S*[\\/])?(?:sudo\s+|doas\s+)?(?:ssh|wsl(?:\.exe)?|chroot|su|screen|tmux)(?:\s[^;&|"']*)?\s|(?:\S*[\\/])?(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b[^;&|"']*\s)$/i;
+function stripInertDataSegments(text) {
+    if (DATA_TO_INTERPRETER.test(text))
+        return text;
+    let out = text;
+    // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
+    out = out.replace(/@'[\s\S]*?'@/g, INERT_DATA);
+    out = out.replace(/@"[\s\S]*?"@/g, m => (m.includes('$(') ? m : INERT_DATA));
+    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
+    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
+    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
+    // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
+    // unless the span sits in a code position (invariants 2–4 above).
+    const src = out;
+    out = src.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
+        const body = dq !== undefined ? dq : (sq || '');
+        if (!/\s/.test(body))
+            return whole; // single token: argv, not prose
+        const before = src.slice(Math.max(0, offset - 80), offset);
+        if (CODE_CONTEXT_BEFORE.test(before))
+            return whole; // code position: executes
+        if (dq !== undefined && INTERPOLATES.test(body))
+            return whole; // $( )/`cmd` executes first
+        return INERT_DATA;
+    });
+    return out;
+}
+function scanTextValue(toolName, rawValue, options) {
+    // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
+    // even inside message data is exfiltration staging, and custom rules define
+    // their own scope.
+    const honeypot = honeypotTouch(rawValue, options);
     if (honeypot)
         return honeypot;
-    const custom = customBlock(value, options);
+    const custom = customBlock(rawValue, options);
     if (custom)
         return custom;
+    // Every rule below asks "can this text ACT?" — so it sees the execution
+    // view: quoted message/document data (commit -m, issue --body, here-strings,
+    // heredocs) is inert unless it can flow into an interpreter (see
+    // stripInertDataSegments invariants). This is the generic FP guard for
+    // "wrote ABOUT a dangerous command" vs "ran one".
+    const value = stripInertDataSegments(rawValue);
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.

package/dist/commands/hook.js

@@ -348,9 +348,9 @@ function degradedAllowMessage(event, detail) {
  * field hit the timeout on transient jitter, and a single retry converts
  * nearly all of them into normal verdicts instead of degraded decisions.
  */
-async function fetchWithOneRetry(url, init, timeoutMs, onFailure) {
+async function fetchWithOneRetry(url, init, timeoutMs, onFailure, attempts = 2) {
     let lastError;
-    for (let attempt = 1; attempt <= 2; attempt++) {
+    for (let attempt = 1; attempt <= attempts; attempt++) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         try {
@@ -385,8 +385,11 @@ function respondDegraded(ctx, detail, toolName, authRejected = false) {
     const advice = authRejected
         ? 'Re-enroll this machine: fullcourtdefense onboard --token <fleet-enrollment-token>.'
         : 'Do not retry until the connection is restored.';
+    // Always track the outage — monitor/shadow machines use the streak too
+    // (gateRecentlyDown) to skip synchronous gate calls while the backend is
+    // down, so a dead network costs them zero added latency per action.
+    const health = (0, policyGateHealth_1.recordGateFailure)();
     if (ctx.failClosed && !ctx.shadow) {
-        const health = (0, policyGateHealth_1.recordGateFailure)();
         if ((0, policyGateHealth_1.shouldFailClosed)(health)) {
             // Persistent outage on an enforcing machine: block, and raise a CRITICAL
             // distress code — the daemon heartbeat ships it and org admins get the
@@ -422,14 +425,19 @@ function respondDegraded(ctx, detail, toolName, authRejected = false) {
  * which is unreachable by definition here. Monitor/shadow machines stay
  * report-only — the local verdict is logged, nothing is stopped.
  */
-function tryLocalPolicyEnforcement(ctx, call, detail) {
+function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     const policies = ctx.localPolicies;
     if (!policies || policies.length === 0)
         return false;
     // Track the outage for visibility: distress ships on the next heartbeat and
-    // the failure streak still feeds the grace-window state.
-    (0, policyGateHealth_1.recordGateFailure)();
-    (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.NETWORK_DOWN, `policy gate unreachable — enforcing locally from cached bundle (${policies.length} policies): ${detail}`);
+    // the failure streak still feeds the grace-window state. Skipped-call paths
+    // (monitor gate-down fast path) pass countAsGateFailure:false — refreshing
+    // lastFailureAt on every SKIP would keep gateRecentlyDown() true forever and
+    // the machine would never retry the gate.
+    if (opts.countAsGateFailure !== false) {
+        (0, policyGateHealth_1.recordGateFailure)();
+        (0, distress_1.reportDistress)('hook', distress_1.DISTRESS.NETWORK_DOWN, `policy gate unreachable — enforcing locally from cached bundle (${policies.length} policies): ${detail}`);
+    }
     const { operation, context } = (0, actionPolicyEngine_1.inferToolContext)(call.toolName, call.toolArgs);
     context.toolName = call.toolName;
     context.developerName = developerId();
@@ -440,7 +448,9 @@ function tryLocalPolicyEnforcement(ctx, call, detail) {
     if (local.verdict === 'block' || local.verdict === 'require_approval') {
         const reason = local.reason || `${call.toolName}: local policy ${local.verdict}`;
         if (ctx.shadow) {
-            (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `[shadow] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
+            // Truth-in-reporting: the action RAN — 'warn' (advisory), never 'allow'
+            // (which hides the would-block from the console) and never 'block'.
+            (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName: call.toolName, reason: `[monitor] local policy would ${local.verdict} (offline): ${reason}`, offlineEnforced: true });
             (0, telemetry_1.triggerFlush)(false);
             ctx.respond(false, undefined, `[FullCourtDefense shadow] would ${local.verdict === 'block' ? 'block' : 'require approval for'} ${call.toolName} (offline, locally cached policy): ${reason}`);
         }
@@ -811,7 +821,8 @@ async function hookCommand(args, config) {
         if (localBlock) {
             dbg({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
             if (shadow) {
-                spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt' });
+                // Truth-in-reporting: this prompt RAN (shadow/monitor) — 'warn', never 'block'.
+                spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt', decision: 'warn' });
                 respond(false, undefined, `[FullCourtDefense shadow] would block prompt: ${localBlock.reason}`);
                 return;
             }
@@ -935,7 +946,8 @@ async function enforceActionPolicy(ctx) {
     if (localBlock) {
         dbg({ phase: 'local_deterministic_block', event, tool: call.toolName, ruleId: localBlock.ruleId, category: localBlock.category });
         if (shadow) {
-            spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event });
+            // Truth-in-reporting: this action RAN (shadow/monitor) — 'warn', never 'block'.
+            spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event, decision: 'warn' });
             respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${localBlock.reason}`);
             return;
         }
@@ -982,6 +994,26 @@ async function enforceActionPolicy(ctx) {
     const headers = { 'Content-Type': 'application/json' };
     if (shieldKey)
         headers['x-shield-key'] = shieldKey;
+    // MONITOR CONTRACT (latency half): a monitor/shadow machine must never make
+    // the developer WAIT on the network. During a known outage (a gate failure in
+    // the last 60s) skip the synchronous call entirely — cached org policies are
+    // evaluated locally and any finding rides the async spool. Otherwise keep the
+    // call (it records the action in the console) but bound it to ONE attempt
+    // with a tight window; on a miss the catch below degrades to local
+    // evaluation and the action proceeds. Enforce machines keep the full
+    // timeout + retry: their verdict actually gates the action.
+    if (shadow && (0, policyGateHealth_1.gateRecentlyDown)()) {
+        dbg({ phase: 'policy_skip_gate_down', event, tool: call.toolName });
+        const detail = 'Policy gate recently unreachable — monitor mode skipped the synchronous check.';
+        if (!tryLocalPolicyEnforcement(ctx, call, detail, { countAsGateFailure: false })) {
+            (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `monitor: ${detail}`, offlineEnforced: true });
+            (0, telemetry_1.triggerFlush)(false);
+            respond(false);
+        }
+        return;
+    }
+    const gateTimeoutMs = shadow ? Math.min(timeoutMs, 1500) : timeoutMs;
+    const gateAttempts = shadow ? 1 : 2;
     let result;
     try {
         const resp = await fetchWithOneRetry(`${apiUrl}/api/agent-security/runtime/check-tool-call`, {
@@ -1001,7 +1033,7 @@ async function enforceActionPolicy(ctx) {
                 ...(event === 'mcp' && mcpServerName(payload) ? { mcpServer: mcpServerName(payload) } : {}),
                 ...machineMetadata(ctx.client),
             }),
-        }, timeoutMs, (attempt, err) => dbg({ phase: 'policy_retry', event, attempt, error: err }));
+        }, gateTimeoutMs, (attempt, err) => dbg({ phase: 'policy_retry', event, attempt, error: err }), gateAttempts);
         if (!resp.ok) {
             dbg({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
             const authRejected = resp.status === 401 || resp.status === 403;
@@ -1131,6 +1163,19 @@ async function waitForApproval(input) {
 }
 async function enforceShieldText(ctx) {
     const { event, text, payload, apiUrl, shieldId, shieldKey, shadow, timeoutMs, respond } = ctx;
+    // MONITOR CONTRACT (latency half — same rule as enforceActionPolicy): a
+    // monitor/shadow machine never makes the developer WAIT on the network.
+    // Known outage => skip the synchronous Shield call (local deterministic
+    // rules already ran; reporting rides the async spool). Otherwise one tight
+    // attempt; a miss degrades to allow via the catch below.
+    if (shadow && (0, policyGateHealth_1.gateRecentlyDown)()) {
+        dbg({ phase: 'shield_skip_gate_down', event });
+        (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: 'prompt', reason: 'monitor: Shield gate recently unreachable — skipped the synchronous scan.', offlineEnforced: true });
+        (0, telemetry_1.triggerFlush)(false);
+        respond(false);
+    }
+    const gateTimeoutMs = shadow ? Math.min(timeoutMs, 1500) : timeoutMs;
+    const gateAttempts = shadow ? 1 : 2;
     try {
         const headers = {
             'Content-Type': 'application/json',
@@ -1145,7 +1190,7 @@ async function enforceShieldText(ctx) {
             method: 'POST',
             headers,
             body: JSON.stringify({ message: text }),
-        }, timeoutMs, (attempt, error) => dbg({ phase: 'shield_retry', event, attempt, error }));
+        }, gateTimeoutMs, (attempt, error) => dbg({ phase: 'shield_retry', event, attempt, error }), gateAttempts);
         if (!resp.ok) {
             respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, 'prompt');
             return;

package/dist/commands/mcpGateway.js

@@ -619,7 +619,7 @@ class AgentGuardApi {
     constructor(config) {
         this.config = config;
     }
-    async checkToolCall(input) {
+    async checkToolCall(input, timeoutMs) {
         const result = await this.post('/api/agent-security/runtime/check-tool-call', {
             shieldId: this.config.shieldId,
             agentName: this.config.agentName,
@@ -633,7 +633,7 @@ class AgentGuardApi {
             userObjective: this.config.userObjective,
             authority: this.config.authority,
             source: 'runtime_sdk',
-        });
+        }, timeoutMs);
         if (!result.success || !result.data) {
             if (result.status === 401 || result.status === 403)
                 throw new CredentialsRejectedError(result.status);
@@ -975,7 +975,12 @@ class McpGatewayServer {
             }
             let preflight;
             try {
-                preflight = await this.api.checkToolCall({ toolName, operation, toolArgs });
+                // MONITOR CONTRACT (latency half): a monitor/no-signal machine must not
+                // make the developer WAIT on the network. Keep the synchronous call (it
+                // records the action in the console) but bound it tightly — on timeout
+                // the catch below degrades to cached-policy evaluation and the call
+                // proceeds. Enforce machines keep the full window: their verdict gates.
+                preflight = await this.api.checkToolCall({ toolName, operation, toolArgs }, reportOnlyMode ? 1_500 : undefined);
             }
             catch (err) {
                 // Policy service unreachable. Local deterministic rules (above) already
@@ -1029,6 +1034,26 @@ class McpGatewayServer {
                 }
             }
             operation = preflight.operation;
+            if (!preflight.allowed && reportOnlyMode) {
+                // MONITOR CONTRACT (online mirror of the offline gate above): the
+                // backend's check-tool-call does NOT downgrade verdicts by shield mode,
+                // so a monitor machine CAN receive block/approval here (e.g. an enforce
+                // Action Policy created from discovery). A monitor machine never blocks
+                // and never pauses for approval — record the would-verdict, let it run.
+                const wouldReason = preflight.actionPolicy?.reason
+                    || preflight.intentEvaluation?.reasons?.[0]
+                    || `Tool call ${preflight.decision} by FullCourtDefense.`;
+                (0, telemetry_1.spoolEvent)({
+                    decision: 'warn',
+                    toolName,
+                    operation,
+                    reason: `[monitor] policy would ${preflight.decision === 'approval' ? 'require approval' : preflight.decision}: ${wouldReason}`,
+                    ruleId: preflight.actionPolicy?.policyName ? `action-policy:${preflight.actionPolicy.policyName}` : undefined,
+                });
+                (0, telemetry_1.triggerFlush)(false);
+                process.stderr.write(`FullCourtDefense (monitor) would ${preflight.decision === 'approval' ? 'require approval for' : 'block'} ${toolName}: ${wouldReason}\n`);
+                preflight = { allowed: true, decision: 'allow', operation };
+            }
             if (!preflight.allowed) {
                 if (preflight.decision === 'approval' && this.gatewayConfig.approvalMode === 'wait') {
                     approvalActionId = preflight.approvalActionId;

package/dist/commands/posixShellGuard.js

@@ -104,7 +104,11 @@ function buildGuardJs(nodePath, cliEntry) {
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
+        `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
+        `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
@@ -112,7 +116,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `if(process.env.FCD_SHELL_GUARD==='off')process.exit(0);`,
         `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)process.exit(0);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');process.exit(0);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,

package/dist/commands/shellGuard.js

@@ -485,14 +485,48 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  }`,
         `} catch { $global:FcdGuardRules = @() }`,
         ``,
+        `# Execution view (aligned with the CLI's stripInertDataSegments): quoted`,
+        `# spans containing whitespace are prose — inert BY DEFAULT — unless in a`,
+        `# code position: interpreter -c/-Command flags, remote executors (ssh/wsl/`,
+        `# docker exec), $( ) substitution, or real backtick command substitution`,
+        `# (>=2 chars of content; a 1-char pair like \`n is a PS ESCAPE, not code).`,
+        `# Whole-line bailout on any interpreter/executor construct keeps detection`,
+        `# false-negative-safe. Single-token quoted args stay: argv (rm -rf "/").`,
+        `function global:Get-FcdExecView {`,
+        `  param([string]$CommandLine)`,
+        String.raw `  if ($CommandLine -match '(?i)\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\s+(?:-c|/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b') { return $CommandLine }`,
+        `  $out = $CommandLine`,
+        "  $interp = '\\$\\(|" + '`[^`]{2,}`' + "'",
+        "  $keepIfInterpolates = [System.Text.RegularExpressions.MatchEvaluator]{ param($m) if ($m.Value -match $interp) { $m.Value } else { ' fcd_inert_data ' } }",
+        String.raw `  $out = [regex]::Replace($out, "@'[\s\S]*?'@", ' fcd_inert_data ')`,
+        `  $out = [regex]::Replace($out, '@"[\\s\\S]*?"@', $keepIfInterpolates)`,
+        String.raw `  $out = [regex]::Replace($out, "<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)", ' fcd_inert_data ')`,
+        String.raw `  $out = [regex]::Replace($out, '<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)', $keepIfInterpolates)`,
+        String.raw `  $codeCtx = '(?i)(?:(?:^|[;&|(]|\s)(?:-c|/c|-e|-command|-scriptblock|-filter)[= ]\s*|(?:^|[;&|(]\s*)(?:\S*[\\/])?(?:sudo\s+|doas\s+)?(?:ssh|wsl(?:\.exe)?|chroot|su|screen|tmux)(?:\s[^;&|"'']*)?\s|(?:\S*[\\/])?(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b[^;&|"'']*\s)$'`,
+        String.raw `  $quotedRe = '"((?:[^"\\]|\\.)*)"|''((?:[^''\\]|\\.)*)'''`,
+        `  $src = $out`,
+        String.raw `  $spanEval = [System.Text.RegularExpressions.MatchEvaluator]{ param($m) $body = if ($m.Groups[1].Success) { $m.Groups[1].Value } else { $m.Groups[2].Value }; if ($body -notmatch '\s') { return $m.Value }; $start = [Math]::Max(0, $m.Index - 80); if ($src.Substring($start, $m.Index - $start) -match $codeCtx) { return $m.Value }; if ($m.Groups[1].Success -and $body -match $interp) { return $m.Value }; return ' fcd_inert_data ' }`,
+        `  $out = [regex]::Replace($src, $quotedRe, $spanEval)`,
+        `  return $out`,
+        `}`,
+        ``,
         `function global:Test-FcdShellGuard {`,
         `  param([string]$CommandLine)`,
         `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
         `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  $execView = $CommandLine`,
+        `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
+        `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
-        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) {`,
+        `      # Built-in rules ask "can this text ACT?" — they see the execution`,
+        `      # view, so a commit message quoting a dangerous command is inert.`,
+        `      # Console custom rules define their own scope — they see the raw line.`,
+        `      $isCustom = ([string]$rule.Source -eq 'custom')`,
+        `      $target = if ($isCustom) { $CommandLine } else { $execView }`,
+        `      $targetNorm = if ($isCustom) { $normalized } else { $execNormalized }`,
+        `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
         `        # A block rule always outranks a warn rule matching the same line.`,
         `        if ($rule.Action -ne 'warn') { return $rule }`,
         `        if ($null -eq $warnHit) { $warnHit = $rule }`,
@@ -546,7 +580,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      if ($global:FcdGuardMode -eq 'monitor') {`,
         `        Write-Host ''`,
         `        Write-Host ('[FullCourtDefense] monitor: would block [' + $hit.Severity + '] ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
-        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow'`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'warn'`,
         `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
         `        return`,
         `      }`,

package/dist/policyGateHealth.d.ts

@@ -29,5 +29,13 @@ export interface GateHealth {
 export declare function recordGateSuccess(): void;
 /** Record one failed gate round-trip and return the updated streak. */
 export declare function recordGateFailure(now?: Date): GateHealth;
+/**
+ * True when the gate failed very recently. Monitor/shadow surfaces use this to
+ * skip the synchronous policy call entirely during an outage (reporting rides
+ * the async spool instead), so a dead/hanging backend costs a monitor machine
+ * ZERO added latency after the first bounded miss. The 60s window guarantees
+ * an automatic retry, which resets the streak via recordGateSuccess().
+ */
+export declare function gateRecentlyDown(now?: Date): boolean;
 /** Fail closed only for persistent outages, never for a single blip. */
 export declare function shouldFailClosed(health: GateHealth, now?: Date): boolean;

package/dist/policyGateHealth.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FAIL_CLOSED_AFTER_MS = exports.FAIL_CLOSED_AFTER_FAILURES = void 0;
 exports.recordGateSuccess = recordGateSuccess;
 exports.recordGateFailure = recordGateFailure;
+exports.gateRecentlyDown = gateRecentlyDown;
 exports.shouldFailClosed = shouldFailClosed;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -104,6 +105,19 @@ function recordGateFailure(now = new Date()) {
     catch { /* best-effort */ }
     return next;
 }
+/**
+ * True when the gate failed very recently. Monitor/shadow surfaces use this to
+ * skip the synchronous policy call entirely during an outage (reporting rides
+ * the async spool instead), so a dead/hanging backend costs a monitor machine
+ * ZERO added latency after the first bounded miss. The 60s window guarantees
+ * an automatic retry, which resets the streak via recordGateSuccess().
+ */
+function gateRecentlyDown(now = new Date()) {
+    const health = readHealth();
+    return health.consecutiveFailures >= 1
+        && health.lastFailureAt !== undefined
+        && now.getTime() - Date.parse(health.lastFailureAt) < 60_000;
+}
 /** Fail closed only for persistent outages, never for a single blip. */
 function shouldFailClosed(health, now = new Date()) {
     if (health.consecutiveFailures >= exports.FAIL_CLOSED_AFTER_FAILURES)

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.25.3"
+  "version": "1.25.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.25.3",
+  "version": "1.25.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {