fullcourtdefense-cli 1.26.12 → 1.26.13

package/dist/commands/cmdGuard.d.ts

@@ -5,6 +5,12 @@ export interface CmdGuardStatus {
     rulesPresent: boolean;
     ruleCount?: number;
     mode?: string;
+    /**
+     * Whether the doskey macro file exists. Installed-but-missing means the bat
+     * fails open and NO command is intercepted, so this must be visible rather
+     * than hidden behind `installed: true`.
+     */
+    macrosPresent?: boolean;
 }
 export declare function isCmdGuardInstalled(): boolean;
 export declare function getCmdGuardStatus(): CmdGuardStatus;

package/dist/commands/cmdGuard.js

@@ -58,6 +58,7 @@ const shellGuard_1 = require("./shellGuard");
 const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
 const GUARD_JS_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
 const AUTORUN_BAT_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-autorun.bat');
+const MACRO_FILE_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-macros.txt');
 const CMD_AUTORUN_KEY = 'HKCU\\Software\\Microsoft\\Command Processor';
 const AUTORUN_VALUE = 'AutoRun';
 const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
@@ -151,10 +152,22 @@ function buildGuardJs(nodePath, cliEntry) {
         ``,
     ].join('\n');
 }
+/**
+ * The doskey macro definitions, as a file for `doskey /macrofile=`.
+ *
+ * Deliberately contains NOTHING but macro lines: every line in a macrofile is a
+ * definition, so a comment or build stamp here would register a junk macro (a
+ * `REM` macro would shadow REM for anything the user types). The build stamp
+ * lives in the bat, which is what the staleness check reads.
+ */
+function buildMacroFile(nodePath) {
+    const guardJs = batQuote(GUARD_JS_PATH);
+    const node = batQuote(nodePath);
+    return `${INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
+}
 function buildAutorunBat(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);
     const node = batQuote(nodePath);
-    const doskeyLines = INTERCEPTED_COMMANDS.map(cmd => `doskey ${cmd}=${node} ${guardJs} ${cmd} $*`);
     return [
         '@echo off',
         'REM FullCourtDefense cmd.exe guard (installed by fullcourtdefense-cli).',
@@ -168,7 +181,13 @@ function buildAutorunBat(nodePath) {
         // must keep working natively. Never break the customer's tools.
         `if not exist ${node} goto :eof`,
         `if not exist ${guardJs} goto :eof`,
-        ...doskeyLines,
+        `if not exist ${batQuote(MACRO_FILE_PATH)} goto :eof`,
+        // ONE doskey call, not one per command. AutoRun runs on every cmd.exe start,
+        // and each separate `doskey` statement costs ~8ms, so the previous
+        // one-line-per-command form added ~320ms to every cmd.exe launch — paid by
+        // build scripts, CI and agents on every single `cmd /c`. Loading the same
+        // macros from a file is ~18ms for the whole set.
+        `doskey /macrofile=${batQuote(MACRO_FILE_PATH)}`,
         '',
     ].join('\r\n');
 }
@@ -229,6 +248,7 @@ function getCmdGuardStatus() {
             rulesPresent,
             ruleCount,
             mode,
+            macrosPresent: fs.existsSync(MACRO_FILE_PATH),
         };
     }
     catch {
@@ -245,6 +265,10 @@ async function installCmdGuardCommand(_args = {}) {
     const nodePath = process.execPath;
     const cliEntry = process.argv[1] || '';
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 'utf8');
+    // Macro file BEFORE the bat: the bat refuses to register macros without it,
+    // so this order can never leave a window where cmd.exe sources a bat whose
+    // macrofile does not exist yet.
+    (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
     fs.writeFileSync(AUTORUN_BAT_PATH, buildAutorunBat(nodePath), 'utf8');
     console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
     const current = readCurrentAutorun();
@@ -280,6 +304,10 @@ async function uninstallCmdGuardCommand() {
         fs.unlinkSync(AUTORUN_BAT_PATH);
     }
     catch { /* not present */ }
+    try {
+        fs.unlinkSync(MACRO_FILE_PATH);
+    }
+    catch { /* not present */ }
     console.log('cmd.exe guard uninstalled. Open cmd windows keep doskey until closed.');
 }
 /** Refresh shared rules JSON when cmd guard is installed. */
@@ -290,21 +318,34 @@ function refreshCmdGuardRules() {
         (0, shellGuard_1.writeShellGuardRules)();
         // Self-heal after CLI updates: the planted checker/autorun carry the
         // detection logic of the build that wrote them — rewrite when stale.
-        if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH)) {
+        //
+        // A MISSING macro file is also healed here, and matters more than staleness:
+        // the bat fails open without it, so the guard would look installed while
+        // registering no macros at all. This is the only path that repairs that.
+        if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH) || !fs.existsSync(MACRO_FILE_PATH)) {
             const nodePath = process.execPath;
             (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, process.argv[1] || ''));
+            (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
             (0, shellGuard_1.writeGuardArtifact)(AUTORUN_BAT_PATH, buildAutorunBat(nodePath));
         }
     }
     catch { /* best-effort */ }
 }
 /**
- * The node.exe path baked into an installed autorun bat's doskey macros.
- * Format written by buildAutorunBat: `doskey <cmd>="<node>" "<guardJs>" <cmd> $*`.
+ * The node.exe path baked into an installed autorun bat.
+ *
+ * Reads the `if not exist "<node>" goto :eof` fail-open line, which is present
+ * in every build. The doskey fallback below covers bats written by builds that
+ * predate the macrofile change (`doskey <cmd>="<node>" "<guardJs>" <cmd> $*`):
+ * those machines are exactly the ones that still need repairing, so dropping
+ * the old shape would strand them.
  */
 function autorunBatNodePath(batContent) {
-    const match = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
-    return match ? match[1] : undefined;
+    const existsCheck = batContent.match(/^if not exist\s+"([^"]+node[^"]*)"\s+goto/im);
+    if (existsCheck)
+        return existsCheck[1];
+    const legacyDoskey = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
+    return legacyDoskey ? legacyDoskey[1] : undefined;
 }
 /**
  * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
@@ -358,6 +399,10 @@ function repairStaleCmdAutorun() {
             fs.unlinkSync(GUARD_JS_PATH);
         }
         catch { /* already gone */ }
+        try {
+            fs.unlinkSync(MACRO_FILE_PATH);
+        }
+        catch { /* already gone */ }
         return true;
     }
     catch {

package/dist/commands/doctor.js

@@ -111,7 +111,10 @@ async function perfCheck(apiUrl, config) {
     console.log(`node spawn floor:      ${hp.nodeSpawnFloorMs}ms median — OS+AV cost of any per-event process`);
     console.log(`hook end-to-end:       ${hp.hookMedianMs}ms median, ${hp.hookMinMs}-${hp.hookMaxMs}ms range — per IDE event (shell/MCP/file)`);
     if (hp.cmdGuardOverheadMs !== undefined) {
-        console.log(`cmd guard overhead:    +${hp.cmdGuardOverheadMs}ms median — per intercepted cmd.exe command`);
+        console.log(`cmd guard overhead:    +${hp.cmdGuardOverheadMs}ms median — per cmd.exe START (once per terminal window; every time for "cmd /c" callers such as build scripts and CI)`);
+    }
+    if (hp.cmdGuardCheckerMs !== undefined) {
+        console.log(`cmd guard checker:     +${hp.cmdGuardCheckerMs}ms median — additional, only when the typed command is one we intercept`);
     }
     if (snapshot.processes.length > 0) {
         console.log(`resident processes:    ${snapshot.processes.length} FullCourtDefense process(es), ${snapshot.totalWorkingSetMB}MB working set total`);

package/dist/commands/verifyRemoved.js

@@ -177,6 +177,7 @@ function collectWindowsChecks() {
         '.fullcourtdefense-shell-guard.ps1',
         '.fullcourtdefense-cmd-guard.js',
         '.fullcourtdefense-cmd-autorun.bat',
+        '.fullcourtdefense-cmd-macros.txt',
     ];
     for (const name of profileFiles) {
         const file = path.join(home, name);

package/dist/perfSnapshot.d.ts

@@ -40,8 +40,19 @@ export interface PerfHotPathBench {
     hookMinMs: number;
     hookMaxMs: number;
     hookRuns: number;
-    /** cmd.exe doskey guard overhead vs a direct command (Windows, when installed). */
+    /**
+     * Cost the cmd guard adds to STARTING a cmd.exe session, measured as a
+     * guarded `cmd /c` against the same command with AutoRun suppressed (`/d`).
+     *
+     * This is what a developer actually pays: AutoRun runs on every cmd.exe
+     * launch and registers the doskey macros, whether or not the command being
+     * run is one of the intercepted ones. An interactive terminal pays it once
+     * when the window opens; anything invoking `cmd /c` per command (build
+     * scripts, CI, agents) pays it every time.
+     */
     cmdGuardOverheadMs?: number;
+    /** Extra cost when the typed command IS doskey-intercepted and goes through the checker. */
+    cmdGuardCheckerMs?: number;
 }
 export interface PerfDiskState {
     hookLogKB?: number;

package/dist/perfSnapshot.js

@@ -112,15 +112,35 @@ async function benchHotPath(entryJs) {
         hookTimes.push((await runTimed(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], { input: hookEvent, timeoutMs: 60_000 })).elapsedMs);
     }
     let cmdGuardOverheadMs;
+    let cmdGuardCheckerMs;
     const guardJs = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
     if (process.platform === 'win32' && fs.existsSync(guardJs)) {
-        const direct = [];
-        const guarded = [];
+        const comSpec = process.env.ComSpec || 'cmd.exe';
+        // What a real command pays: AutoRun fires (registering macros) vs `/d`,
+        // which suppresses it. Measuring `node guardJs echo` instead — as this
+        // did previously — reports only the checker's cost for an intercepted
+        // command and never observes the AutoRun work every cmd.exe start does,
+        // which understated the figure developers actually feel by ~5x.
+        const withAutoRun = [];
+        const withoutAutoRun = [];
         for (let i = 0; i < 4; i++) {
-            direct.push((await runTimed(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
-            guarded.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            // Alternate order so neither side systematically absorbs warm-up cost.
+            if (i % 2 === 0) {
+                withAutoRun.push((await runTimed(comSpec, ['/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+                withoutAutoRun.push((await runTimed(comSpec, ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            }
+            else {
+                withoutAutoRun.push((await runTimed(comSpec, ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+                withAutoRun.push((await runTimed(comSpec, ['/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            }
+        }
+        cmdGuardOverheadMs = Math.max(0, median(withAutoRun) - median(withoutAutoRun));
+        // Kept as a separate number: the checker cost for an intercepted command.
+        const checker = [];
+        for (let i = 0; i < 4; i++) {
+            checker.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
         }
-        cmdGuardOverheadMs = Math.max(0, median(guarded) - median(direct));
+        cmdGuardCheckerMs = Math.max(0, median(checker) - median(withoutAutoRun));
     }
     return {
         nodeSpawnFloorMs: median(spawnTimes),
@@ -129,6 +149,7 @@ async function benchHotPath(entryJs) {
         hookMaxMs: Math.max(...hookTimes),
         hookRuns: hookTimes.length,
         cmdGuardOverheadMs,
+        cmdGuardCheckerMs,
     };
 }
 /**
@@ -246,7 +267,7 @@ async function collectPerfSnapshot(input = {}) {
 }
 /** One-line human summary for machine-action result reporting. */
 function summarizePerfSnapshot(s) {
-    const guard = s.hotPath.cmdGuardOverheadMs !== undefined ? `, cmd guard +${s.hotPath.cmdGuardOverheadMs}ms` : '';
+    const guard = s.hotPath.cmdGuardOverheadMs !== undefined ? `, cmd guard +${s.hotPath.cmdGuardOverheadMs}ms/cmd.exe start` : '';
     return `Hook ${s.hotPath.hookMedianMs}ms median (spawn floor ${s.hotPath.nodeSpawnFloorMs}ms${guard}); `
         + `${s.processes.length} FCD process(es) using ${s.totalWorkingSetMB}MB; `
         + `spool backlog ${s.disk.spoolBacklogCount ?? 0}, hook.log ${s.disk.hookLogKB ?? 0}KB${s.enforcement.mode ? `; mode ${s.enforcement.mode}` : ''}.`;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.12"
+  "version": "1.26.13"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.12",
+  "version": "1.26.13",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {