fullcourtdefense-cli 1.25.7 → 1.26.1

package/dist/commands/cmdGuard.js

@@ -74,21 +74,29 @@ const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
  * cmd (they ARE under PowerShell/zsh/bash and `shell-guard-check`).
  */
 const INTERCEPTED_COMMANDS = [
-    // Destructive filesystem / disk
+    // Destructive filesystem / disk / permission tampering
     'del', 'erase', 'rd', 'rmdir', 'format', 'cipher', 'diskpart', 'fsutil',
-    'robocopy', 'xcopy', 'takeown', 'icacls', 'attrib', 'compact',
+    'takeown', 'icacls', 'attrib', 'compact',
     // Backup / recovery / shadow-copy tampering (ransomware patterns)
     'vssadmin', 'wbadmin', 'bcdedit', 'wevtutil',
-    // Interpreters / download-and-exec vectors
-    'powershell', 'pwsh', 'curl', 'wget', 'certutil', 'bitsadmin', 'mshta',
-    'rundll32', 'regsvr32', 'wscript', 'cscript', 'wmic', 'wsl',
-    // Service / firewall / registry / accounts
-    'reg', 'net', 'net1', 'sc', 'netsh', 'schtasks', 'taskkill',
-    // Infra / cloud CLIs
-    'terraform', 'pulumi', 'kubectl', 'aws', 'gcloud', 'az', 'docker',
-    // VCS + database clients
-    'git', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
+    // Script hosts / LOLBin download-and-exec vectors (rare in dev workflows)
+    'powershell', 'pwsh', 'certutil', 'bitsadmin', 'mshta',
+    'rundll32', 'regsvr32', 'wscript', 'cscript', 'wmic',
+    // Service / firewall / registry / accounts / scheduled-task tampering
+    'reg', 'net', 'net1', 'sc', 'netsh', 'schtasks',
 ];
+/**
+ * LIGHTNESS DIET (deliberate non-goals of the cmd guard): high-frequency
+ * developer commands are NOT doskey-intercepted. Every macro costs a full
+ * Node spawn per typed command — plus a corporate-AV scan of node.exe — so
+ * wrapping `docker`/`git` made every docker-heavy terminal feel sticky.
+ * Dropped: docker, git, kubectl, aws, gcloud, az, terraform, pulumi, wsl,
+ * curl, wget, taskkill, robocopy, xcopy, psql, mysql, mongo, mongosh, sqlcmd.
+ * Coverage is NOT lost where it matters: agent-driven commands go through the
+ * IDE hooks (full ruleset, any position in the line), and humans typing in
+ * PowerShell are covered in-process by the PSReadLine guard. Interactive
+ * cmd.exe keeps only the rare, high-signal destructive/tamper commands above.
+ */
 function regString(key, value) {
     try {
         const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
@@ -130,7 +138,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
-        `const line=args.join(' ');const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
+        // TOP-LEVEL FAIL-OPEN: any unexpected exception in rule loading/matching
+        // must never break the user's typed command — treat it as "no hit" and
+        // delegate. A stack trace or nonzero exit here IS an outage for the shell.
+        `const line=args.join(' ');let mode='monitor';let hit=null;try{const r=loadRules();mode=r.mode;hit=matchLine(line,r.rules);}catch{hit=null;}`,
         `if(!hit)delegate(args);`,
         `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,

package/dist/commands/daemon.d.ts

@@ -1,5 +1,6 @@
 import { BotGuardConfig } from '../config';
 import { ProtectAllArgs } from './mcpGateway';
+import { windowsTaskRunsInteractive, windowsTaskRunsVisibly } from '../windowsTaskState';
 export interface DaemonArgs extends ProtectAllArgs {
     install?: string;
     uninstall?: string;
@@ -83,15 +84,7 @@ export declare function registerHiddenTask(taskName: string, xml: string | strin
 /** True when an existing scheduled task's action still runs wscript/cscript
  *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
 export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-export declare function windowsTaskRunsInteractive(taskName: string): boolean;
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-export declare function windowsTaskRunsVisibly(taskName: string): boolean;
+export { windowsTaskRunsInteractive, windowsTaskRunsVisibly };
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;

package/dist/commands/daemon.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsTaskRunsVisibly = exports.windowsTaskRunsInteractive = void 0;
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
@@ -44,8 +45,6 @@ exports.buildTaskXml = buildTaskXml;
 exports.buildTaskXmlVariants = buildTaskXmlVariants;
 exports.registerHiddenTask = registerHiddenTask;
 exports.windowsTaskReferencesScriptHost = windowsTaskReferencesScriptHost;
-exports.windowsTaskRunsInteractive = windowsTaskRunsInteractive;
-exports.windowsTaskRunsVisibly = windowsTaskRunsVisibly;
 exports.daemonRuntimeState = daemonRuntimeState;
 exports.spawnDetachedDaemon = spawnDetachedDaemon;
 exports.pidIsAlive = pidIsAlive;
@@ -76,9 +75,15 @@ const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
 const cmdGuard_1 = require("./cmdGuard");
 const machineActionVerify_1 = require("../machineActionVerify");
+const perfSnapshot_1 = require("../perfSnapshot");
 const desktopChatGuard_1 = require("./desktopChatGuard");
 const honeypot_1 = require("../honeypot");
 const windowsAudit_1 = require("./windowsAudit");
+const hook_1 = require("./hook");
+const verdictIpc_1 = require("../verdictIpc");
+const windowsTaskState_1 = require("../windowsTaskState");
+Object.defineProperty(exports, "windowsTaskRunsInteractive", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsInteractive; } });
+Object.defineProperty(exports, "windowsTaskRunsVisibly", { enumerable: true, get: function () { return windowsTaskState_1.windowsTaskRunsVisibly; } });
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -108,6 +113,11 @@ const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60
 const DISCOVER_STALE_MS = envMs('FCD_DAEMON_DISCOVER_STALE_MS', 20 * 60 * 60_000);
 /** How often the daemon re-checks discovery freshness. */
 const DISCOVER_CHECK_INTERVAL_MS = envMs('FCD_DAEMON_DISCOVER_CHECK_MS', 60 * 60_000);
+/** Boot catch-up sweep delay — well past login so it never competes with the
+ *  developer's IDE/browser startup (the sweep also runs at idle priority). */
+const DISCOVER_BOOT_CATCHUP_DELAY_MS = envMs('FCD_DAEMON_DISCOVER_BOOT_DELAY_MS', 15 * 60_000);
+/** Random jitter added to the boot catch-up so a fleet doesn't sweep in lockstep. */
+const DISCOVER_BOOT_CATCHUP_JITTER_MS = 5 * 60_000;
 /** Rotate the daemon log when it grows past this size. */
 const LOG_MAX_BYTES = 1_000_000;
 function daemonDir() {
@@ -225,6 +235,14 @@ function runDiscoverSweep(credentials, timeoutMs = 300_000) {
             // home so the posture scope reports a meaningful folder, not an OS dir.
             cwd: os.homedir(),
         });
+        // Idle CPU priority (IDLE_PRIORITY_CLASS on Windows, nice 19 on POSIX): a
+        // deep sweep must never compete with the developer's build/IDE for CPU.
+        // The sweep just takes longer on a busy machine — which is the point.
+        try {
+            if (child.pid)
+                os.setPriority(child.pid, 19);
+        }
+        catch { /* best-effort */ }
         let stderrTail = '';
         child.stderr?.on('data', (chunk) => {
             stderrTail = (stderrTail + chunk.toString('utf8')).slice(-4096);
@@ -616,10 +634,18 @@ async function runDaemon(args, config) {
                 body: JSON.stringify({ shieldId: creds.shieldId, machineId: identity.machineId, ...payload }),
                 signal: AbortSignal.timeout(15_000),
             });
+            if (!resp.ok) {
+                // Log the STATUS and the server's own words. Swallowing them turned a
+                // precise backend rejection into "network or backend rejection" in the
+                // console, which cost a Cloud Run log dig to diagnose — on the very
+                // feature whose job is to explain a machine remotely.
+                const body = await resp.text().catch(() => '');
+                log(`Diagnostics upload rejected: HTTP ${resp.status}${body ? ` — ${body.slice(0, 300).replace(/\s+/g, ' ')}` : ''}`);
+            }
             return resp.ok;
         }
-        catch {
-            log('Diagnostics upload failed (network) — the bundle stays available locally.');
+        catch (error) {
+            log(`Diagnostics upload failed (network: ${error.message}) — the bundle stays available locally.`);
             return false;
         }
     };
@@ -898,6 +924,31 @@ async function runDaemon(args, config) {
                 log('Discovery scan: upload complete — dashboard discovery + posture timestamps will refresh.');
                 resultSummary = 'Discovery + posture scan completed and uploaded.';
             }
+            else if (action.type === 'perf_snapshot') {
+                // On-demand performance proof: per-process footprint + hot-path
+                // micro-bench + disk state, collected in one shot (no resident
+                // profiler, no periodic sampling — the lightness principle applies
+                // to the measurement itself). Same collection as `doctor --perf`,
+                // so the console table matches what the customer sees locally.
+                log('Perf snapshot: measuring hot-path latency, process footprint, and disk state (~10s)…');
+                await uploadLogTail();
+                let bundleState = {};
+                try {
+                    const identity = (0, machineIdentity_1.getMachineIdentity)();
+                    const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                        apiUrl: creds.apiUrl, shieldId: creds.shieldId || '', shieldKey: creds.shieldKey,
+                        developerName: identity.developerName, machineName: identity.hostname, hotPath: true,
+                    });
+                    bundleState = { mode: bundle.mode, source: bundle.source, policyHash: bundle.policyHash };
+                }
+                catch { /* snapshot still useful without mode context */ }
+                const snapshot = (0, perfSnapshot_1.collectPerfSnapshot)({ cliVersion: cliVersion(), ...bundleState });
+                const uploaded = await uploadDiagnostics({ perfSnapshot: snapshot });
+                if (!uploaded)
+                    throw new Error('Perf snapshot could not be uploaded (network or backend rejection).');
+                resultSummary = (0, perfSnapshot_1.summarizePerfSnapshot)(snapshot);
+                log(`Perf snapshot: ${resultSummary}`);
+            }
             await reportMachineAction(action.id, 'succeeded', { resultSummary });
             log(`Remote action succeeded: ${action.type}.`);
         }
@@ -938,6 +989,9 @@ async function runDaemon(args, config) {
         }
         catch { /* offline — next poll retries */ }
     };
+    // Base cadence for the bundle poll — the server can slow a whole fleet down
+    // via pollIntervalMs (bounded: 15s..1h) without shipping a new CLI.
+    let bundlePollBaseMs = BUNDLE_POLL_MS;
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
@@ -957,6 +1011,9 @@ async function runDaemon(args, config) {
                 machineId: identity.machineId,
                 force: true,
             });
+            if (typeof bundle.pollIntervalMs === 'number' && Number.isFinite(bundle.pollIntervalMs)) {
+                bundlePollBaseMs = Math.min(Math.max(bundle.pollIntervalMs, 15_000), 60 * 60_000);
+            }
             if (bundle.suspended && !suspended) {
                 suspended = true;
                 log('Machine SUSPENDED by admin — hooks/gateway deny all actions; daemon pauses re-protection.');
@@ -1020,6 +1077,22 @@ async function runDaemon(args, config) {
                     log(`Honeypot: removal failed: ${error.message}`);
                 }
             }
+            // Keep the IDE hooks' Local Safety snapshot warm. Hooks on monitor
+            // machines read this cache with preferCached and never fetch — the
+            // daemon is the only process paying the network cost, off the hot path.
+            try {
+                const hookIdentity = (0, localSafetySnapshot_1.hookSnapshotIdentity)();
+                await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
+                    apiUrl: creds.apiUrl,
+                    shieldId: creds.shieldId,
+                    shieldKey: creds.shieldKey,
+                    developerName: hookIdentity.developerName,
+                    machineName: hookIdentity.machineName,
+                    expectedPolicyHash: bundle.policyHash || bundle.version,
+                    timeoutMs: 8_000,
+                });
+            }
+            catch { /* hooks fall back to their own bounded fetch */ }
         }
         catch { /* offline — cached stance applies */ }
     };
@@ -1115,6 +1188,20 @@ async function runDaemon(args, config) {
         if (desktopChatGuard)
             log('Claude Desktop chat guard: supervising (advisory — warns on secrets typed into Claude Desktop).');
     }
+    // Verdict IPC server (resident-agent pattern): per-event hook processes
+    // become thin clients that ask THIS process for the verdict over a named
+    // pipe / Unix socket — everything (config, bundle, snapshot, policy engine)
+    // is warm here, so verdicts resolve in milliseconds instead of repeating
+    // cold-start work per IDE event. Config is re-read per request (small YAML,
+    // cheap) so on-disk edits apply without a daemon restart. Hooks fall back
+    // to full local evaluation whenever this server is down — never a blocker.
+    let verdictServer;
+    try {
+        verdictServer = (0, verdictIpc_1.startVerdictServer)((hookArgs, stdin) => (0, hook_1.evaluateHookRequest)(hookArgs, stdin, (0, config_1.loadConfig)()), log);
+    }
+    catch (error) {
+        log(`Verdict IPC: failed to start (${error.message}) — hooks will evaluate locally.`);
+    }
     // Fresh machines have never uploaded an inventory (MSI/onboard defers the
     // initial discovery to keep setup fast), so the dashboard shows "Never" for
     // discovery + posture until the daily scheduled job fires — up to 24h later.
@@ -1178,16 +1265,51 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
     };
-    // Give the machine a couple of minutes to settle after boot/wake before the
-    // first check — same grace as the initial sweep.
-    const discoverCatchUpBootTimer = setTimeout(() => { void maybeCatchUpDiscovery('after start'); }, INITIAL_DISCOVER_DELAY_MS);
+    // Boot deep sweeps were the "my PC is slow every morning" complaint: a
+    // machine off overnight is always >20h stale, so the old 2-minute grace
+    // launched a full deep sweep right while the developer opened their IDE and
+    // browser. Defer the boot catch-up well past login (default 15 min) and add
+    // jitter so a fleet behind one proxy doesn't sweep in lockstep. The hourly
+    // re-check still guarantees same-day freshness.
+    const discoverCatchUpBootTimer = setTimeout(() => { void maybeCatchUpDiscovery('after start'); }, DISCOVER_BOOT_CATCHUP_DELAY_MS + Math.floor(Math.random() * DISCOVER_BOOT_CATCHUP_JITTER_MS));
     const discoverCatchUpTimer = setInterval(() => { void maybeCatchUpDiscovery('hourly check'); }, DISCOVER_CHECK_INTERVAL_MS);
     const rescanTimer = setInterval(() => {
         const count = refreshWatchTargets();
         log(`Rescan: watching ${count} config file(s).`);
     }, RESCAN_INTERVAL_MS);
-    const bundleTimer = setInterval(() => { void pollBundle(); }, BUNDLE_POLL_MS);
-    const heartbeatTimer = setInterval(() => { void heartbeat(); }, HEARTBEAT_INTERVAL_MS);
+    // Jittered self-rescheduling polls (±20%) instead of fixed setInterval:
+    // a fleet enrolled behind one corporate proxy must not hit the gate in
+    // lockstep, and one machine's timers must not stack into the same tick.
+    // The bundle poll additionally honors the server's pollIntervalMs, and the
+    // next tick is scheduled only AFTER the previous poll finishes — a slow
+    // gate can never pile up overlapping polls.
+    const jittered = (baseMs) => Math.max(5_000, Math.round(baseMs * (0.8 + Math.random() * 0.4)));
+    let bundleTimer;
+    const scheduleBundlePoll = () => {
+        if (stopped)
+            return;
+        bundleTimer = setTimeout(async () => {
+            try {
+                await pollBundle();
+            }
+            catch { /* poll never throws, but never stop the loop */ }
+            scheduleBundlePoll();
+        }, jittered(bundlePollBaseMs));
+    };
+    scheduleBundlePoll();
+    let heartbeatTimer;
+    const scheduleHeartbeat = () => {
+        if (stopped)
+            return;
+        heartbeatTimer = setTimeout(async () => {
+            try {
+                await heartbeat();
+            }
+            catch { /* keep the loop alive */ }
+            scheduleHeartbeat();
+        }, jittered(HEARTBEAT_INTERVAL_MS));
+    };
+    scheduleHeartbeat();
     // PowerShell transcript retention (Windows): the Transcription policy FCD
     // enables writes a file per session forever — prune anything older than the
     // retention window once a day (plus once shortly after boot, so laptops
@@ -1211,8 +1333,10 @@ async function runDaemon(args, config) {
         stopped = true;
         log(`Received ${signal} — shutting down.`);
         clearInterval(rescanTimer);
-        clearInterval(bundleTimer);
-        clearInterval(heartbeatTimer);
+        if (bundleTimer)
+            clearTimeout(bundleTimer);
+        if (heartbeatTimer)
+            clearTimeout(heartbeatTimer);
         clearTimeout(transcriptPruneBootTimer);
         clearInterval(transcriptPruneTimer);
         clearTimeout(discoverCatchUpBootTimer);
@@ -1223,6 +1347,8 @@ async function runDaemon(args, config) {
             clearTimeout(debounceTimer);
         if (desktopChatGuard)
             desktopChatGuard.stop();
+        if (verdictServer)
+            verdictServer.close();
         for (const watcher of watchers.values())
             watcher.close();
         for (const watcher of rootWatchers.values())
@@ -1437,36 +1563,6 @@ function windowsTaskReferencesScriptHost(taskName) {
         return false;
     }
 }
-/** True when an existing task still runs with an InteractiveToken principal —
- *  the 1.22.1 window-flash bug (console window on every trigger). Migration
- *  trigger for the windowless S4U principal. */
-function windowsTaskRunsInteractive(taskName) {
-    return windowsTaskXmlState(taskName).interactive;
-}
-/** True when triggering the task would open a VISIBLE console window:
- *  InteractiveToken principal AND a bare console action (not wrapped in
- *  `conhost --headless`). This — not the principal alone — is the flash
- *  condition; a conhost-wrapped InteractiveToken task is fully windowless. */
-function windowsTaskRunsVisibly(taskName) {
-    const state = windowsTaskXmlState(taskName);
-    return state.interactive && !state.headless;
-}
-function windowsTaskXmlState(taskName) {
-    try {
-        const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/XML'], {
-            encoding: 'utf8', windowsHide: true, timeout: 10_000,
-        });
-        if (query.status !== 0 || typeof query.stdout !== 'string')
-            return { interactive: false, headless: false };
-        return {
-            interactive: /<LogonType>\s*InteractiveToken\s*<\/LogonType>/i.test(query.stdout),
-            headless: /conhost(\.exe)?<\/Command>[\s\S]*?--headless/i.test(query.stdout),
-        };
-    }
-    catch {
-        return { interactive: false, headless: false };
-    }
-}
 /**
  * Upgrade an EXISTING (working) task to the windowless S4U principal. Tries
  * ONLY the S4U XML — on failure (unelevated daemon) the current task is left
@@ -1599,7 +1695,7 @@ function startDaemonNowWindows(viaTask = false) {
         }
     }
     catch { /* not running */ }
-    if (viaTask && !windowsTaskRunsVisibly(TASK_NAME)) {
+    if (viaTask && !(0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
         // Start through the scheduled task so the daemon runs with the task's
         // LIMITED (non-elevated) token. Launching directly from an elevated MSI
         // custom action would leave an elevated daemon that a normal-user CLI can
@@ -1709,12 +1805,12 @@ function ensureWindowsAutostartHealthy(logFn) {
         // registration always works and is just as windowless. The updater kick
         // stays as the final backstop for machines where even that failed.
         let migrationDenied = false;
-        if (daemonTask.status === 0 && !legacyDaemon && windowsTaskRunsVisibly(TASK_NAME)) {
+        if (daemonTask.status === 0 && !legacyDaemon && (0, windowsTaskState_1.windowsTaskRunsVisibly)(TASK_NAME)) {
             const daemonXml = buildDaemonTaskXml();
             migrationDenied = !(upgradeTaskWindowless(TASK_NAME, daemonXml[0], logFn)
                 || rewrapTaskHeadless(TASK_NAME, daemonXml[1], logFn)) || migrationDenied;
         }
-        if (watchdogQuery.status === 0 && !legacyWatchdog && windowsTaskRunsVisibly(WATCHDOG_TASK_NAME)) {
+        if (watchdogQuery.status === 0 && !legacyWatchdog && (0, windowsTaskState_1.windowsTaskRunsVisibly)(WATCHDOG_TASK_NAME)) {
             const watchdogXml = buildWatchdogTaskXml();
             migrationDenied = !(upgradeTaskWindowless(WATCHDOG_TASK_NAME, watchdogXml[0], logFn)
                 || rewrapTaskHeadless(WATCHDOG_TASK_NAME, watchdogXml[1], logFn)) || migrationDenied;
@@ -1815,6 +1911,7 @@ function installMacos() {
   </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
+  <key>ThrottleInterval</key><integer>30</integer>
   <key>StandardOutPath</key><string>${logFile()}</string>
   <key>StandardErrorPath</key><string>${logFile()}</string>
 </dict>
@@ -1873,7 +1970,11 @@ Description=FullCourtDefense resident daemon (config watch + heartbeat)
 [Service]
 ExecStart=${JSON.stringify(process.execPath)} ${JSON.stringify(cliEntry())} daemon
 Restart=always
-RestartSec=10
+RestartSec=30
+# Crash-loop circuit breaker: a daemon that dies 8 times in 10 minutes stops
+# being restarted (no infinite 10s spawn storm eating CPU on a broken install).
+StartLimitIntervalSec=600
+StartLimitBurst=8
 
 [Install]
 WantedBy=default.target

package/dist/commands/desktopChatGuard.js

@@ -100,10 +100,24 @@ const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop
 const STDOUT_PREFIX = 'FCD:';
 /** Prefix for clipboard payloads (distinct from composer reads). */
 const CLIP_PREFIX = 'FCDCLIP:';
-/** Poll cadence for the composer read (ms). 800ms lost the race against a
- *  fast paste+Enter (the composer clears before the next read); 250ms is still
- *  negligible CPU for one MSAA tree walk. */
+/** FALLBACK poll cadence while Claude Desktop is the FOREGROUND window (ms),
+ *  used only when the event subscriptions could not initialize. 800ms lost
+ *  the race against a fast paste+Enter (the composer clears before the next
+ *  read); 250ms is needed only while the user can actually type. */
 const POLL_MS = 250;
+/** Foreground safety-tick in EVENT mode (ms): clipboard/focus arrive as
+ *  events, so this timeout only paces the best-effort MSAA composer read —
+ *  the paste race is covered by WM_CLIPBOARDUPDATE, not by this cadence. */
+const POLL_FOCUSED_EVT_MS = 1000;
+/** FALLBACK poll cadence while Claude Desktop runs in the BACKGROUND (ms). No
+ *  typing or pasting can reach the composer without focus, so the expensive
+ *  MSAA tree walk is skipped — this loop only watches for focus returning.
+ *  (Event mode blocks on the focus-change event instead.) */
+const POLL_BG_MS = 1500;
+/** Safety timeout while idle/background (ms) — in event mode the loop BLOCKS
+ *  on the event signal for this long; in fallback mode it is the idle poll
+ *  cadence (one cheap Get-Process per tick, nothing else). */
+const POLL_IDLE_MS = 4000;
 /** Don't re-toast the same finding value more often than this. */
 const TOAST_DEBOUNCE_MS = 60_000;
 /** Refresh the cached Local Safety snapshot on this cadence. */
@@ -111,6 +125,11 @@ const SNAPSHOT_REFRESH_MS = 5 * 60_000;
 /** Watcher restart backoff bounds. */
 const RESTART_MIN_MS = 2_000;
 const RESTART_MAX_MS = 30_000;
+/** Give up after this many restarts with NO healthy output in between — a
+ *  watcher that can never start (powershell.exe blocked by EDR/GPO) must not
+ *  spawn-loop forever; each spawn costs CPU and an EDR scan. The daemon's
+ *  next full restart (or an admin repair_protection action) tries again. */
+const RESTART_GIVE_UP_AFTER = 10;
 /** Only meaningful where Claude Desktop runs and MSAA is available. */
 function desktopChatGuardSupported() {
     return process.platform === 'win32' && (0, discoverPaths_1.claudeDesktopLikelyInstalled)();
@@ -242,19 +261,114 @@ function desktopChatWatcherScript() {
         "'@",
         '} catch { }',
         '',
+        // Event subscriptions (WM_CLIPBOARDUPDATE + EVENT_SYSTEM_FOREGROUND): the
+        // loop below BLOCKS on these instead of spinning at 250ms. A hidden
+        // message-only window on a background STA thread receives clipboard-change
+        // messages and a WinEvent hook fires on every foreground-window change —
+        // both set flags and pulse one AutoResetEvent the main loop waits on.
+        // If any of this fails to initialize (hardened hosts, odd session types),
+        // [FcdEvents]::Ok stays false and the loop falls back to the old polling.
+        'try {',
+        "  Add-Type -TypeDefinition @'",
+        'using System;',
+        'using System.Runtime.InteropServices;',
+        'using System.Threading;',
+        'public static class FcdEvents {',
+        '  const uint WM_CLIPBOARDUPDATE = 0x031D;',
+        '  const uint EVENT_SYSTEM_FOREGROUND = 0x0003;',
+        '  static readonly IntPtr HWND_MESSAGE = new IntPtr(-3);',
+        '  public static bool Ok = false;',
+        '  static AutoResetEvent signal = new AutoResetEvent(false);',
+        '  static int clipFlag = 0, fgFlag = 0;',
+        '  delegate IntPtr WndProc(IntPtr h, uint m, IntPtr w, IntPtr l);',
+        '  delegate void WinEventProc(IntPtr hook, uint ev, IntPtr hwnd, int obj, int child, uint tid, uint time);',
+        '  static WndProc wndProcRef; static WinEventProc fgProcRef; // keep delegates alive (GC)',
+        '  [StructLayout(LayoutKind.Sequential)] struct MSG { public IntPtr hwnd; public uint message; public IntPtr wParam; public IntPtr lParam; public uint time; public int ptX; public int ptY; }',
+        '  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)] struct WNDCLASS { public uint style; public WndProc lpfnWndProc; public int cbClsExtra; public int cbWndExtra; public IntPtr hInstance; public IntPtr hIcon; public IntPtr hCursor; public IntPtr hbrBackground; [MarshalAs(UnmanagedType.LPWStr)] public string lpszMenuName; [MarshalAs(UnmanagedType.LPWStr)] public string lpszClassName; }',
+        '  [DllImport("user32.dll", CharSet=CharSet.Unicode)] static extern ushort RegisterClassW(ref WNDCLASS wc);',
+        '  [DllImport("user32.dll", CharSet=CharSet.Unicode)] static extern IntPtr CreateWindowExW(int ex, string cls, string name, int style, int x, int y, int w, int h, IntPtr parent, IntPtr menu, IntPtr inst, IntPtr param);',
+        '  [DllImport("user32.dll")] static extern IntPtr DefWindowProcW(IntPtr h, uint m, IntPtr w, IntPtr l);',
+        '  [DllImport("user32.dll")] static extern bool AddClipboardFormatListener(IntPtr h);',
+        '  [DllImport("user32.dll")] static extern IntPtr SetWinEventHook(uint mn, uint mx, IntPtr mod, WinEventProc cb, uint pid, uint tid, uint flags);',
+        '  [DllImport("user32.dll")] static extern int GetMessageW(out MSG m, IntPtr h, uint mn, uint mx);',
+        '  [DllImport("user32.dll")] static extern bool TranslateMessage(ref MSG m);',
+        '  [DllImport("user32.dll")] static extern IntPtr DispatchMessageW(ref MSG m);',
+        '  [DllImport("kernel32.dll", CharSet=CharSet.Unicode)] static extern IntPtr GetModuleHandleW(string n);',
+        '  public static void Start() {',
+        '    var t = new Thread(Pump); t.IsBackground = true; t.SetApartmentState(ApartmentState.STA); t.Start();',
+        '  }',
+        '  static void Pump() {',
+        '    try {',
+        '      wndProcRef = HandleMsg;',
+        '      var wc = new WNDCLASS(); wc.lpfnWndProc = wndProcRef; wc.hInstance = GetModuleHandleW(null); wc.lpszClassName = "FcdDesktopGuardEvt";',
+        '      RegisterClassW(ref wc);',
+        '      IntPtr hwnd = CreateWindowExW(0, "FcdDesktopGuardEvt", "", 0, 0, 0, 0, 0, HWND_MESSAGE, IntPtr.Zero, wc.hInstance, IntPtr.Zero);',
+        '      if (hwnd == IntPtr.Zero) return;',
+        '      bool clipOk = AddClipboardFormatListener(hwnd);',
+        '      fgProcRef = HandleFg;',
+        '      IntPtr hook = SetWinEventHook(EVENT_SYSTEM_FOREGROUND, EVENT_SYSTEM_FOREGROUND, IntPtr.Zero, fgProcRef, 0, 0, 0);',
+        '      Ok = clipOk && hook != IntPtr.Zero;',
+        '      MSG m;',
+        '      while (GetMessageW(out m, IntPtr.Zero, 0, 0) > 0) { TranslateMessage(ref m); DispatchMessageW(ref m); }',
+        '    } catch { Ok = false; }',
+        '  }',
+        '  static IntPtr HandleMsg(IntPtr h, uint m, IntPtr w, IntPtr l) {',
+        '    if (m == WM_CLIPBOARDUPDATE) { Interlocked.Exchange(ref clipFlag, 1); signal.Set(); return IntPtr.Zero; }',
+        '    return DefWindowProcW(h, m, w, l);',
+        '  }',
+        '  static void HandleFg(IntPtr hook, uint ev, IntPtr hwnd, int obj, int child, uint tid, uint time) {',
+        '    Interlocked.Exchange(ref fgFlag, 1); signal.Set();',
+        '  }',
+        '  public static bool Wait(int ms) { try { return signal.WaitOne(ms); } catch { return false; } }',
+        '  public static bool TakeClip() { return Interlocked.Exchange(ref clipFlag, 0) == 1; }',
+        '  public static bool TakeFg() { return Interlocked.Exchange(ref fgFlag, 0) == 1; }',
+        '}',
+        "'@",
+        '} catch { }',
+        '',
+        '$evt = $false',
+        'try { [FcdEvents]::Start(); Start-Sleep -Milliseconds 300; $evt = [FcdEvents]::Ok } catch { $evt = $false }',
+        // Observability: doctor/tests can confirm which mode the watcher runs in.
+        'if ($env:FCD_DESKTOP_GUARD_DEBUG) { [Console]::Out.WriteLine("FCDEVT:" + $evt); [Console]::Out.Flush() }',
+        '',
         '$last = ""',
         '$lastClip = ""',
         '$lastWake = [DateTime]::MinValue',
+        '$lastComposer = [DateTime]::MinValue',
+        // EVENT-DRIVEN loop (when FcdEvents initialized): the loop BLOCKS on the
+        // clipboard/foreground event signal with a safety timeout — zero wakeups
+        // while nothing happens. Clipboard is read only when it actually changed
+        // (or focus just moved, covering copy-elsewhere-then-paste-into-Claude);
+        // the MSAA composer read relaxes to ~1s because the clipboard EVENT now
+        // wins the paste+Enter race the old 250ms poll existed for.
+        // FALLBACK (events unavailable): the original adaptive polling — 250ms
+        // focused / 1500ms background / 4000ms idle.
+        '$sleepMs = ' + POLL_IDLE_MS,
         'while ($true) {',
-        '  Start-Sleep -Milliseconds ' + POLL_MS,
+        '  $clipEvt = $true',
+        '  $fgEvt = $true',
+        '  if ($evt) {',
+        '    [void][FcdEvents]::Wait($sleepMs)',
+        '    $clipEvt = [FcdEvents]::TakeClip()',
+        '    $fgEvt = [FcdEvents]::TakeFg()',
+        '  } else {',
+        '    Start-Sleep -Milliseconds $sleepMs',
+        '  }',
         '  try {',
         '    $pids = New-Object \'System.Collections.Generic.HashSet[uint32]\'',
         "    Get-Process -Name 'Claude' -ErrorAction SilentlyContinue | ForEach-Object { [void]$pids.Add([uint32]$_.Id) }",
-        '    if ($pids.Count -eq 0) { continue }',
+        '    if ($pids.Count -eq 0) { $sleepMs = ' + POLL_IDLE_MS + '; continue }',
+        '    if (-not [FcdMsaa]::ClaudeIsForeground($pids)) {',
+        '      if ($evt) { $sleepMs = ' + POLL_IDLE_MS + ' } else { $sleepMs = ' + POLL_BG_MS + ' }',
+        '      continue',
+        '    }',
+        '    if ($evt) { $sleepMs = ' + POLL_FOCUSED_EVT_MS + ' } else { $sleepMs = ' + POLL_MS + ' }',
         // Clipboard paste guard: only while Claude Desktop is the foreground app, so
         // a copy staged for any OTHER application is never inspected or reported.
         // The deterministic engine (parent process) decides if the text is a secret.
-        '    if ([FcdMsaa]::ClaudeIsForeground($pids)) {',
+        // Event mode reads it only when the clipboard changed or focus just landed
+        // on Claude — not on every tick.
+        '    if ($clipEvt -or $fgEvt) {',
         '      $clip = ""',
         '      try { $clip = Get-Clipboard -Raw -ErrorAction SilentlyContinue } catch { }',
         '      if (-not [string]::IsNullOrEmpty($clip) -and $clip.Length -le 8000 -and $clip -ne $lastClip) {',
@@ -264,6 +378,10 @@ function desktopChatWatcherScript() {
         '        [Console]::Out.Flush()',
         '      }',
         '    }',
+        // Composer read throttle: event wakes can arrive in bursts (every copy on
+        // the machine); the MSAA tree walk stays on its own ~1s cadence.
+        '    if ($evt -and ([DateTime]::UtcNow - $lastComposer).TotalMilliseconds -lt 900) { continue }',
+        '    $lastComposer = [DateTime]::UtcNow',
         '    $main = [FcdMsaa]::FindMain($pids)',
         '    if ($main -eq [IntPtr]::Zero) { continue }',
         '    if (([DateTime]::UtcNow - $lastWake).TotalSeconds -ge 30) { [FcdMsaa]::Wake($main); $lastWake = [DateTime]::UtcNow }',
@@ -326,6 +444,7 @@ function startDesktopChatGuard(runtime) {
     let child;
     let restartTimer;
     let restartDelay = RESTART_MIN_MS;
+    let consecutiveRestarts = 0;
     let findings = 0;
     const lastToastAt = new Map();
     let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
@@ -424,6 +543,7 @@ function startDesktopChatGuard(runtime) {
             if (decoded === undefined)
                 return;
             restartDelay = RESTART_MIN_MS; // healthy output resets backoff
+            consecutiveRestarts = 0; // …and the give-up counter
             handleText(decoded.text, decoded.source);
         });
         child.on('exit', () => { rl.close(); if (!stopped)
@@ -436,6 +556,11 @@ function startDesktopChatGuard(runtime) {
     const scheduleRestart = () => {
         if (stopped || restartTimer)
             return;
+        consecutiveRestarts += 1;
+        if (consecutiveRestarts > RESTART_GIVE_UP_AFTER) {
+            runtime.log(`Claude Desktop chat guard: watcher failed ${RESTART_GIVE_UP_AFTER} consecutive starts — giving up until the daemon restarts (powershell.exe may be blocked by EDR/policy).`);
+            return;
+        }
         restartTimer = setTimeout(() => {
             restartTimer = undefined;
             spawnWatcher();

package/dist/commands/deterministicGuard.js

@@ -613,15 +613,27 @@ function credentialCommandReason(value) {
         return undefined;
     });
 }
+// Container-scoped execution context immediately before an `rm` hit: a
+// docker/podman/nerdctl/kubectl exec|run (incl. `compose exec/run`) earlier in
+// the SAME statement (no ; & | between). Inside that context a bare `rm -rf *`
+// wipes the CONTAINER's workdir — routine build/image cleanup on a
+// docker-heavy fleet — not the developer's machine, so it must never warn or
+// stall. Root targets (`/`, `/*`) stay blocked even inside containers (the
+// Patria case: an agent nuking a running container's filesystem).
+const CONTAINER_EXEC_BEFORE = /\b(?:docker|podman|nerdctl|kubectl)(?:\.exe)?\s+(?:compose\s+)?(?:exec|run)\b[^;&|]*$/i;
 function destructiveCommandReason(value) {
     return matchCommand(value, (text, lower) => {
-        // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`), and the target
-        // may be the root `/`, the root wildcard `/*`, or a bare `*`. Terminators
+        // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
         // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
-        // outer command — is caught too.
-        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
+        // outer command — is caught too. Path-aware: only the root `/`, the root
+        // wildcard `/*`, and a bare `*` are treated as destructive — scoped paths
+        // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
+        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
+        // Bare `*` deletes the current directory tree — destructive on the HOST,
+        // but inside a container exec/run it is the container workdir (cleanup).
+        const bareStar = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/.exec(lower);
+        if (bareStar && !CONTAINER_EXEC_BEFORE.test(lower.slice(0, bareStar.index)))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant