fullcourtdefense-cli 1.26.12 → 1.26.14

package/dist/commands/cmdGuard.d.ts

@@ -5,6 +5,12 @@ export interface CmdGuardStatus {
     rulesPresent: boolean;
     ruleCount?: number;
     mode?: string;
+    /**
+     * Whether the doskey macro file exists. Installed-but-missing means the bat
+     * fails open and NO command is intercepted, so this must be visible rather
+     * than hidden behind `installed: true`.
+     */
+    macrosPresent?: boolean;
 }
 export declare function isCmdGuardInstalled(): boolean;
 export declare function getCmdGuardStatus(): CmdGuardStatus;

package/dist/commands/cmdGuard.js

@@ -58,6 +58,7 @@ const shellGuard_1 = require("./shellGuard");
 const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
 const GUARD_JS_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
 const AUTORUN_BAT_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-autorun.bat');
+const MACRO_FILE_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-macros.txt');
 const CMD_AUTORUN_KEY = 'HKCU\\Software\\Microsoft\\Command Processor';
 const AUTORUN_VALUE = 'AutoRun';
 const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
@@ -151,10 +152,22 @@ function buildGuardJs(nodePath, cliEntry) {
         ``,
     ].join('\n');
 }
+/**
+ * The doskey macro definitions, as a file for `doskey /macrofile=`.
+ *
+ * Deliberately contains NOTHING but macro lines: every line in a macrofile is a
+ * definition, so a comment or build stamp here would register a junk macro (a
+ * `REM` macro would shadow REM for anything the user types). The build stamp
+ * lives in the bat, which is what the staleness check reads.
+ */
+function buildMacroFile(nodePath) {
+    const guardJs = batQuote(GUARD_JS_PATH);
+    const node = batQuote(nodePath);
+    return `${INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
+}
 function buildAutorunBat(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);
     const node = batQuote(nodePath);
-    const doskeyLines = INTERCEPTED_COMMANDS.map(cmd => `doskey ${cmd}=${node} ${guardJs} ${cmd} $*`);
     return [
         '@echo off',
         'REM FullCourtDefense cmd.exe guard (installed by fullcourtdefense-cli).',
@@ -168,7 +181,13 @@ function buildAutorunBat(nodePath) {
         // must keep working natively. Never break the customer's tools.
         `if not exist ${node} goto :eof`,
         `if not exist ${guardJs} goto :eof`,
-        ...doskeyLines,
+        `if not exist ${batQuote(MACRO_FILE_PATH)} goto :eof`,
+        // ONE doskey call, not one per command. AutoRun runs on every cmd.exe start,
+        // and each separate `doskey` statement costs ~8ms, so the previous
+        // one-line-per-command form added ~320ms to every cmd.exe launch — paid by
+        // build scripts, CI and agents on every single `cmd /c`. Loading the same
+        // macros from a file is ~18ms for the whole set.
+        `doskey /macrofile=${batQuote(MACRO_FILE_PATH)}`,
         '',
     ].join('\r\n');
 }
@@ -229,6 +248,7 @@ function getCmdGuardStatus() {
             rulesPresent,
             ruleCount,
             mode,
+            macrosPresent: fs.existsSync(MACRO_FILE_PATH),
         };
     }
     catch {
@@ -245,6 +265,10 @@ async function installCmdGuardCommand(_args = {}) {
     const nodePath = process.execPath;
     const cliEntry = process.argv[1] || '';
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 'utf8');
+    // Macro file BEFORE the bat: the bat refuses to register macros without it,
+    // so this order can never leave a window where cmd.exe sources a bat whose
+    // macrofile does not exist yet.
+    (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
     fs.writeFileSync(AUTORUN_BAT_PATH, buildAutorunBat(nodePath), 'utf8');
     console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
     const current = readCurrentAutorun();
@@ -280,6 +304,10 @@ async function uninstallCmdGuardCommand() {
         fs.unlinkSync(AUTORUN_BAT_PATH);
     }
     catch { /* not present */ }
+    try {
+        fs.unlinkSync(MACRO_FILE_PATH);
+    }
+    catch { /* not present */ }
     console.log('cmd.exe guard uninstalled. Open cmd windows keep doskey until closed.');
 }
 /** Refresh shared rules JSON when cmd guard is installed. */
@@ -290,21 +318,34 @@ function refreshCmdGuardRules() {
         (0, shellGuard_1.writeShellGuardRules)();
         // Self-heal after CLI updates: the planted checker/autorun carry the
         // detection logic of the build that wrote them — rewrite when stale.
-        if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH)) {
+        //
+        // A MISSING macro file is also healed here, and matters more than staleness:
+        // the bat fails open without it, so the guard would look installed while
+        // registering no macros at all. This is the only path that repairs that.
+        if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH) || !fs.existsSync(MACRO_FILE_PATH)) {
             const nodePath = process.execPath;
             (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, process.argv[1] || ''));
+            (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
             (0, shellGuard_1.writeGuardArtifact)(AUTORUN_BAT_PATH, buildAutorunBat(nodePath));
         }
     }
     catch { /* best-effort */ }
 }
 /**
- * The node.exe path baked into an installed autorun bat's doskey macros.
- * Format written by buildAutorunBat: `doskey <cmd>="<node>" "<guardJs>" <cmd> $*`.
+ * The node.exe path baked into an installed autorun bat.
+ *
+ * Reads the `if not exist "<node>" goto :eof` fail-open line, which is present
+ * in every build. The doskey fallback below covers bats written by builds that
+ * predate the macrofile change (`doskey <cmd>="<node>" "<guardJs>" <cmd> $*`):
+ * those machines are exactly the ones that still need repairing, so dropping
+ * the old shape would strand them.
  */
 function autorunBatNodePath(batContent) {
-    const match = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
-    return match ? match[1] : undefined;
+    const existsCheck = batContent.match(/^if not exist\s+"([^"]+node[^"]*)"\s+goto/im);
+    if (existsCheck)
+        return existsCheck[1];
+    const legacyDoskey = batContent.match(/^doskey\s+\S+="([^"]+)"\s/m);
+    return legacyDoskey ? legacyDoskey[1] : undefined;
 }
 /**
  * Self-heal a stale/broken cmd-guard AutoRun. Two failure shapes are covered:
@@ -358,6 +399,10 @@ function repairStaleCmdAutorun() {
             fs.unlinkSync(GUARD_JS_PATH);
         }
         catch { /* already gone */ }
+        try {
+            fs.unlinkSync(MACRO_FILE_PATH);
+        }
+        catch { /* already gone */ }
         return true;
     }
     catch {

package/dist/commands/daemon.js

@@ -109,16 +109,42 @@ const DEBOUNCE_MS = envMs('FCD_DAEMON_DEBOUNCE_MS', 2_000);
 const RESCAN_INTERVAL_MS = envMs('FCD_DAEMON_RESCAN_MS', 5 * 60_000);
 /** Heartbeat / spool flush cadence. */
 const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
+/**
+ * Floor between integrity-triggered repairs. The drift watcher reacts to config
+ * CHANGES; this path reacts to a failing verdict, which persists until fixed. If
+ * a repair cannot fix it (no write permission, a config owned by another
+ * install) an uncooled retry would re-run protect-all every heartbeat forever.
+ */
+const INTEGRITY_HEAL_COOLDOWN_MS = envMs('FCD_INTEGRITY_HEAL_COOLDOWN_MS', 60 * 60_000);
 /** Bundle (mode / suspension / policy version) poll cadence. */
 const BUNDLE_POLL_MS = envMs('FCD_DAEMON_BUNDLE_POLL_MS', 60_000);
+/**
+ * Fetch budget for the daemon's background bundle poll. Deliberately NOT the
+ * hot-path default (getRuntimeBundle's 1.5s), which exists so a hook never
+ * stalls a developer's command. Nothing waits on this poll — it runs on its own
+ * 60s timer inside a 45s deadline — so a slow-but-healthy control plane must be
+ * waited out, not reported as an outage. At 1.5s roughly 10% of polls aborted
+ * on ordinary p95 latency spikes and each one raised a `network_down` distress
+ * signal, while `doctor --health` (already passing 10s) stayed green against
+ * the same backend: alert noise with no failure behind it.
+ */
+const BUNDLE_FETCH_TIMEOUT_MS = envMs('FCD_DAEMON_BUNDLE_TIMEOUT_MS', 10_000);
 /**
  * Hard ceilings for one poll attempt (see startPollLoop). Generous multiples of
- * the work each poll actually does — a bundle poll is a 1.5s fetch plus an 8s
+ * the work each poll actually does — a bundle poll is a 10s fetch plus an 8s
  * snapshot refresh, a heartbeat is a spool flush plus a log upload — so these
  * only ever fire on a genuinely hung socket, never on a merely slow network.
  */
 const BUNDLE_POLL_DEADLINE_MS = envMs('FCD_DAEMON_BUNDLE_DEADLINE_MS', 45_000);
 const HEARTBEAT_DEADLINE_MS = envMs('FCD_DAEMON_HEARTBEAT_DEADLINE_MS', 120_000);
+/**
+ * Wake-from-sleep detection. Timers are the only awake clock we have: a beat
+ * that observes far more wall time than its own interval proves the machine
+ * was suspended in between. The jump bound is a generous multiple of the beat
+ * so ordinary event-loop lag or a busy CPU can never look like a resume.
+ */
+const RESUME_BEAT_MS = envMs('FCD_DAEMON_RESUME_BEAT_MS', 30_000);
+const RESUME_JUMP_MS = envMs('FCD_DAEMON_RESUME_JUMP_MS', 120_000);
 /** Delay before the one-time initial discovery sweep on a fresh machine. */
 const INITIAL_DISCOVER_DELAY_MS = envMs('FCD_DAEMON_INITIAL_DISCOVER_MS', 2 * 60_000);
 /** A discovery upload older than this is stale — the daemon catches up itself. */
@@ -505,6 +531,7 @@ async function runDaemon(args, config) {
     let quietUntil = 0; // ignore events until this time (self-writes)
     let debounceTimer = null;
     let reprotecting = false;
+    let lastIntegrityHealAt = 0; // cooldown anchor for integrity-triggered repairs
     let suspended = false;
     let stopped = false;
     const executingActionIds = new Set();
@@ -582,16 +609,23 @@ async function runDaemon(args, config) {
         }
         catch { /* next tick */ }
     };
-    const reprotect = async (reasonPaths) => {
+    /**
+     * One repair path, two triggers: a watched config CHANGED (drift), or the
+     * integrity check reported a reason protect-all can fix (integrity). Keeping
+     * them on the same function preserves the reprotecting/quiet-window guards —
+     * a second copy would race this one and re-enter protect-all concurrently.
+     */
+    const reprotect = async (reasonPaths, cause = 'drift') => {
+        const headline = cause === 'integrity' ? 'Integrity self-heal' : 'Config drift detected';
         if (reprotecting || stopped)
             return;
         if (suspended) {
-            log(`Config drift detected (${reasonPaths.join(', ')}) but machine is suspended — not re-protecting.`);
+            log(`${headline} (${reasonPaths.join(', ')}) but machine is suspended — not re-protecting.`);
             return;
         }
         reprotecting = true;
         quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
-        log(`Config drift detected: ${reasonPaths.join(', ')} — re-running protect-all.`);
+        log(`${headline}: ${reasonPaths.join(', ')} — re-running protect-all.`);
         try {
             const repaired = await (0, protectionRepair_1.repairProtection)({ ...args, dryRun: undefined }, config);
             quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
@@ -601,7 +635,9 @@ async function runDaemon(args, config) {
             if (!quiet) {
                 (0, notify_1.notifyOs)({
                     title: 'FullCourtDefense re-protected this machine',
-                    message: 'An MCP or hook config changed; the FullCourtDefense gateway was re-applied.',
+                    message: cause === 'integrity'
