fullcourtdefense-cli 1.26.4 → 1.26.6

package/dist/commands/hook.js

@@ -36,9 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeClaudePayload = normalizeClaudePayload;
 exports.evaluateHookRequest = evaluateHookRequest;
 exports.hookCommand = hookCommand;
-const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
-const path = __importStar(require("path"));
 const config_1 = require("../config");
 const runtimeConfig_1 = require("../runtimeConfig");
 const telemetry_1 = require("../telemetry");
@@ -51,73 +49,9 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const verdictIpc_1 = require("../verdictIpc");
 const machineIdentity_1 = require("../machineIdentity");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
-const DEBUG_LOG = path.join(os.homedir(), '.fullcourtdefense-hook.log');
-/**
- * Verbose diagnostics (FCD_HOOK_DEBUG=1) additionally log content previews
- * (raw payload + prompt text snippets). Default logging keeps operational
- * metadata only — user prompt content must never sit in a plaintext file on
- * a customer laptop unless support explicitly opts in.
- */
-const HOOK_DEBUG_VERBOSE = process.env.FCD_HOOK_DEBUG === '1';
-/** Rotate the hook log when it grows past this size (same scheme as daemon.log). */
-const DEBUG_LOG_MAX_BYTES = 1_000_000;
-// Checked once per (short-lived) hook process: unbounded hook.log growth was
-// real customer disk churn — and every append to a huge file re-triggers AV
-// scanning. One stat per process is enough for a hook run; the resident
-// daemon (verdict IPC evaluation) re-checks every 500 writes so a long
-// uptime can't outgrow the cap either.
-let debugLogRotationChecked = false;
-let debugLogWritesSinceCheck = 0;
-/** Append a diagnostic line so we can see exactly what Cursor invoked + the verdict. */
-function dbg(obj) {
-    try {
-        debugLogWritesSinceCheck += 1;
-        if (!debugLogRotationChecked || debugLogWritesSinceCheck >= 500) {
-            debugLogRotationChecked = true;
-            debugLogWritesSinceCheck = 0;
-            try {
-                if (fs.existsSync(DEBUG_LOG) && fs.statSync(DEBUG_LOG).size > DEBUG_LOG_MAX_BYTES) {
-                    fs.renameSync(DEBUG_LOG, `${DEBUG_LOG}.1`);
-                }
-            }
-            catch { /* rotation is best-effort */ }
-        }
-        fs.appendFileSync(DEBUG_LOG, JSON.stringify({ t: new Date().toISOString(), ...obj }) + '\n');
-    }
-    catch { /* ignore */ }
-}
-function readStdin() {
-    return new Promise((resolve) => {
-        const stdin = process.stdin;
-        if (stdin.isTTY) {
-            resolve('');
-            return;
-        }
-        // Read raw BYTES (no setEncoding) and decode the whole payload as UTF-8 once.
-        // Per-chunk string decoding + concat corrupts multibyte chars (e.g. Hebrew),
-        // turning them into Latin-1 mojibake before they ever reach the backend.
-        const chunks = [];
-        let settled = false;
-        const finish = () => {
-            if (settled)
-                return;
-            settled = true;
-            let buf = Buffer.concat(chunks);
-            // Strip UTF-8 BOM at the byte level (Cursor on Windows prepends EF BB BF).
-            if (buf.length >= 3 && buf[0] === 0xEF && buf[1] === 0xBB && buf[2] === 0xBF) {
-                buf = buf.subarray(3);
-            }
-            resolve(buf.toString('utf8'));
-        };
-        stdin.on('data', (chunk) => {
-            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-        });
-        stdin.on('end', finish);
-        stdin.on('error', finish);
-        // Safety: if nothing arrives, don't hang forever.
-        setTimeout(finish, 2000).unref?.();
-    });
-}
+// Shared with the slim hook entry (hookSlim.ts) so both entries log to the
+// same rotated hook.log and read stdin identically.
+const hookIo_1 = require("../hookIo");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -427,7 +361,7 @@ function respondDegraded(ctx, detail, toolName, authRejected = false, opts = {})
         // Grace window: transient failure on a fail-closed machine — allow this
         // action, but record distress so the episode is visible in the console.
         (0, distress_1.reportDistress)('hook', authRejected ? distress_1.DISTRESS.AUTH_BROKEN : distress_1.DISTRESS.NETWORK_DOWN, `Policy gate failure ${health.consecutiveFailures}/3 (grace window, still allowing): ${detail}`);
-        dbg({ phase: 'policy_grace_allow', event: ctx.event, consecutiveFailures: health.consecutiveFailures, detail });
+        (0, hookIo_1.dbg)({ phase: 'policy_grace_allow', event: ctx.event, consecutiveFailures: health.consecutiveFailures, detail });
         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName, reason: `degraded (grace ${health.consecutiveFailures}/3): ${detail}`, offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(false);
         ctx.respond(false, undefined, degradedAllowMessage(ctx.event, detail));
@@ -469,7 +403,7 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     context.machineName = os.hostname();
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
-    dbg({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
+    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
     if (local.verdict === 'block' || local.verdict === 'require_approval') {
         const reason = local.reason || `${call.toolName}: local policy ${local.verdict}`;
         if (ctx.shadow) {
@@ -617,7 +551,7 @@ function spoolLocalFinding(input) {
  */
 function spoolLocalWarnings(warnings, toolName, operation) {
     for (const finding of warnings) {
-        dbg({ phase: 'local_deterministic_warn', tool: toolName, ruleId: finding.ruleId, itemId: finding.itemId });
+        (0, hookIo_1.dbg)({ phase: 'local_deterministic_warn', tool: toolName, ruleId: finding.ruleId, itemId: finding.itemId });
         spoolLocalFinding({ finding, toolName, operation, decision: 'warn' });
     }
 }
@@ -695,7 +629,7 @@ async function hookCommandOuter(args, config, startedAt) {
         let raw = '';
         let stdinErr = '';
         try {
-            raw = await readStdin();
+            raw = await (0, hookIo_1.readStdin)();
         }
         catch (e) {
             stdinErr = e instanceof Error ? e.message : String(e);
@@ -709,7 +643,7 @@ async function hookCommandOuter(args, config, startedAt) {
         if (process.env.FCD_VERDICT_IPC !== 'off') {
             const ipc = await (0, verdictIpc_1.requestDaemonVerdict)(args, raw, undefined, startedAt);
             if (ipc.outcome === 'verdict') {
-                dbg({ phase: 'ipc_verdict', event: args.event, exitCode: ipc.exitCode });
+                (0, hookIo_1.dbg)({ phase: 'ipc_verdict', event: args.event, exitCode: ipc.exitCode });
                 if (ipc.stderr) {
                     try {
                         process.stderr.write(ipc.stderr);
@@ -726,7 +660,7 @@ async function hookCommandOuter(args, config, startedAt) {
             }
             // Daemon down / busy / refused — evaluate locally as always. Logged so a
             // machine that silently stopped using the fast path is diagnosable.
-            dbg({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
+            (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
         }
         await hookCommandInner(args, config, processIo(raw, stdinErr));
     }
@@ -763,7 +697,7 @@ function failOpenOutcome(event, message) {
     }
     catch { /* never throw */ }
     try {
-        dbg({ phase: 'hook_fail_open', event, error: message, suspended });
+        (0, hookIo_1.dbg)({ phase: 'hook_fail_open', event, error: message, suspended });
     }
     catch { /* never throw */ }
     try {
@@ -799,8 +733,23 @@ function failOpenOutcome(event, message) {
 async function hookCommandInner(args, config, io) {
     // Mode is server-authoritative (pulled from the cached runtime bundle), with
     // local flags as explicit overrides. Resolved after creds below.
-    let shadow = args.shadow === 'true';
-    const forceMonitor = args.shadow === 'true';
+    //
+    // On INSTALLER-MANAGED invocations (`--fcd-managed true`, the hooks.json we
+    // write) a `--shadow` flag is IGNORED: our installer never writes it on the
+    // standard path, so its presence means someone hand-edited the managed entry
+    // to silently downgrade enforcement. Mode for managed hooks comes from the
+    // server bundle only — an org that wants shadow sets it in the console.
+    // Ad-hoc/manual `fullcourtdefense hook --shadow true` keeps working.
+    const managedInvocation = args.fcdManaged === 'true';
+    const shadowFlagIgnored = managedInvocation && args.shadow === 'true';
+    let shadow = args.shadow === 'true' && !managedInvocation;
+    const forceMonitor = shadow;
+    if (shadowFlagIgnored) {
+        try {
+            (0, hookIo_1.dbg)({ phase: 'managed_shadow_flag_ignored', event: args.event });
+        }
+        catch { /* never throw */ }
+    }
     const forceEnforce = args.enforce === 'true';
     // Offline stance: an explicit --fail-closed flag wins; otherwise the
     // server-authoritative machine stance from the runtime bundle applies
@@ -841,6 +790,14 @@ async function hookCommandInner(args, config, io) {
     if (!forceMonitor && !forceEnforce && shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
+            // Kill-switch holds even on a 'default' bundle: with the cache missing
+            // but a signed last-known-suspended marker standing, getRuntimeBundle
+            // stamps suspended on the default — deleting the cache file must not
+            // unlock a suspended machine.
+            if (bundle.suspended === true) {
+                machineSuspended = true;
+                shadow = false;
+            }
             if (bundle.source !== 'default') {
                 shadow = bundle.mode !== 'block'; // 'monitor'/'shadow' => report-only
                 modeResolved = true; // add this line
@@ -855,7 +812,7 @@ async function hookCommandInner(args, config, io) {
                     machineSuspended = true;
                     shadow = false;
                 }
-                dbg({ phase: 'mode_resolved', mode: bundle.mode, source: bundle.source, shadow, failClosed, suspended: machineSuspended });
+                (0, hookIo_1.dbg)({ phase: 'mode_resolved', mode: bundle.mode, source: bundle.source, shadow, failClosed, suspended: machineSuspended });
             }
         }
         catch { /* keep the local default */ }
@@ -863,7 +820,7 @@ async function hookCommandInner(args, config, io) {
     // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
     if (!modeResolved && !forceEnforce) {
         shadow = true;
-        dbg({ phase: 'mode_default_monitor_first', shadow });
+        (0, hookIo_1.dbg)({ phase: 'mode_default_monitor_first', shadow });
     }
     if (forceEnforce)
         shadow = false;
@@ -908,8 +865,8 @@ async function hookCommandInner(args, config, io) {
     else {
         event = inferEvent(args.event, payload);
     }
-    dbg({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
-        isTTY, rawLen: raw.length, ...(HOOK_DEBUG_VERBOSE ? { rawPreview: raw.slice(0, 300) } : {}), stdinErr, parseErr,
+    (0, hookIo_1.dbg)({ phase: 'invoke', event, argEvent: args.event, format: hookFormat, client, pid: process.pid,
+        isTTY, rawLen: raw.length, ...(hookIo_1.HOOK_DEBUG_VERBOSE ? { rawPreview: raw.slice(0, 300) } : {}), stdinErr, parseErr,
         argv: process.argv.slice(2), payloadKeys: Object.keys(payload) });
     // Emit the verdict in the shape THIS client expects, then exit.
     //   Cursor: beforeSubmitPrompt blocks via { continue: false }; execution hooks
@@ -949,7 +906,7 @@ async function hookCommandInner(args, config, io) {
             if (agentMsg)
                 decision.agent_message = agentMsg;
         }
-        dbg({ phase: 'verdict', event, format: hookFormat, blocked, decision });
+        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision });
         if (hookFormat === 'claude' && event === 'prompt' && blocked) {
             // Claude Desktop/Code variants do not all honor the structured
             // UserPromptSubmit decision consistently. Exit 2 is the documented hard
@@ -1001,7 +958,7 @@ async function hookCommandInner(args, config, io) {
     // --- Shield text analysis for prompts (developer chat) ---
     if (event === 'prompt') {
         const text = extractPromptText(payload).trim();
-        dbg({ phase: 'prompt_text', textLen: text.length, ...(HOOK_DEBUG_VERBOSE ? { textPreview: text.slice(0, 300) } : {}) });
+        (0, hookIo_1.dbg)({ phase: 'prompt_text', textLen: text.length, ...(hookIo_1.HOOK_DEBUG_VERBOSE ? { textPreview: text.slice(0, 300) } : {}) });
         if (!text)
             respond(false);
         // Record the developer's prompt so taint-tracking can later tell whether a
@@ -1020,7 +977,7 @@ async function hookCommandInner(args, config, io) {
         spoolLocalWarnings(promptOutcome.warnings, 'prompt', 'prompt');
         const localBlock = promptOutcome.blockingFinding;
         if (localBlock) {
-            dbg({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
+            (0, hookIo_1.dbg)({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
             if (shadow) {
                 // Truth-in-reporting: this prompt RAN (shadow/monitor) — 'warn', never 'block'.
                 spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt', decision: 'warn' });
@@ -1032,7 +989,7 @@ async function hookCommandInner(args, config, io) {
             return;
         }
         if (localOnly) {
-            dbg({ phase: 'local_deterministic_prompt_allow', event });
+            (0, hookIo_1.dbg)({ phase: 'local_deterministic_prompt_allow', event });
             respond(false);
             return;
         }
@@ -1094,9 +1051,9 @@ async function runTaintApproveOnce(ctx, event, call, sessId, taintFinding) {
             + `Deny:        fullcourtdefense approve ${approval.id} --deny\n`
             + `(run "fullcourtdefense approve" to list; expires in ${Math.round(timeoutMs / 60000)} min)`,
     });
-    dbg({ phase: 'taint_approve_once_wait', event, tool: call.toolName, approvalId: approval.id, timeoutMs });
+    (0, hookIo_1.dbg)({ phase: 'taint_approve_once_wait', event, tool: call.toolName, approvalId: approval.id, timeoutMs });
     const outcome = await (0, taintLedger_1.waitForTaintApproval)(approval.id, timeoutMs, Math.max(750, Math.min(ctx.approvalPollMs, 2000)));
-    dbg({ phase: 'taint_approve_once_outcome', approvalId: approval.id, outcome });
+    (0, hookIo_1.dbg)({ phase: 'taint_approve_once_outcome', approvalId: approval.id, outcome });
     if (outcome === 'approved') {
         (0, telemetry_1.spoolEvent)({
             decision: 'allow',
@@ -1146,7 +1103,7 @@ async function enforceActionPolicy(ctx) {
     spoolLocalWarnings(toolOutcome.warnings, call.toolName, event);
     const localBlock = toolOutcome.blockingFinding;
     if (localBlock) {
-        dbg({ phase: 'local_deterministic_block', event, tool: call.toolName, ruleId: localBlock.ruleId, category: localBlock.category });
+        (0, hookIo_1.dbg)({ phase: 'local_deterministic_block', event, tool: call.toolName, ruleId: localBlock.ruleId, category: localBlock.category });
         if (shadow) {
             // Truth-in-reporting: this action RAN (shadow/monitor) — 'warn', never 'block'.
             spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event, decision: 'warn' });
@@ -1162,7 +1119,7 @@ async function enforceActionPolicy(ctx) {
     // state directory; otherwise a compromised agent could approve itself.
     const selfApproval = (0, taintLedger_1.detectTaintSelfApproval)(event, call.toolName, call.toolArgs);
     if (selfApproval) {
-        dbg({ phase: 'taint_self_approval_block', event, tool: call.toolName });
+        (0, hookIo_1.dbg)({ phase: 'taint_self_approval_block', event, tool: call.toolName });
         if (shadow) {
             respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${selfApproval.reason}`);
             return;
@@ -1180,7 +1137,7 @@ async function enforceActionPolicy(ctx) {
     const sessId = sessionId(payload);
     const taintFinding = (0, taintLedger_1.checkTaintedSink)(sessId, event, call.toolName, call.toolArgs);
     if (taintFinding) {
-        dbg({ phase: 'local_taint_block', event, tool: call.toolName, ruleId: taintFinding.ruleId, sink: taintFinding.sink.kind, targets: taintFinding.sink.targets });
+        (0, hookIo_1.dbg)({ phase: 'local_taint_block', event, tool: call.toolName, ruleId: taintFinding.ruleId, sink: taintFinding.sink.kind, targets: taintFinding.sink.targets });
         if (shadow) {
             respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${taintFinding.reason}`);
             return;
@@ -1204,7 +1161,7 @@ async function enforceActionPolicy(ctx) {
     // (detached flush child). Enforce machines keep the full timeout + retry:
     // their verdict actually gates the action.
     if (shadow) {
-        dbg({ phase: 'policy_skip_monitor', event, tool: call.toolName });
+        (0, hookIo_1.dbg)({ phase: 'policy_skip_monitor', event, tool: call.toolName });
         const detail = 'monitor mode — synchronous policy check skipped by design.';
         if (!tryLocalPolicyEnforcement(ctx, call, detail, { countAsGateFailure: false })) {
             (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: call.toolName, reason: `monitor: ${detail}`, offlineEnforced: true });
@@ -1246,7 +1203,7 @@ async function enforceActionPolicy(ctx) {
         localCtx.developerName = developerId();
         localCtx.machineName = os.hostname();
         const localVerdict = (0, actionPolicyEngine_1.evaluateActionPolicies)(ctx.localPolicies, call.toolName, localOp, localCtx, (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName));
-        dbg({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });
+        (0, hookIo_1.dbg)({ phase: 'policy_local_first', event, tool: call.toolName, operation: localOp, verdict: localVerdict.verdict, policyName: localVerdict.policyName });
         if (localVerdict.verdict === 'allow') {
             // Audit rides async: server records the action + its own verdict; if it
             // is unreachable the spool keeps the trail (idempotent on eventId).
@@ -1275,7 +1232,7 @@ async function enforceActionPolicy(ctx) {
     // skip does NOT refresh the failure window, so the next call after 60s
     // probes the gate again (bounded), and a success resets the streak.
     if ((0, policyGateHealth_1.gateRecentlyDown)()) {
-        dbg({ phase: 'policy_skip_gate_down', event, tool: call.toolName });
+        (0, hookIo_1.dbg)({ phase: 'policy_skip_gate_down', event, tool: call.toolName });
         const detail = 'policy service recently unreachable — synchronous wait skipped (fast-probe window).';
         if (!tryLocalPolicyEnforcement(ctx, call, detail, { countAsGateFailure: false })) {
             respondDegraded(ctx, detail, call.toolName, false, { countAsGateFailure: false });
@@ -1293,9 +1250,9 @@ async function enforceActionPolicy(ctx) {
             method: 'POST',
             headers,
             body: gateBody,
-        }, gateTimeoutMs, (attempt, err) => dbg({ phase: 'policy_retry', event, attempt, error: err }), gateAttempts);
+        }, gateTimeoutMs, (attempt, err) => (0, hookIo_1.dbg)({ phase: 'policy_retry', event, attempt, error: err }), gateAttempts);
         if (!resp.ok) {
-            dbg({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
+            (0, hookIo_1.dbg)({ phase: 'policy_http_error', event, status: resp.status, failClosed: ctx.failClosed });
             const authRejected = resp.status === 401 || resp.status === 403;
             const detail = authRejected
                 ? `The policy service rejected this machine's credentials (HTTP ${resp.status}) — the shield key saved here is broken or revoked, not a network problem.`
@@ -1314,7 +1271,7 @@ async function enforceActionPolicy(ctx) {
         }
         const body = await resp.json().catch(() => ({}));
         if (!body.success || !body.data) {
-            dbg({ phase: 'policy_no_data', event, error: body.error, failClosed: ctx.failClosed });
+            (0, hookIo_1.dbg)({ phase: 'policy_no_data', event, error: body.error, failClosed: ctx.failClosed });
             const detail = body.error ? `Backend error: ${body.error}` : 'Backend returned no policy data.';
             if (!tryLocalPolicyEnforcement(ctx, call, detail)) {
                 respondDegraded(ctx, detail, call.toolName);
@@ -1326,7 +1283,7 @@ async function enforceActionPolicy(ctx) {
         (0, policyGateHealth_1.recordGateSuccess)();
     }
     catch (err) {
-        dbg({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err), failClosed: ctx.failClosed });
+        (0, hookIo_1.dbg)({ phase: 'policy_exception', event, error: err instanceof Error ? err.message : String(err), failClosed: ctx.failClosed });
         const detail = `Hook error: ${err instanceof Error ? err.message : String(err)}.`;
         if (!tryLocalPolicyEnforcement(ctx, call, detail)) {
             respondDegraded(ctx, detail, call.toolName);
@@ -1337,7 +1294,7 @@ async function enforceActionPolicy(ctx) {
         || result.intentEvaluation?.reasons?.[0]
         || `${call.toolName} ${result.decision}ed by Action Policy.`;
     const policyName = result.actionPolicy?.policyName;
-    dbg({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
+    (0, hookIo_1.dbg)({ phase: 'policy_verdict', event, tool: call.toolName, decision: result.decision, allowed: result.allowed, policyName });
     if (result.allowed && result.decision === 'allow') {
         respond(false);
         return;
@@ -1396,7 +1353,7 @@ async function waitForApproval(input) {
         headers['x-shield-key'] = input.shieldKey;
     const url = `${input.apiUrl}/api/agent-security/runtime/approvals/${encodeURIComponent(input.actionId)}?shieldId=${encodeURIComponent(input.shieldId)}`;
     const deadline = Date.now() + input.timeoutMs;
-    dbg({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: input.timeoutMs });
+    (0, hookIo_1.dbg)({ phase: 'approval_wait_start', actionId: input.actionId, timeoutMs: input.timeoutMs });
     while (Date.now() <= deadline) {
         try {
             const resp = await fetch(url, { method: 'GET', headers, signal: AbortSignal.timeout(15000) });
@@ -1415,7 +1372,7 @@ async function waitForApproval(input) {
             }
         }
         catch (err) {
-            dbg({ phase: 'approval_poll_error', actionId: input.actionId, error: err instanceof Error ? err.message : String(err) });
+            (0, hookIo_1.dbg)({ phase: 'approval_poll_error', actionId: input.actionId, error: err instanceof Error ? err.message : String(err) });
         }
         await new Promise((resolve) => setTimeout(resolve, Math.min(input.pollMs, Math.max(0, deadline - Date.now()))));
     }
@@ -1431,7 +1388,7 @@ async function enforceShieldText(ctx) {
     // deterministic rules already ran before this point; the audit trail rides
     // the async spool. Enforce machines keep the full window: their verdict gates.
     if (shadow) {
-        dbg({ phase: 'shield_skip_monitor', event });
+        (0, hookIo_1.dbg)({ phase: 'shield_skip_monitor', event });
         (0, telemetry_1.spoolEvent)({ decision: 'allow', toolName: 'prompt', reason: 'monitor: synchronous Shield scan skipped by design.', offlineEnforced: true });
         (0, telemetry_1.triggerFlush)(false);
         respond(false);
@@ -1440,7 +1397,7 @@ async function enforceShieldText(ctx) {
     // recently-failed gate is not re-probed on every prompt; the degraded stance
     // resolves instantly instead of paying the full timeout per event.
     if ((0, policyGateHealth_1.gateRecentlyDown)()) {
-        dbg({ phase: 'shield_skip_gate_down', event });
+        (0, hookIo_1.dbg)({ phase: 'shield_skip_gate_down', event });
         respondDegraded(ctx, 'Shield service recently unreachable — synchronous wait skipped (fast-probe window).', 'prompt', false, { countAsGateFailure: false });
         return;
     }
@@ -1460,7 +1417,7 @@ async function enforceShieldText(ctx) {
             method: 'POST',
             headers,
             body: JSON.stringify({ message: text }),
-        }, gateTimeoutMs, (attempt, error) => dbg({ phase: 'shield_retry', event, attempt, error }), gateAttempts);
+        }, gateTimeoutMs, (attempt, error) => (0, hookIo_1.dbg)({ phase: 'shield_retry', event, attempt, error }), gateAttempts);
         if (!resp.ok) {
             respondDegraded(ctx, `Backend returned HTTP ${resp.status}.`, 'prompt');
             return;

package/dist/commands/installClaudeHook.d.ts

@@ -28,6 +28,8 @@ export interface ClaudeManagedHookRepairResult {
     existed: boolean;
     managedEntries: number;
     staleEntries: number;
+    /** Managed entries with a hand-added `--shadow true` (enforcement downgrade tamper). */
+    weakenedEntries?: number;
     changed: boolean;
 }
 export declare function inspectClaudeManagedHooks(): ClaudeManagedHookRepairResult;

package/dist/commands/installClaudeHook.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
+const hookIo_1 = require("../hookIo");
 const restartNotice_1 = require("./restartNotice");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -77,9 +78,23 @@ function isManagedCommand(cmd) {
     return typeof cmd?.command === 'string'
         && (cmd.command.includes(MANAGED_MARKER) || cmd.command.includes(MANAGED_TAG));
 }
+/**
+ * Prefer the SLIM hook entry (dist/hookSlim.js — Node-builtins-only module
+ * graph, near-spawn-floor cold start) and fall back to the full CLI entry on
+ * older dist layouts. Repair rewrites stale entries through this prefix too,
+ * which is how an enrolled fleet migrates to the slim hook on upgrade.
+ */
+function hookScriptPath() {
+    const cliScript = process.argv[1] || path.join(__dirname, '..', 'index.js');
+    // argv[1] first (normal CLI invocation), then this module's own dist
+    // location — argv[1] can be an npm shim or a daemon-driven repair helper.
+    return (0, hookIo_1.slimHookEntryPath)(cliScript)
+        || (0, hookIo_1.slimHookEntryPath)(path.join(__dirname, '..', 'index.js'))
+        || cliScript;
+}
 function hookInvocationPrefix() {
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
-    return `${q(process.execPath)} ${q(process.argv[1] || path.join(__dirname, '..', 'index.js'))}`;
+    return `${q(process.execPath)} ${q(hookScriptPath())}`;
 }
 function repairManagedCommandPath(command) {
     const marker = command.indexOf(' hook ');
@@ -114,6 +129,10 @@ function inspectClaudeManagedHooks() {
         existed: true,
         managedEntries: commands.length,
         staleEntries: commands.filter(command => repairManagedCommandPath(command.command).stale).length,
+        // Hand-added `--shadow true` on a managed command = enforcement downgrade
+        // tamper (the installer never writes it). The hook ignores the flag on
+        // managed invocations; this count surfaces the edit in integrity reports.
+        weakenedEntries: commands.filter(command => /--shadow(?:[ =])true\b/.test(command.command)).length,
         changed: false,
     };
 }
@@ -189,12 +208,11 @@ function stripManaged(hooks) {
 /** Build the absolute, shell-agnostic command that invokes this CLI's `hook`. */
 function buildHookCommand(opts) {
     const nodeExe = process.execPath;
-    const scriptPath = process.argv[1] || path.join(__dirname, '..', 'index.js');
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
     // No --event flag: the bridge detects the Claude payload (hook_event_name) itself.
     // local-only affects prompt events only; tool events still use the complete
     // Action Policy/approval path. This keeps prompt text on the endpoint.
-    let cmd = `${q(nodeExe)} ${q(scriptPath)} hook --approval-mode wait --local-only true`;
+    let cmd = `${q(nodeExe)} ${q(hookScriptPath())} hook --approval-mode wait --local-only true`;
     if (opts.shadow)
         cmd += ' --shadow true';
     if (opts.failClosed)

package/dist/commands/installCursorHook.d.ts

@@ -13,6 +13,14 @@ export interface ManagedHookRepairResult {
     existed: boolean;
     managedEntries: number;
     staleEntries: number;
+    /**
+     * Managed entries whose command carries a hand-added `--shadow true` — the
+     * standard installer/repair path never writes it, so its presence means the
+     * managed entry was edited to silently downgrade enforcement. The hook
+     * itself ignores the flag on managed invocations; this count makes the
+     * tamper VISIBLE (integrity report -> fleet console).
+     */
+    weakenedEntries?: number;
     changed: boolean;
 }
 export declare function inspectCursorManagedHooks(): ManagedHookRepairResult;

package/dist/commands/installCursorHook.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
+const hookIo_1 = require("../hookIo");
 const restartNotice_1 = require("./restartNotice");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -70,12 +71,29 @@ const EVENT_MAP = {
     file: { hookKey: 'afterFileEdit', flag: 'file', timeoutSec: APPROVAL_CAPABLE_TIMEOUT_SEC },
     read: { hookKey: 'beforeReadFile', flag: 'read', timeoutSec: APPROVAL_CAPABLE_TIMEOUT_SEC },
 };
+/**
+ * The script a hook command invokes: the SLIM entry (dist/hookSlim.js) when it
+ * exists — a Node-builtins-only module graph, so per-event cold start is the
+ * node spawn plus three small files instead of the whole CLI (the difference
+ * an EDR-heavy corporate machine feels on every docker command). Falls back
+ * to the full CLI entry when the slim file is absent (older dist layouts).
+ * The literal ` hook ` subcommand is kept in the command either way — it is
+ * the marker managed-entry repair keys on, and the slim entry ignores it.
+ */
+function hookScriptPath() {
+    const cliScript = process.argv[1] || path.join(__dirname, '..', 'index.js');
+    // Resolve the slim entry against argv[1] first (normal CLI invocation), then
+    // against this module's own dist location — argv[1] can be an npm shim or a
+    // helper script (daemon-driven repair) rather than dist/index.js.
+    return (0, hookIo_1.slimHookEntryPath)(cliScript)
+        || (0, hookIo_1.slimHookEntryPath)(path.join(__dirname, '..', 'index.js'))
+        || cliScript;
+}
 /** Build the absolute, shell-agnostic command that invokes this CLI's `hook`. */
 function buildHookCommand(flag, opts) {
     const nodeExe = process.execPath; // real node binary (handles Windows/Linux/mac)
-    const scriptPath = process.argv[1] || path.join(__dirname, '..', 'index.js');
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
-    let cmd = `${q(nodeExe)} ${q(scriptPath)} hook --event ${flag}`;
+    let cmd = `${q(nodeExe)} ${q(hookScriptPath())} hook --event ${flag}`;
     if (opts.shadow)
         cmd += ' --shadow true';
     if (opts.failClosed)
@@ -113,9 +131,11 @@ function isManaged(entry) {
 }
 function hookInvocationPrefix() {
     const nodeExe = process.execPath;
-    const scriptPath = process.argv[1] || path.join(__dirname, '..', 'index.js');
     const q = (s) => (/\s/.test(s) ? `"${s}"` : s);
-    return `${q(nodeExe)} ${q(scriptPath)}`;
+    // Repair rewrites stale managed entries to the slim entry too — this is how
+    // an already-enrolled fleet migrates to the slim hook on upgrade, without a
+    // reinstall (protection repair runs from the daemon after every update).
+    return `${q(nodeExe)} ${q(hookScriptPath())}`;
 }
 function repairManagedCommandPath(command) {
     const marker = command.indexOf(' hook ');
@@ -124,6 +144,10 @@ function repairManagedCommandPath(command) {
     const expected = `${hookInvocationPrefix()}${command.slice(marker)}`;
     return { command: expected, stale: expected !== command };
 }
+/** A managed command mutated to weaken enforcement (`--shadow true` injected). */
+function isWeakenedManagedCommand(command) {
+    return /--shadow(?:[ =])true\b/.test(command);
+}
 function inspectCursorManagedHooks() {
     const file = hooksJsonPath(false);
     if (!fs.existsSync(file))
@@ -135,6 +159,7 @@ function inspectCursorManagedHooks() {
         existed: true,
         managedEntries: managed.length,
         staleEntries: managed.filter(entry => repairManagedCommandPath(entry.command).stale).length,
+        weakenedEntries: managed.filter(entry => isWeakenedManagedCommand(entry.command)).length,
         changed: false,
     };
 }