+                        ? 'Protection was reported incomplete; the FullCourtDefense gateway was re-applied.'
+                        : 'An MCP or hook config changed; the FullCourtDefense gateway was re-applied.',
                     url: (0, notify_1.consoleUrl)('/agent-security/users?view=desktop'),
                 });
             }
@@ -990,6 +1026,7 @@ async function runDaemon(args, config) {
                     machineId: identity.machineId,
                     force: true,
                     ttlMs: 0,
+                    timeoutMs: BUNDLE_FETCH_TIMEOUT_MS,
                 });
                 log(bundle.policyHash
                     ? `Policy refresh: bundle applied (hash ${bundle.policyHash.slice(0, 12)}…, ${bundle.policyCount ?? 0} policies).`
@@ -1155,6 +1192,7 @@ async function runDaemon(args, config) {
                 machineName: identity.hostname,
                 machineId: identity.machineId,
                 force: true,
+                timeoutMs: BUNDLE_FETCH_TIMEOUT_MS,
             });
             if (typeof bundle.pollIntervalMs === 'number' && Number.isFinite(bundle.pollIntervalMs)) {
                 bundlePollBaseMs = Math.min(Math.max(bundle.pollIntervalMs, 15_000), 60 * 60_000);
@@ -1261,7 +1299,24 @@ async function runDaemon(args, config) {
         if (!creds.shieldId)
             return;
         try {
-            const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+            let integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+            // A failing verdict used to be REPORTED and nothing more, so a machine
+            // could sit "Damaged" in the console indefinitely on a reason the daemon
+            // already knows how to fix — the drift watcher only fires when a config
+            // file changes, and a stale gateway path changes nothing. Heal first, then
+            // report what is true AFTER the repair rather than the verdict that
+            // triggered it.
+            if (!integrity.ok
+                && !suspended
+                && Date.now() - lastIntegrityHealAt >= INTEGRITY_HEAL_COOLDOWN_MS
+                && (0, integrity_1.hasHealableIntegrityReason)(integrity.reasons)) {
+                lastIntegrityHealAt = Date.now();
+                await reprotect(integrity.reasons, 'integrity');
+                integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+                log(integrity.ok
+                    ? 'Integrity self-heal: protection restored.'
+                    : `Integrity self-heal: still failing (${integrity.reasons.join(', ')}) — reported for support.`);
+            }
             // Report a previous daemon's unclean death exactly once.
             const crash = (0, daemonForensics_1.readPostmortem)();
             const unreportedCrash = crash && !crash.reportedAt ? crash : undefined;
@@ -1471,6 +1526,27 @@ async function runDaemon(args, config) {
         },
         onError: error => log(`Heartbeat error: ${error instanceof Error ? error.message : String(error)}`),
     });
+    // ── Wake-from-sleep recovery ──────────────────────────────────────────────
+    // Nothing in the agent reacts to a resume, so after a laptop wakes the
+    // machine kept reporting "daemon down" until the next SCHEDULED heartbeat —
+    // a full cadence later. Worse, the liveness marker stayed stale for that
+    // whole window, which is what the watchdog reads before deciding the daemon
+    // is wedged. Refreshing the marker the moment we notice the wall-clock jump
+    // closes the reporting gap and removes the evidence of a hang that never
+    // happened. Both calls go through runWithDeadline, so a resume that lands on
+    // sockets which died during sleep cannot leak an unhandled rejection.
+    let lastResumeBeatMs = Date.now();
+    const resumeTimer = setInterval(() => {
+        const now = Date.now();
+        const drift = now - lastResumeBeatMs;
+        lastResumeBeatMs = now;
+        if (drift < RESUME_JUMP_MS)
+            return;
+        log(`Resume detected: ${Math.round(drift / 1000)}s of wall time elapsed while suspended — refreshing liveness and reporting in now.`);
+        (0, daemonForensics_1.touchDaemonAlive)();
+        void (0, pollLoop_1.runWithDeadline)({ run: heartbeat, deadlineMs: HEARTBEAT_DEADLINE_MS });
+        void (0, pollLoop_1.runWithDeadline)({ run: pollBundle, deadlineMs: BUNDLE_POLL_DEADLINE_MS });
+    }, RESUME_BEAT_MS);
     // PowerShell transcript retention (Windows): the Transcription policy FCD
     // enables writes a file per session forever — prune anything older than the
     // retention window once a day (plus once shortly after boot, so laptops
@@ -1496,6 +1572,7 @@ async function runDaemon(args, config) {
         clearInterval(rescanTimer);
         bundleLoop.stop();
         heartbeatLoop.stop();
+        clearInterval(resumeTimer);
         clearTimeout(transcriptPruneBootTimer);
         clearInterval(transcriptPruneTimer);
         clearTimeout(discoverCatchUpBootTimer);

package/dist/commands/doctor.js

@@ -111,7 +111,10 @@ async function perfCheck(apiUrl, config) {
     console.log(`node spawn floor:      ${hp.nodeSpawnFloorMs}ms median — OS+AV cost of any per-event process`);
     console.log(`hook end-to-end:       ${hp.hookMedianMs}ms median, ${hp.hookMinMs}-${hp.hookMaxMs}ms range — per IDE event (shell/MCP/file)`);
     if (hp.cmdGuardOverheadMs !== undefined) {
-        console.log(`cmd guard overhead:    +${hp.cmdGuardOverheadMs}ms median — per intercepted cmd.exe command`);
+        console.log(`cmd guard overhead:    +${hp.cmdGuardOverheadMs}ms median — per cmd.exe START (once per terminal window; every time for "cmd /c" callers such as build scripts and CI)`);
+    }
+    if (hp.cmdGuardCheckerMs !== undefined) {
+        console.log(`cmd guard checker:     +${hp.cmdGuardCheckerMs}ms median — additional, only when the typed command is one we intercept`);
     }
     if (snapshot.processes.length > 0) {
         console.log(`resident processes:    ${snapshot.processes.length} FullCourtDefense process(es), ${snapshot.totalWorkingSetMB}MB working set total`);

package/dist/commands/verifyRemoved.js

@@ -177,6 +177,7 @@ function collectWindowsChecks() {
         '.fullcourtdefense-shell-guard.ps1',
         '.fullcourtdefense-cmd-guard.js',
         '.fullcourtdefense-cmd-autorun.bat',
+        '.fullcourtdefense-cmd-macros.txt',
     ];
     for (const name of profileFiles) {
         const file = path.join(home, name);

package/dist/commands/watchdog.js

@@ -66,6 +66,16 @@ async function watchdogCommand(args, config) {
     const state = (0, daemon_1.daemonRuntimeState)();
     let relaunched = false;
     let postmortem = (0, daemonForensics_1.readPostmortem)();
+    // Our own tick cadence is the only awake clock available (see
+    // detectMachineSuspension): a gap far larger than the interval proves the
+    // MACHINE was suspended, which fully explains a stale daemon marker. Read
+    // the previous tick BEFORE recording this one, and record unconditionally so
+    // an early return below still leaves the next tick a baseline.
+    const machineSuspended = (0, daemonForensics_1.detectMachineSuspension)({
+        previousTickAt: (0, daemonForensics_1.readWatchdogTick)()?.lastTickAt,
+        nowMs: Date.now(),
+    });
+    (0, daemonForensics_1.recordWatchdogTick)();
     // Beyond "the pid exists": a wedged daemon or a recycled pid both pass a
     // plain pid check while the machine has no working control plane. Classify
     // with the alive-marker freshness + a verdict-pipe probe.
@@ -77,6 +87,7 @@ async function watchdogCommand(args, config) {
             marker: (0, daemonForensics_1.readAliveMarker)(),
             staleAfterMs: (0, daemonForensics_1.daemonHungAfterMs)(),
             pipeProbe: await (0, verdictIpcClient_1.probeVerdictServer)(1_500),
+            machineSuspended,
         });
     }
     if (health === 'hung' && state.pid && process.env.FCD_WATCHDOG_NO_RELAUNCH !== '1') {
@@ -85,6 +96,9 @@ async function watchdogCommand(args, config) {
         // clean. The distress ledger survives; the fresh daemon's first heartbeat
         // ships the story to the fleet.
         (0, distress_1.reportDistress)('watchdog', distress_1.DISTRESS.DAEMON_HUNG, `daemon pid ${state.pid} unresponsive (alive-marker stale + verdict pipe silent) — recycled by watchdog`);
+        // Claim the kill first: otherwise the next daemon boots, finds a marker
+        // with no clean-exit stamp, and reports EDR/AV killed it.
+        (0, daemonForensics_1.recordWatchdogRecycle)(state.pid);
         (0, daemon_1.forceStopPid)(state.pid);
     }
     // NOTE for 'pid_reused': the pid belongs to an UNRELATED process — never

package/dist/daemonForensics.d.ts

@@ -98,7 +98,81 @@ export declare function classifyDaemonHealth(input: {
     marker: DaemonAliveMarker | undefined;
     staleAfterMs: number;
     pipeProbe: 'responsive' | 'unresponsive' | 'no-endpoint' | 'not-probed';
+    /**
+     * True when the machine itself stopped running since the previous check
+     * (sleep/hibernate). Marker staleness is then not evidence of anything —
+     * see detectMachineSuspension.
+     */
+    machineSuspended?: boolean;
     nowMs?: number;
 }): DaemonHealthClass;
+/**
+ * WHY THIS EXISTS (a real developer-machine incident, 2026-08)
+ * Staleness above is a WALL-CLOCK measurement, but the daemon can only refresh
+ * its marker while the CPU is actually running. A laptop that sleeps longer
+ * than `staleAfterMs` therefore produces a stale marker through no fault of
+ * the daemon — and the watchdog read that as "wedged" and killed a perfectly
+ * healthy process on every lid-open. One developer machine was recycled 8
+ * times in 7 days, each kill also writing a post-mortem blaming EDR/AV for
+ * what was in fact our own watchdog.
+ *
+ * There is no portable awake clock to compare against. On Windows
+ * `os.uptime()` still INCLUDES sleep (measured on the incident machine: 26.66h
+ * of "uptime" spanning a 13h sleep), and reading the kernel power log would
+ * mean spawning PowerShell every 5 minutes — precisely the pattern that gets
+ * this agent killed by EDR, which the watchdog is documented to avoid.
+ *
+ * What we do have is our OWN cadence. A fixed-interval scheduled task that
+ * observes far more wall time between two of its own ticks than its interval
+ * allows has proven the machine was not running in between. That gap explains
+ * the daemon's stale marker, so staleness stops counting as evidence.
+ */
+/** The watchdog scheduled task's interval — its ticks are the awake clock. */
+export declare const WATCHDOG_CADENCE_MS: number;
+/** Gaps beyond cadence x this factor cannot be explained by jitter or a slow tick. */
+export declare const SUSPEND_GAP_FACTOR = 3;
+/** The watchdog's own proof that IT was running, persisted between ticks. */
+export interface WatchdogTick {
+    lastTickAt: string;
+}
+export declare function watchdogTickFile(): string;
+export declare function readWatchdogTick(): WatchdogTick | undefined;
+export declare function recordWatchdogTick(now?: Date): void;
+/**
+ * Pure: did the machine stop running between the previous watchdog tick and
+ * this one?
+ *
+ * A MISSING baseline answers FALSE (i.e. "not suspended", the pre-existing
+ * behavior) rather than granting grace. That looks backwards next to "never
+ * kill on a guess", but it is the safer failure mode overall: the grace
+ * depends on a tick file, and if that file can never be persisted (locked
+ * directory, full disk, AV quarantine) then every tick would see no baseline,
+ * grant grace forever, and silently disable the watchdog's ability to recycle
+ * a genuinely wedged daemon. Answering false means a persistence failure
+ * degrades to the known old behavior instead of to no protection at all, and
+ * costs at most one stale verdict on the very first tick after upgrade.
+ *
+ * A baseline that EXISTS but cannot be trusted (unparseable, or the clock
+ * moved backwards under us) still answers TRUE: there we have positive
+ * evidence that time is not measurable, which is exactly when a staleness
+ * comparison must not be believed.
+ */
+export declare function detectMachineSuspension(input: {
+    previousTickAt?: string;
+    nowMs: number;
+    cadenceMs?: number;
+    factor?: number;
+}): boolean;
+/**
+ * Stamp the marker before the watchdog force-stops a wedged daemon, so the
+ * NEXT boot's `detectUncleanDeath` does not report our own recycle as an
+ * external kill. The reason is distinct from a real shutdown's signal name,
+ * and the recycle stays visible via the `daemon_hung` distress entry and the
+ * beacon's `daemonHealth` field — this only suppresses the false EDR/AV story.
+ *
+ * Keyed on the DAEMON's pid (not `process.pid`): the watchdog is a different
+ * process, which is exactly why `recordCleanExit` cannot be reused here.
+ */
+export declare function recordWatchdogRecycle(daemonPid: number): void;
 /** Stamp the post-mortem as delivered so heartbeats stop re-sending it. */
 export declare function markPostmortemReported(): void;

package/dist/daemonForensics.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUSPEND_GAP_FACTOR = exports.WATCHDOG_CADENCE_MS = void 0;
 exports.aliveMarkerFile = aliveMarkerFile;
 exports.postmortemFile = postmortemFile;
 exports.readAliveMarker = readAliveMarker;
@@ -45,6 +46,11 @@ exports.touchDaemonAlive = touchDaemonAlive;
 exports.recordCleanExit = recordCleanExit;
 exports.daemonHungAfterMs = daemonHungAfterMs;
 exports.classifyDaemonHealth = classifyDaemonHealth;
+exports.watchdogTickFile = watchdogTickFile;
+exports.readWatchdogTick = readWatchdogTick;
+exports.recordWatchdogTick = recordWatchdogTick;
+exports.detectMachineSuspension = detectMachineSuspension;
+exports.recordWatchdogRecycle = recordWatchdogRecycle;
 exports.markPostmortemReported = markPostmortemReported;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -199,12 +205,109 @@ function classifyDaemonHealth(input) {
         return 'healthy';
     if (input.pipeProbe === 'responsive')
         return 'healthy';
+    // The marker is stale, but the daemon had no CPU with which to refresh it.
+    // Judging it now would convict a healthy daemon of the machine's sleep, so
+    // defer: the next tick runs after a full awake interval and decides fairly.
+    if (input.machineSuspended)
+        return 'indeterminate';
     if (input.pipeProbe === 'unresponsive')
         return 'hung';
     if (input.pipeProbe === 'no-endpoint')
         return 'pid_reused';
     return 'indeterminate';
 }
+// ---------------------------------------------------------------------------
+// Suspend awareness
+// ---------------------------------------------------------------------------
+/**
+ * WHY THIS EXISTS (a real developer-machine incident, 2026-08)
+ * Staleness above is a WALL-CLOCK measurement, but the daemon can only refresh
+ * its marker while the CPU is actually running. A laptop that sleeps longer
+ * than `staleAfterMs` therefore produces a stale marker through no fault of
+ * the daemon — and the watchdog read that as "wedged" and killed a perfectly
+ * healthy process on every lid-open. One developer machine was recycled 8
+ * times in 7 days, each kill also writing a post-mortem blaming EDR/AV for
+ * what was in fact our own watchdog.
+ *
+ * There is no portable awake clock to compare against. On Windows
+ * `os.uptime()` still INCLUDES sleep (measured on the incident machine: 26.66h
+ * of "uptime" spanning a 13h sleep), and reading the kernel power log would
+ * mean spawning PowerShell every 5 minutes — precisely the pattern that gets
+ * this agent killed by EDR, which the watchdog is documented to avoid.
+ *
+ * What we do have is our OWN cadence. A fixed-interval scheduled task that
+ * observes far more wall time between two of its own ticks than its interval
+ * allows has proven the machine was not running in between. That gap explains
+ * the daemon's stale marker, so staleness stops counting as evidence.
+ */
+/** The watchdog scheduled task's interval — its ticks are the awake clock. */
+exports.WATCHDOG_CADENCE_MS = 5 * 60_000;
+/** Gaps beyond cadence x this factor cannot be explained by jitter or a slow tick. */
+exports.SUSPEND_GAP_FACTOR = 3;
+function watchdogTickFile() {
+    return path.join(stateDir(), 'watchdog.tick.json');
+}
+function readWatchdogTick() {
+    try {
+        const tick = JSON.parse(fs.readFileSync(watchdogTickFile(), 'utf8'));
+        return tick && typeof tick.lastTickAt === 'string' ? tick : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function recordWatchdogTick(now = new Date()) {
+    writeJson(watchdogTickFile(), { lastTickAt: now.toISOString() });
+}
+/**
+ * Pure: did the machine stop running between the previous watchdog tick and
+ * this one?
+ *
+ * A MISSING baseline answers FALSE (i.e. "not suspended", the pre-existing
+ * behavior) rather than granting grace. That looks backwards next to "never
+ * kill on a guess", but it is the safer failure mode overall: the grace
+ * depends on a tick file, and if that file can never be persisted (locked
+ * directory, full disk, AV quarantine) then every tick would see no baseline,
+ * grant grace forever, and silently disable the watchdog's ability to recycle
+ * a genuinely wedged daemon. Answering false means a persistence failure
+ * degrades to the known old behavior instead of to no protection at all, and
+ * costs at most one stale verdict on the very first tick after upgrade.
+ *
+ * A baseline that EXISTS but cannot be trusted (unparseable, or the clock
+ * moved backwards under us) still answers TRUE: there we have positive
+ * evidence that time is not measurable, which is exactly when a staleness
+ * comparison must not be believed.
+ */
+function detectMachineSuspension(input) {
+    const cadence = input.cadenceMs && input.cadenceMs > 0 ? input.cadenceMs : exports.WATCHDOG_CADENCE_MS;
+    const factor = input.factor && input.factor > 0 ? input.factor : exports.SUSPEND_GAP_FACTOR;
+    if (!input.previousTickAt)
+        return false;
+    const previous = Date.parse(input.previousTickAt);
+    if (!Number.isFinite(previous))
+        return true;
+    const gap = input.nowMs - previous;
+    if (gap < 0)
+        return true;
+    return gap > cadence * factor;
+}
+/**
+ * Stamp the marker before the watchdog force-stops a wedged daemon, so the
+ * NEXT boot's `detectUncleanDeath` does not report our own recycle as an
+ * external kill. The reason is distinct from a real shutdown's signal name,
+ * and the recycle stays visible via the `daemon_hung` distress entry and the
+ * beacon's `daemonHealth` field — this only suppresses the false EDR/AV story.
+ *
+ * Keyed on the DAEMON's pid (not `process.pid`): the watchdog is a different
+ * process, which is exactly why `recordCleanExit` cannot be reused here.
+ */
+function recordWatchdogRecycle(daemonPid) {
+    const marker = readAliveMarker();
+    if (!marker || marker.pid !== daemonPid)
+        return;
+    marker.cleanExit = { at: new Date().toISOString(), reason: 'watchdog-recycle' };
+    writeJson(aliveMarkerFile(), marker);
+}
 /** Stamp the post-mortem as delivered so heartbeats stop re-sending it. */
 function markPostmortemReported() {
     const pm = readPostmortem();

package/dist/integrity.d.ts

@@ -1,4 +1,6 @@
 export type IntegrityReason = 'mcp_gateway_missing' | 'mcp_gateway_stale_path' | 'cursor_hook_missing' | 'cursor_hook_stale_path' | 'cursor_hook_changed' | 'claude_hook_missing' | 'claude_hook_stale_path' | 'claude_hook_changed' | 'daemon_not_running' | 'runtime_bundle_stale';
+/** Pure: does this verdict contain anything a protect-all pass could fix? */
+export declare function hasHealableIntegrityReason(reasons: readonly string[]): boolean;
 export interface LocalIntegrityReport {
     ok: boolean;
     reasons: IntegrityReason[];

package/dist/integrity.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasHealableIntegrityReason = hasHealableIntegrityReason;
 exports.isDaemonRunning = isDaemonRunning;
 exports.getLocalIntegrityReport = getLocalIntegrityReport;
 const fs = __importStar(require("fs"));
@@ -42,6 +43,27 @@ const installClaudeHook_1 = require("./commands/installClaudeHook");
 const installCursorHook_1 = require("./commands/installCursorHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
 const appDetection_1 = require("./appDetection");
+/**
+ * The reasons `protect-all` can actually repair. Detecting a failure is only
+ * half the job: the daemon heals these instead of reporting them forever, which
+ * is why the taxonomy lives beside the reason type rather than in the caller.
+ *
+ * Excluded on purpose:
+ *  - `daemon_not_running` — the daemon is the thing evaluating this; re-wrapping
+ *    configs cannot start a process that is already running or already dead.
+ *  - `runtime_bundle_stale` — a control-plane reachability symptom. Re-wrapping
+ *    would churn every config on this machine and still not fetch the bundle,
+ *    hiding a network problem behind protection noise.
+ */
+const HEALABLE_REASONS = new Set([
+    'mcp_gateway_missing', 'mcp_gateway_stale_path',
+    'cursor_hook_missing', 'cursor_hook_stale_path', 'cursor_hook_changed',
+    'claude_hook_missing', 'claude_hook_stale_path', 'claude_hook_changed',
+]);
+/** Pure: does this verdict contain anything a protect-all pass could fix? */
+function hasHealableIntegrityReason(reasons) {
+    return reasons.some(reason => HEALABLE_REASONS.has(reason));
+}
 function readText(file) {
     try {
         return fs.readFileSync(file, 'utf8');

package/dist/perfSnapshot.d.ts

@@ -40,8 +40,19 @@ export interface PerfHotPathBench {
     hookMinMs: number;
     hookMaxMs: number;
     hookRuns: number;
-    /** cmd.exe doskey guard overhead vs a direct command (Windows, when installed). */
+    /**
+     * Cost the cmd guard adds to STARTING a cmd.exe session, measured as a
+     * guarded `cmd /c` against the same command with AutoRun suppressed (`/d`).
+     *
+     * This is what a developer actually pays: AutoRun runs on every cmd.exe
+     * launch and registers the doskey macros, whether or not the command being
+     * run is one of the intercepted ones. An interactive terminal pays it once
+     * when the window opens; anything invoking `cmd /c` per command (build
+     * scripts, CI, agents) pays it every time.
+     */
     cmdGuardOverheadMs?: number;
+    /** Extra cost when the typed command IS doskey-intercepted and goes through the checker. */
+    cmdGuardCheckerMs?: number;
 }
 export interface PerfDiskState {
     hookLogKB?: number;

package/dist/perfSnapshot.js

@@ -112,15 +112,35 @@ async function benchHotPath(entryJs) {
         hookTimes.push((await runTimed(process.execPath, [entry, 'hook', '--event', 'shell', '--fcd-managed', 'true'], { input: hookEvent, timeoutMs: 60_000 })).elapsedMs);
     }
     let cmdGuardOverheadMs;
+    let cmdGuardCheckerMs;
     const guardJs = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
     if (process.platform === 'win32' && fs.existsSync(guardJs)) {
-        const direct = [];
-        const guarded = [];
+        const comSpec = process.env.ComSpec || 'cmd.exe';
+        // What a real command pays: AutoRun fires (registering macros) vs `/d`,
+        // which suppresses it. Measuring `node guardJs echo` instead — as this
+        // did previously — reports only the checker's cost for an intercepted
+        // command and never observes the AutoRun work every cmd.exe start does,
+        // which understated the figure developers actually feel by ~5x.
+        const withAutoRun = [];
+        const withoutAutoRun = [];
         for (let i = 0; i < 4; i++) {
-            direct.push((await runTimed(process.env.ComSpec || 'cmd.exe', ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
-            guarded.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            // Alternate order so neither side systematically absorbs warm-up cost.
+            if (i % 2 === 0) {
+                withAutoRun.push((await runTimed(comSpec, ['/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+                withoutAutoRun.push((await runTimed(comSpec, ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            }
+            else {
+                withoutAutoRun.push((await runTimed(comSpec, ['/d', '/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+                withAutoRun.push((await runTimed(comSpec, ['/c', 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
+            }
+        }
+        cmdGuardOverheadMs = Math.max(0, median(withAutoRun) - median(withoutAutoRun));
+        // Kept as a separate number: the checker cost for an intercepted command.
+        const checker = [];
+        for (let i = 0; i < 4; i++) {
+            checker.push((await runTimed(process.execPath, [guardJs, 'echo', 'fcd-perf'], { timeoutMs: 30_000 })).elapsedMs);
         }
-        cmdGuardOverheadMs = Math.max(0, median(guarded) - median(direct));
+        cmdGuardCheckerMs = Math.max(0, median(checker) - median(withoutAutoRun));
     }
     return {
         nodeSpawnFloorMs: median(spawnTimes),
@@ -129,6 +149,7 @@ async function benchHotPath(entryJs) {
         hookMaxMs: Math.max(...hookTimes),
         hookRuns: hookTimes.length,
         cmdGuardOverheadMs,
+        cmdGuardCheckerMs,
     };
 }
 /**
@@ -246,7 +267,7 @@ async function collectPerfSnapshot(input = {}) {
 }
 /** One-line human summary for machine-action result reporting. */
 function summarizePerfSnapshot(s) {
-    const guard = s.hotPath.cmdGuardOverheadMs !== undefined ? `, cmd guard +${s.hotPath.cmdGuardOverheadMs}ms` : '';
+    const guard = s.hotPath.cmdGuardOverheadMs !== undefined ? `, cmd guard +${s.hotPath.cmdGuardOverheadMs}ms/cmd.exe start` : '';
     return `Hook ${s.hotPath.hookMedianMs}ms median (spawn floor ${s.hotPath.nodeSpawnFloorMs}ms${guard}); `
         + `${s.processes.length} FCD process(es) using ${s.totalWorkingSetMB}MB; `
         + `spool backlog ${s.disk.spoolBacklogCount ?? 0}, hook.log ${s.disk.hookLogKB ?? 0}KB${s.enforcement.mode ? `; mode ${s.enforcement.mode}` : ''}.`;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.26.12"
+  "version": "1.26.14"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.26.12",
+  "version": "1.26.14",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -30,6 +30,7 @@
     "test:audit-restore": "node scripts/test-audit-restore.js",
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
+    "test:cmd-guard-perf": "npm run build && node scripts/test-cmd-guard-perf.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
     "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",