fullcourtdefense-cli 1.27.4 → 1.28.0

package/dist/commands/cmdGuard.d.ts

@@ -1,3 +1,4 @@
+export declare function buildGuardJs(nodePath: string, cliEntry: string): string;
 export interface CmdGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/cmdGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGuardJs = buildGuardJs;
 exports.isCmdGuardInstalled = isCmdGuardInstalled;
 exports.getCmdGuardStatus = getCmdGuardStatus;
 exports.installCmdGuardCommand = installCmdGuardCommand;
@@ -127,16 +128,25 @@ function buildGuardJs(nodePath, cliEntry) {
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `const ASK_TIMEOUT_S=${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS};const ASK_REMEMBER_MS=${shellGuard_1.SHELL_ASK_REMEMBER_HOURS}*3600*1000;`,
+        `// "s = remember for this cmd window": keyed by the parent cmd.exe pid (doskey runs us directly under it); dies with the window, capped in time.`,
+        `const ASK_MEMORY_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense'))}+'/cmd-ask-'+process.ppid+'.json';`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Precedence on one line: block outranks ask, ask outranks warn.`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
         `// made the user's terminal wait for a full CLI process INCLUDING the network`,
         `// flush after every finding. Monitor mode must never add synchronous latency.`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `function askRemembered(ruleId){try{const m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'));const until=m&&m[ruleId];return typeof until==='number'&&until>Date.now();}catch{return false;}}`,
+        `function rememberAsk(ruleId){try{let m={};try{m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'))||{};}catch{}m[ruleId]=Date.now()+ASK_REMEMBER_MS;fs.mkdirSync(path.dirname(ASK_MEMORY_PATH),{recursive:true});fs.writeFileSync(ASK_MEMORY_PATH,JSON.stringify(m),{encoding:'utf8',mode:0o600});}catch{}}`,
+        `// One key via choice.exe (ships with Windows): Y run once, S run + remember for this window, N / timeout not executed. FCD_ASK_TEST_ANSWER overrides for the drill.`,
+        `function askDeveloper(hit){const forced=process.env.FCD_ASK_TEST_ANSWER;if(forced)return forced;try{const r=spawnSync('choice',['/c','YSN','/n','/t',String(ASK_TIMEOUT_S),'/d','N','/m','Run anyway?  [Y] yes   [S] yes, remember for this cmd window   [N] no   ('+ASK_TIMEOUT_S+'s):'],{stdio:'inherit',windowsHide:true});if(r.status===1)return 'y';if(r.status===2)return 's';if(r.status===3)return 'n';}catch{}return 'n';}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
         // TOP-LEVEL FAIL-OPEN: any unexpected exception in rule loading/matching
@@ -144,8 +154,15 @@ function buildGuardJs(nodePath, cliEntry) {
         // delegate. A stack trace or nonzero exit here IS an outage for the shell.
         `const line=args.join(' ');let mode='monitor';let hit=null;try{const r=loadRules();mode=r.mode;hit=matchLine(line,r.rules);}catch{hit=null;}`,
         `if(!hit)delegate(args);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
+        `if(hit.action==='ask'){`,
+        `  if(askRemembered(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this cmd window.');spoolEvent(hit,line,'allow','remembered');delegate(args);}`,
+        `  console.error('[FullCourtDefense] ASK ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
+        `  const a=askDeveloper(hit);`,
+        `  if(a==='y'||a==='s'){if(a==='s')rememberAsk(hit.id);console.error('[FullCourtDefense] yes'+(a==='s'?' — remembered for this cmd window.':'')+' Reported to your security dashboard as allowed by you.');spoolEvent(hit,line,'allow','confirmed');delegate(args);}`,
+        `  const outcome=a==='t'?'timeout':'declined';console.error('[FullCourtDefense] '+(outcome==='timeout'?'no answer':'no')+' — this command was not executed ('+outcome+'). Reported to your security dashboard.');spoolEvent(hit,line,'block',outcome);process.exit(1);`,
+        `}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(1);`,
@@ -263,7 +280,7 @@ async function installCmdGuardCommand(_args = {}) {
     }
     const rules = (0, shellGuard_1.writeShellGuardRules)();
     const nodePath = process.execPath;
-    const cliEntry = process.argv[1] || '';
+    const cliEntry = (0, shellGuard_1.guardCliEntry)();
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 'utf8');
     // Macro file BEFORE the bat: the bat refuses to register macros without it,
     // so this order can never leave a window where cmd.exe sources a bat whose
@@ -324,7 +341,7 @@ function refreshCmdGuardRules() {
         // registering no macros at all. This is the only path that repairs that.
         if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH) || !fs.existsSync(MACRO_FILE_PATH)) {
             const nodePath = process.execPath;
-            (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, process.argv[1] || ''));
+            (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, (0, shellGuard_1.guardCliEntry)()));
             (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
             (0, shellGuard_1.writeGuardArtifact)(AUTORUN_BAT_PATH, buildAutorunBat(nodePath));
         }

package/dist/commands/installAll.js

@@ -126,10 +126,12 @@ async function installAllCommand(args, config) {
         }
     }
     // Interactive macOS/Linux guard — same rules, zsh accept-line widget + bash
-    // function wrappers, from the local cache (no admin, no network hot path).
-    // Gated to darwin/linux so Windows install-all behavior is unchanged.
-    if ((process.platform === 'darwin' || process.platform === 'linux') && args.posixGuard !== 'false') {
-        console.log('\n\x1b[1mInstalling interactive shell guard (bash + zsh)…\x1b[0m');
+    // DEBUG-trap hook, from the local cache (no admin, no network hot path). On
+    // Windows the same bash guard covers Git Bash (MSYS2) when it is installed.
+    if ((0, posixShellGuard_1.posixGuardSupported)() && args.posixGuard !== 'false') {
+        console.log(process.platform === 'win32'
+            ? '\n\x1b[1mGit Bash detected — installing interactive shell guard (bash)…\x1b[0m'
+            : '\n\x1b[1mInstalling interactive shell guard (bash + zsh)…\x1b[0m');
         try {
             await (0, posixShellGuard_1.installPosixShellGuardCommand)();
         }

package/dist/commands/mcpGateway.js

@@ -67,6 +67,7 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const machineIdentity_1 = require("../machineIdentity");
 const backupManifest_1 = require("../backupManifest");
+const devConfirm_1 = require("../devConfirm");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
 const INSTALL_GATEWAY_ARGS = { includeShieldKey: false };
@@ -876,6 +877,8 @@ function blockError(message) {
 function isBlockError(err) {
     return err instanceof Error && err.fcdDeliberateBlock === true;
 }
+/** How long an MCP elicitation ("Ask the developer" dialog in the client) waits before it counts as declined. */
+const ELICITATION_TIMEOUT_MS = 5 * 60_000;
 class McpGatewayServer {
     gatewayConfig;
     downstreamSpec;
@@ -883,6 +886,20 @@ class McpGatewayServer {
     downstreamReady;
     buffer = '';
     api;
+    /**
+     * The MCP client declared `capabilities.elicitation` on initialize — it can
+     * show the user a server-initiated question. That is the only channel a stdio
+     * proxy has to "Ask the developer"; without it an ask rule fails strict.
+     */
+    clientSupportsElicitation = false;
+    /** Server -> client requests (elicitation) awaiting the client's response, by id. */
+    clientPending = new Map();
+    clientRequestSeq = 0;
+    /**
+     * "Remember for this session" scope when the client passes no session id: the
+     * gateway process lives exactly as long as the client's MCP session does.
+     */
+    gatewaySessionId = `gateway-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
     constructor(gatewayConfig, downstreamSpec) {
         this.gatewayConfig = gatewayConfig;
         this.downstreamSpec = downstreamSpec;
@@ -924,10 +941,29 @@ class McpGatewayServer {
         // id may legally be 0 or "" — only a genuinely ABSENT id marks a notification.
         if ((message.id === undefined || message.id === null) && message.method?.startsWith('notifications/'))
             return;
+        // A RESPONSE from the client to one of OUR requests (elicitation): no
+        // method, an id we issued. Route it to the waiter instead of the -32601 path.
+        if (!message.method && message.id !== undefined && message.id !== null && ('result' in message || 'error' in message)) {
+            const waiter = this.clientPending.get(String(message.id));
+            if (waiter) {
+                clearTimeout(waiter.timer);
+                this.clientPending.delete(String(message.id));
+                waiter.resolve(message);
+            }
+            return;
+        }
         try {
             if (message.method === 'initialize') {
+                const caps = message.params?.capabilities;
+                this.clientSupportsElicitation = Boolean(caps && typeof caps === 'object' && caps.elicitation !== undefined && caps.elicitation !== null);
+                // Echo the client's own protocol version (it necessarily supports it);
+                // elicitation is a 2025-06-18+ feature, but the capability flag — not
+                // the version string — is what tells us the client can show a dialog.
+                const requested = typeof message.params?.protocolVersion === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(message.params.protocolVersion)
+                    ? message.params.protocolVersion
+                    : '2024-11-05';
                 this.respond(message.id, {
-                    protocolVersion: '2024-11-05',
+                    protocolVersion: requested,
                     capabilities: { tools: {} },
                     serverInfo: { name: 'agentguard-mcp-gateway', version: '0.1.0' },
                 });
@@ -1099,12 +1135,77 @@ class McpGatewayServer {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
-            // The gateway is a stdio proxy with no developer prompt of its own — an
-            // "Ask the developer" rule fails strict here (block), never a silent allow.
-            const localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
+            // "Ask the developer" rule with no hard block on the same call: ask the
+            // human through the MCP client (elicitation) when the client can show a
+            // dialog and a human is present. Session memory reuses the IDE hook's
+            // ledger (same tool + rule => remembered). Decline, cancel, timeout, a
+            // client without elicitation, or no human => block, never a silent allow.
+            let localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
+            let askNote = '';
+            if (!requestOutcome.blockingFinding && requestOutcome.askFinding && !reportOnlyMode) {
+                const ask = requestOutcome.askFinding;
+                const origin = ask.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+                const rememberScope = { toolName, operation: operation || (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).operation, policyId: `local-safety:${ask.itemId}`, matchedRule: ask.ruleId };
+                const sessionId = runtimeSessionId() || this.gatewaySessionId;
+                const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
+                if (remembered) {
+                    (0, telemetry_1.spoolEvent)({
+                        decision: 'allow', toolName, operation: rememberScope.operation,
+                        reason: `developer confirmed earlier this session (session memory) — ${ask.reason}`,
+                        ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                        evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                        approvalScope: 'developer', approvedBy: 'developer',
+                    });
+                    (0, telemetry_1.triggerFlush)(false);
+                    localBlock = undefined;
+                }
+                else if (this.clientSupportsElicitation && (0, devConfirm_1.isHumanPresent)()) {
+                    const digest = (0, devConfirm_1.actionDigest)(toolArgs);
+                    const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
+                        event: 'mcp_gateway', toolName, operation: rememberScope.operation, argsDigest: digest,
+                        policyId: rememberScope.policyId, policyName: `Local Safety: ${ask.itemId}`, matchedRule: ask.ruleId,
+                        sessionId, remember: 'none',
+                    });
+                    process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}: ${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId})\n`);
+                    const answer = await this.elicitDeveloperConfirmation({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence });
+                    if (answer.answer === 'accept') {
+                        // Settle through the shared ledger so "remember for this session" is
+                        // recorded exactly like an IDE approval would be.
+                        if (answer.remember)
+                            (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
+                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, telemetry_1.spoolEvent)({
+                            decision: 'allow', toolName, operation: rememberScope.operation,
+                            reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''} — ${ask.reason}`,
+                            ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                            evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                            approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
+                        });
+                        (0, telemetry_1.triggerFlush)(false);
+                        localBlock = undefined;
+                    }
+                    else {
+                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+                        (0, telemetry_1.spoolEvent)({
+                            decision: 'block', toolName, operation: rememberScope.operation,
+                            reason: `${how} — ${ask.reason}`,
+                            ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                            evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                            approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
+                        });
+                        (0, telemetry_1.triggerFlush)(true);
+                        throw blockError(`${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId}: ${ask.evidence}) — ${answer.answer === 'timeout' ? 'you did not answer the confirmation prompt in time' : 'you declined the confirmation prompt'}, so this tool call was not executed. Logged to your org's console. This is a security policy decision, not a transient error — do not retry.`);
+                    }
+                }
+                else {
+                    askNote = this.clientSupportsElicitation
+                        ? ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.'
+                        : ' This rule asks the developer to confirm; this MCP client cannot show a confirmation dialog (no elicitation support), so it blocks here (the IDE hook can ask).';
+                }
+            }
             if (localBlock) {
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
-                const askNote = !requestOutcome.blockingFinding ? ' This rule asks the developer to confirm; the MCP gateway cannot prompt, so it blocks here (the IDE hook can ask).' : '';
                 if (reportOnlyMode) {
                     // MONITOR CONTRACT: a monitor/shadow machine (or one with no bundle
                     // signal at all) must NEVER hard-block. Online, the server already
@@ -1112,8 +1213,9 @@ class McpGatewayServer {
                     // the client-side belt for offline/no-cache/stale-cache states,
                     // where the scan can still yield block-action findings. Record the
                     // would-block and let the call through.
+                    const would = requestOutcome.blockingFinding ? 'would block' : 'would ask you to confirm';
                     this.spoolLocalFinding({ ...localBlock, reason: `[monitor] ${localBlock.reason}` }, toolName, operation, 'warn');
-                    process.stderr.write(`FullCourtDefense (monitor) would block ${toolName}: ${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId})\n`);
+                    process.stderr.write(`FullCourtDefense (monitor) ${would} ${toolName}: ${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId})\n`);
                 }
                 else {
                     this.spoolLocalFinding(localBlock, toolName, operation);
@@ -1614,6 +1716,63 @@ class McpGatewayServer {
     error(id, code, message) {
         process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } })}\n`);
     }
+    /**
+     * Server -> client JSON-RPC request (MCP lets servers ask the client for
+     * things: elicitation, sampling, roots). Resolves with the client's response
+     * message; a timeout resolves to `undefined`. Never rejects.
+     */
+    requestClient(method, params, timeoutMs) {
+        const id = `fcd-${++this.clientRequestSeq}`;
+        return new Promise(resolve => {
+            const timer = setTimeout(() => {
+                this.clientPending.delete(id);
+                resolve(undefined);
+            }, timeoutMs);
+            this.clientPending.set(id, { resolve, timer });
+            process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
+        });
+    }
+    /**
+     * "Ask the developer" through the MCP client. Shows the same question the IDE
+     * hook would: what is about to run, which rule asked, yes / no, and an
+     * optional "remember for this session". Returns the human's answer; anything
+     * that is not an explicit accept (decline, cancel, timeout, malformed) is a
+     * decline. The caller decides what a decline means (block).
+     */
+    async elicitDeveloperConfirmation(input) {
+        const started = Date.now();
+        const evidence = input.evidence ? `\n\nEvidence: ${input.evidence.slice(0, 240)}` : '';
+        const response = await this.requestClient('elicitation/create', {
+            message: `FullCourtDefense — your organization asks you to confirm this action.\n\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nAllow this tool call? Your answer is reported to your security dashboard as your decision.`,
+            requestedSchema: {
+                type: 'object',
+                properties: {
+                    confirm: {
+                        type: 'boolean',
+                        title: 'Allow this tool call',
+                        description: 'Yes runs the tool call once. No (or closing this dialog) does not run it.',
+                        default: false,
+                    },
+                    remember: {
+                        type: 'boolean',
+                        title: 'Remember for this session',
+                        description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
+                        default: false,
+                    },
+                },
+                required: ['confirm'],
+            },
+        }, ELICITATION_TIMEOUT_MS);
+        const latencyMs = Date.now() - started;
+        if (!response)
+            return { answer: 'timeout', remember: false, latencyMs };
+        const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
+        const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
+        if (result?.action === 'accept' && content?.confirm === true) {
+            return { answer: 'accept', remember: content.remember === true, latencyMs };
+        }
+        return { answer: 'decline', remember: false, latencyMs };
+    }
 }
 async function mcpGatewayCommand(args, config) {
     // The gateway is a resident proxy in front of the IDE's MCP servers — if it

package/dist/commands/posixShellGuard.d.ts

@@ -1,3 +1,16 @@
+/** Checker exit code: the rule asks the developer — the shell must prompt. */
+export declare const ASK_CODE = 98;
+/**
+ * Git for Windows' bash.exe, if installed (the MSYS2-based "Git Bash"). WSL's
+ * System32\bash.exe is deliberately NOT a match — that is a Linux distro with
+ * its own home directory and rc files, not this Windows profile.
+ */
+export declare function detectGitBash(): string | undefined;
+/**
+ * Where the bash/zsh guard can be planted: real POSIX hosts, or Windows with
+ * Git Bash installed (bash only — no zsh there).
+ */
+export declare function posixGuardSupported(): boolean;
 export interface PosixShellGuardStatus {
     supported: boolean;
     installed: boolean;
@@ -18,9 +31,9 @@ export interface InstallPosixShellGuardArgs {
     /** 'false' to write the guard scripts + rules without wiring rc files. */
     profiles?: string;
 }
-/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+/** `fullcourtdefense install-shell-guard` on macOS/Linux (bash/zsh) or Windows with Git Bash (bash). */
 export declare function installPosixShellGuardCommand(args?: InstallPosixShellGuardArgs): Promise<void>;
-/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux (or Git Bash on Windows) — remove the guard. */
 export declare function uninstallPosixShellGuardCommand(): Promise<void>;
 /** Refresh the shared rules JSON when the POSIX guard is installed. Never throws. */
 export declare function refreshPosixShellGuardRules(): void;

package/dist/commands/posixShellGuard.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASK_CODE = void 0;
+exports.detectGitBash = detectGitBash;
+exports.posixGuardSupported = posixGuardSupported;
 exports.getPosixShellGuardStatus = getPosixShellGuardStatus;
 exports.isPosixShellGuardInstalled = isPosixShellGuardInstalled;
 exports.installPosixShellGuardCommand = installPosixShellGuardCommand;
@@ -75,6 +78,18 @@ const shellGuard_1 = require("./shellGuard");
  * (checker exit code 97) stops a command. Disable for a session with
  * `export FCD_SHELL_GUARD=off`.
  *
+ * "Ask the developer" rules (checker exit code 98): the checker prints one
+ * machine-readable `FCD_ASK\t<rule>\t<severity>\t<reason>` line and the SHELL
+ * (which owns the tty) shows `Run anyway? [y] / [s] remember for this shell /
+ * [N]` with a timeout. y/s run the line, anything else drops it; every answer
+ * is reported through the checker's `--record` mode as a developer decision.
+ * An ask that cannot be answered (no tty, timeout) is a block — the one place
+ * the guard fails STRICT, because the org explicitly asked for a human.
+ *
+ * Git Bash on Windows (MSYS2 runtime) is supported: same bash guard, wired into
+ * %USERPROFILE%\.bashrc, node invoked with MSYS path conversion disabled so
+ * typed lines like `/dev/tcp/...` reach the checker untouched.
+ *
  * Rules/mode refresh opportunistically on every telemetry flush (offline caches
  * only — never blocks a shell). Blocks are spooled and reported to the fleet
  * dashboard as `shell_terminal` events.
@@ -87,9 +102,49 @@ const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
 const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
 const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
 const BLOCK_CODE = 97;
+/** Checker exit code: the rule asks the developer — the shell must prompt. */
+exports.ASK_CODE = 98;
 function isPosixPlatform() {
     return process.platform === 'darwin' || process.platform === 'linux';
 }
+/**
+ * Git for Windows' bash.exe, if installed (the MSYS2-based "Git Bash"). WSL's
+ * System32\bash.exe is deliberately NOT a match — that is a Linux distro with
+ * its own home directory and rc files, not this Windows profile.
+ */
+function detectGitBash() {
+    if (process.platform !== 'win32')
+        return undefined;
+    const candidates = [
+        path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env.ProgramW6432 || '', 'Git', 'bin', 'bash.exe'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            if (candidate && fs.existsSync(candidate))
+                return candidate;
+        }
+        catch { /* keep looking */ }
+    }
+    return undefined;
+}
+/**
+ * Where the bash/zsh guard can be planted: real POSIX hosts, or Windows with
+ * Git Bash installed (bash only — no zsh there).
+ */
+function posixGuardSupported() {
+    return isPosixPlatform() || Boolean(detectGitBash());
+}
+/**
+ * Path as the planted shell script should spell it. MSYS2 bash resolves
+ * `C:/Program Files/nodejs/node.exe` for `[ -x ]` and exec; backslashes would
+ * be read as escapes inside the script.
+ */
+function shellPath(p) {
+    return process.platform === 'win32' ? p.replace(/\\/g, '/') : p;
+}
 function shSingleQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -104,27 +159,107 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `const ASK_CODE=${exports.ASK_CODE};`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Precedence on one line: block outranks ask, ask outranks warn.`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
-        `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `let argv=process.argv.slice(2);`,
+        `// --record <confirmed|remembered|declined|timeout> <ruleId> -- <line>: the shell answered an ask prompt; report it and exit.`,
+        `if(argv[0]==='--record'){const kind=argv[1],ruleId=argv[2];let rest=argv.slice(3);if(rest[0]==='--')rest=rest.slice(1);const rline=rest.join(' ');try{const{rules}=loadRules();const rule=rules.find(r=>r.id===ruleId)||{id:ruleId,reason:'ask rule '+ruleId,category:'',severity:'',source:'builtin'};spoolEvent(rule,rline,(kind==='confirmed'||kind==='remembered')?'allow':'block',kind);}catch{}process.exit(0);}`,
+        `if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
         `if(!line.trim())process.exit(0);`,
         `if(process.env.FCD_SHELL_GUARD==='off')process.exit(0);`,
         `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)process.exit(0);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
+        `if(hit.action==='ask'){`,
+        `  // "s = remember for this shell": the shell exports FCD_SHELL_ASK_OK=<ruleId>,<ruleId>... — dies with the shell.`,
+        `  const ok=String(process.env.FCD_SHELL_ASK_OK||'').split(',').map(s=>s.trim()).filter(Boolean);`,
+        `  if(ok.includes(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this shell.');spoolEvent(hit,line,'allow','remembered');process.exit(0);}`,
+        `  // Machine-readable ask line on stdout; the sourcing shell owns the prompt (it has the tty).`,
+        `  process.stdout.write('FCD_ASK\\t'+hit.id+'\\t'+(hit.severity||'')+'\\t'+String(hit.reason||'').replace(/[\\t\\n\\r]+/g,' ')+'\\n');`,
+        `  process.exit(ASK_CODE);`,
+        `}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(BLOCK_CODE);`,
         ``,
     ].join('\n');
 }
+/**
+ * Shared POSIX-shell prompt for an ask hit (sourced by both the bash and zsh
+ * guards — plain POSIX/bash syntax, no ZLE). Args: <meta line> <typed line>.
+ * Returns 0 = run the command, 1 = do not. Reads ONE key from /dev/tty with a
+ * timeout; y = run once, s = run + export FCD_SHELL_ASK_OK for this shell,
+ * anything else / timeout / no tty = not executed. Every answer is reported
+ * through the checker's --record mode. Fail-strict: an ask that cannot be
+ * answered is a block, never a silent allow.
+ */
+function buildAskShellFunction(shell) {
+    // One key, with timeout: bash `read -n 1 -t`, zsh `read -k 1 -t`.
+    const readKey = shell === 'zsh'
+        ? `read -k 1 -t ${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS} __fcd_ans </dev/tty`
+        : `IFS= read -r -n 1 -t ${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS} __fcd_ans </dev/tty`;
+    return [
+        `__fcd_ask_prompt() {`,
+        `  local __fcd_meta="$1" __fcd_line="$2" __fcd_tag __fcd_id __fcd_sev __fcd_reason __fcd_ans=""`,
+        `  local __fcd_oldifs="$IFS"; IFS="$(printf '\\t')"; read -r __fcd_tag __fcd_id __fcd_sev __fcd_reason <<< "$__fcd_meta"; IFS="$__fcd_oldifs"`,
+        `  printf '[FullCourtDefense] ASK [%s]: %s (rule %s)\\n' "$__fcd_sev" "$__fcd_reason" "$__fcd_id" >&2`,
+        `  # Only a shell with a REAL keyboard may be asked: stdin must be this shell's`,
+        `  # terminal. A spawned / piped / embedded shell (stdin not a tty) never opens`,
+        `  # /dev/tty — on MSYS that can be some OTHER window's console — it blocks now.`,
+        `  if [ -t 0 ] && [ -r /dev/tty ] && [ -w /dev/tty ]; then`,
+        `    printf 'Run anyway?  [y] yes   [s] yes, remember for this shell   [N] no   (%ss): ' "${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS}" >/dev/tty`,
+        `    if ${readKey}; then :; else __fcd_ans="__timeout__"; fi`,
+        `    printf '\\n' >/dev/tty`,
+        `  else`,
+        `    __fcd_ans="__notty__"`,
+        `    printf '[FullCourtDefense] no terminal to ask on — not executed.\\n' >&2`,
+        `  fi`,
+        `  case "$__fcd_ans" in`,
+        `    y|Y)`,
+        `      printf '[FullCourtDefense] yes — reported to your security dashboard as allowed by you.\\n' >&2`,
+        `      __fcd_run_checker --record confirmed "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 0 ;;`,
+        `    s|S)`,
+        `      export FCD_SHELL_ASK_OK="\${FCD_SHELL_ASK_OK:+$FCD_SHELL_ASK_OK,}$__fcd_id"`,
+        `      printf '[FullCourtDefense] yes — remembered for this shell. Reported to your security dashboard as allowed by you.\\n' >&2`,
+        `      __fcd_run_checker --record confirmed "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 0 ;;`,
+        `    __timeout__)`,
+        `      printf '[FullCourtDefense] no answer — this command was not executed (timeout). Reported to your security dashboard.\\n' >&2`,
+        `      __fcd_run_checker --record timeout "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 1 ;;`,
+        `    *)`,
+        `      printf '[FullCourtDefense] no — this command was not executed (declined). Reported to your security dashboard.\\n' >&2`,
+        `      __fcd_run_checker --record declined "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 1 ;;`,
+        `  esac`,
+        `}`,
+    ].join('\n');
+}
+/**
+ * How the shell scripts invoke the Node checker. On Git Bash (MSYS2 runtime on
+ * Windows) node.exe is a NATIVE program, so the runtime would rewrite any
+ * argument that looks like a POSIX path (e.g. the typed line "/usr/bin/rm -rf /"
+ * or "/dev/tcp/...") into a Windows path before node sees it — disable that for
+ * this one call. Both variables are inert on real macOS/Linux shells.
+ */
+function buildRunCheckerFunction() {
+    return [
+        `__fcd_run_checker() {`,
+        `  MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' "$FCD_GUARD_NODE" "$FCD_GUARD_JS" "$@"`,
+        `}`,
+    ].join('\n');
+}
 /** zsh guard — sourced ONLY from .zshrc (contains zsh-specific ZLE syntax). */
 function buildGuardZsh(nodePath) {
     return [
@@ -135,8 +270,12 @@ function buildGuardZsh(nodePath) {
         ``,
         `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
         ``,
-        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
-        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        `FCD_GUARD_NODE=${shSingleQuote(shellPath(nodePath))}`,
+        `FCD_GUARD_JS=${shSingleQuote(shellPath(GUARD_JS_PATH))}`,
+        ``,
+        buildRunCheckerFunction(),
+        ``,
+        buildAskShellFunction('zsh'),
         ``,
         `# Inspect the WHOLE typed line against every rule before accepting it`,
         `# (command-agnostic: catches any command, pipes, and chained segments).`,
@@ -145,12 +284,23 @@ function buildGuardZsh(nodePath) {
         `  local __fcd_line=$BUFFER`,
         `  if [[ -n "$__fcd_line" && "\${FCD_SHELL_GUARD:-}" != "off" && -x "$FCD_GUARD_NODE" && -f "$FCD_GUARD_JS" ]]; then`,
         `    local __fcd_out`,
-        `    __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `    __fcd_out="$(__fcd_run_checker -- "$__fcd_line" 2>&1)"`,
         `    local __fcd_rc=$?`,
-        `    if [[ $__fcd_rc -eq 97 ]]; then`,
+        `    if [[ $__fcd_rc -eq ${BLOCK_CODE} ]]; then`,
         `      zle -M -- "$__fcd_out"`,
         `      return`,
         `    fi`,
+        `    if [[ $__fcd_rc -eq ${exports.ASK_CODE} ]]; then`,
+        `      # Ask the human: leave ZLE for the prompt, then run or drop the line.`,
+        `      zle -I`,
+        `      if __fcd_ask_prompt "$__fcd_out" "$__fcd_line"; then`,
+        `        zle .accept-line`,
+        `      else`,
+        `        BUFFER=""`,
+        `        zle .accept-line`,
+        `      fi`,
+        `      return`,
+        `    fi`,
         `    [[ -n "$__fcd_out" ]] && print -u2 -r -- "$__fcd_out"`,
         `  fi`,
         `  zle .accept-line`,
@@ -182,10 +332,14 @@ function buildGuardBash(nodePath) {
         ``,
         `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
         ``,
-        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
-        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        `FCD_GUARD_NODE=${shSingleQuote(shellPath(nodePath))}`,
+        `FCD_GUARD_JS=${shSingleQuote(shellPath(GUARD_JS_PATH))}`,
         `__fcd_last_line=""`,
         ``,
+        buildRunCheckerFunction(),
+        ``,
+        buildAskShellFunction('bash'),
+        ``,
         `# Run the shared checker on one full line. Returns 1 to cancel (extdebug).`,
         `__fcd_check_line() {`,
         `  local __fcd_line="$1"`,
@@ -193,10 +347,14 @@ function buildGuardBash(nodePath) {
         `  [ "\${FCD_SHELL_GUARD:-}" = "off" ] && return 0`,
         `  if [ ! -x "$FCD_GUARD_NODE" ] || [ ! -f "$FCD_GUARD_JS" ]; then return 0; fi`,
         `  local __fcd_out __fcd_rc`,
-        `  __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `  __fcd_out="$(__fcd_run_checker -- "$__fcd_line" 2>&1)"`,
         `  __fcd_rc=$?`,
+        `  if [ "$__fcd_rc" -eq ${exports.ASK_CODE} ]; then`,
+        `    __fcd_ask_prompt "$__fcd_out" "$__fcd_line" && return 0`,
+        `    return 1`,
+        `  fi`,
         `  [ -n "$__fcd_out" ] && printf '%s\\n' "$__fcd_out" >&2`,
-        `  [ "$__fcd_rc" -eq 97 ] && return 1`,
+        `  [ "$__fcd_rc" -eq ${BLOCK_CODE} ] && return 1`,
         `  return 0`,
         `}`,
         ``,
@@ -222,13 +380,18 @@ function buildGuardBash(nodePath) {
         ``,
     ].join('\n');
 }
-/** rc files we wire the guard into. .bash_profile only when it already exists. */
+/**
+ * rc files we wire the guard into. .bash_profile only when it already exists.
+ * Windows (Git Bash) is bash-only: Git for Windows' login shell reads
+ * ~/.bash_profile, and auto-creates one that sources ~/.bashrc when only the
+ * latter exists — so ~/.bashrc is the right home there too.
+ */
 function resolveRcTargets() {
     const home = os.homedir();
-    const out = [
-        { shell: 'zsh', rcPath: path.join(home, '.zshrc'), guardPath: GUARD_ZSH_PATH },
-        { shell: 'bash', rcPath: path.join(home, '.bashrc'), guardPath: GUARD_BASH_PATH },
-    ];
+    const out = [];
+    if (process.platform !== 'win32')
+        out.push({ shell: 'zsh', rcPath: path.join(home, '.zshrc'), guardPath: GUARD_ZSH_PATH });
+    out.push({ shell: 'bash', rcPath: path.join(home, '.bashrc'), guardPath: GUARD_BASH_PATH });
     const bashProfile = path.join(home, '.bash_profile');
     if (fs.existsSync(bashProfile))
         out.push({ shell: 'bash', rcPath: bashProfile, guardPath: GUARD_BASH_PATH });
@@ -272,7 +435,7 @@ function removeSnippetFromRc(rcPath) {
 }
 /** Read-only probe. Never throws. */
 function getPosixShellGuardStatus() {
-    if (!isPosixPlatform()) {
+    if (!posixGuardSupported()) {
         return { supported: false, installed: false, rcFiles: [], rulesPresent: false };
     }
     try {
@@ -310,7 +473,7 @@ function getPosixShellGuardStatus() {
 /** Lightweight boolean for the telemetry heartbeat / discovery report. */
 function isPosixShellGuardInstalled() {
     try {
-        if (!isPosixPlatform())
+        if (!posixGuardSupported())
             return false;
         if (!fs.existsSync(GUARD_ZSH_PATH) && !fs.existsSync(GUARD_BASH_PATH))
             return false;
@@ -327,17 +490,18 @@ function isPosixShellGuardInstalled() {
         return false;
     }
 }
-/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+/** `fullcourtdefense install-shell-guard` on macOS/Linux (bash/zsh) or Windows with Git Bash (bash). */
 async function installPosixShellGuardCommand(args = {}) {
-    if (!isPosixPlatform()) {
-        console.log('The POSIX shell guard supports macOS and Linux (bash/zsh).');
+    if (!posixGuardSupported()) {
+        console.log('The POSIX shell guard supports macOS and Linux (bash/zsh), and Git Bash on Windows.');
         return;
     }
     const rules = (0, shellGuard_1.writeShellGuardRules)();
     const nodePath = process.execPath;
-    const cliEntry = process.argv[1] || '';
+    const cliEntry = (0, shellGuard_1.guardCliEntry)();
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), { encoding: 'utf8', mode: 0o600 });
-    fs.writeFileSync(GUARD_ZSH_PATH, buildGuardZsh(nodePath), { encoding: 'utf8', mode: 0o600 });
+    if (process.platform !== 'win32')
+        fs.writeFileSync(GUARD_ZSH_PATH, buildGuardZsh(nodePath), { encoding: 'utf8', mode: 0o600 });
     fs.writeFileSync(GUARD_BASH_PATH, buildGuardBash(nodePath), { encoding: 'utf8', mode: 0o600 });
     console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
     if (args.profiles === 'false') {
@@ -358,14 +522,14 @@ async function installPosixShellGuardCommand(args = {}) {
             console.log(`\x1b[33m⚠ ${target.shell}: could not update ${target.rcPath} (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
         }
     }
-    console.log('\x1b[2mTakes effect in NEW terminals (or run: source ~/.zshrc). Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+    console.log('\x1b[2mTakes effect in NEW terminals (or run: source ~/.zshrc / ~/.bashrc). Dangerous typed commands are blocked, asked about, or warned (per rule and machine mode) and reported to the fleet dashboard.\x1b[0m');
     if (wired === 0) {
         console.log('\x1b[33m⚠ Guard scripts written but no rc file was newly wired — check the entries above.\x1b[0m');
     }
 }
-/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux (or Git Bash on Windows) — remove the guard. */
 async function uninstallPosixShellGuardCommand() {
-    if (!isPosixPlatform()) {
+    if (!posixGuardSupported()) {
         console.log('Nothing to remove on this OS.');
         return;
     }
@@ -400,9 +564,10 @@ function refreshPosixShellGuardRules() {
         // logic of the build that wrote them — rewrite when the stamp is stale.
         if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH)) {
             const nodePath = process.execPath;
-            const cliEntry = process.argv[1] || '';
+            const cliEntry = (0, shellGuard_1.guardCliEntry)();
             (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 0o600);
-            (0, shellGuard_1.writeGuardArtifact)(GUARD_ZSH_PATH, buildGuardZsh(nodePath), 0o600);
+            if (process.platform !== 'win32')
+                (0, shellGuard_1.writeGuardArtifact)(GUARD_ZSH_PATH, buildGuardZsh(nodePath), 0o600);
             (0, shellGuard_1.writeGuardArtifact)(GUARD_BASH_PATH, buildGuardBash(nodePath), 0o600);
         }
     }

package/dist/commands/shellGuard.d.ts

@@ -27,11 +27,30 @@ export interface ShellGuardRule {
     /**
      * Per-rule enforcement action from the console (Local Safety). Absent =
      * 'block'. 'warn' → yellow notice, the command still runs (like monitor
-     * mode, but for this one rule). 'mask' is meaningless for a typed command
-     * and degrades to block.
+     * mode, but for this one rule). 'ask' → the guard pauses the typed line and
+     * asks the human at the keyboard (y / N / s = remember for this shell);
+     * declined, timed out, or no answerable terminal → block, never a silent
+     * allow. 'mask' is meaningless for a typed command and degrades to block.
      */
-    action?: 'block' | 'warn';
+    action?: ShellGuardAction;
 }
+export type ShellGuardAction = 'block' | 'warn' | 'ask';
+/**
+ * The CLI entry a planted guard should spawn for `flush-spool`. Resolved from
+ * THIS module's location (dist/commands -> dist/index.js), never from
+ * process.argv[1]: when the guard installer runs embedded in another process
+ * (daemon, test drill, host script), argv[1] is the HOST — baking it in would
+ * make every spooled event re-launch the host, hidden, recursively (a fork
+ * bomb that has frozen a developer machine). argv[1] is only a last resort
+ * when the packaged entry is not on disk.
+ */
+export declare function guardCliEntry(): string;
+/** Seconds a terminal "ask" prompt waits for an answer before it counts as declined. */
+export declare const SHELL_ASK_TIMEOUT_SECONDS = 30;
+/** How long "s = remember for this shell" lasts (capped — a forgotten window must not last forever). */
+export declare const SHELL_ASK_REMEMBER_HOURS = 12;
+/** Normalize a console action into what a typed-command guard can enforce. */
+export declare function toShellGuardAction(raw: unknown): ShellGuardAction;
 interface ShellGuardRulesFile {
     updatedAt: string;
     mode: 'block' | 'monitor';

package/dist/commands/shellGuard.js

@@ -33,10 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GUARD_BUILD_MARKER = void 0;
+exports.SHELL_ASK_REMEMBER_HOURS = exports.SHELL_ASK_TIMEOUT_SECONDS = exports.GUARD_BUILD_MARKER = void 0;
 exports.guardBuildStamp = guardBuildStamp;
 exports.guardArtifactStale = guardArtifactStale;
 exports.writeGuardArtifact = writeGuardArtifact;
+exports.guardCliEntry = guardCliEntry;
+exports.toShellGuardAction = toShellGuardAction;
 exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
@@ -127,6 +129,36 @@ function writeGuardArtifact(filePath, content, mode) {
     fs.writeFileSync(tmp, content, mode !== undefined ? { encoding: 'utf8', mode } : 'utf8');
     fs.renameSync(tmp, filePath);
 }
+/**
+ * The CLI entry a planted guard should spawn for `flush-spool`. Resolved from
+ * THIS module's location (dist/commands -> dist/index.js), never from
+ * process.argv[1]: when the guard installer runs embedded in another process
+ * (daemon, test drill, host script), argv[1] is the HOST — baking it in would
+ * make every spooled event re-launch the host, hidden, recursively (a fork
+ * bomb that has frozen a developer machine). argv[1] is only a last resort
+ * when the packaged entry is not on disk.
+ */
+function guardCliEntry() {
+    const packaged = path.join(__dirname, '..', 'index.js');
+    try {
+        if (fs.existsSync(packaged))
+            return packaged;
+    }
+    catch { /* fall through */ }
+    return process.argv[1] || '';
+}
+/** Seconds a terminal "ask" prompt waits for an answer before it counts as declined. */
+exports.SHELL_ASK_TIMEOUT_SECONDS = 30;
+/** How long "s = remember for this shell" lasts (capped — a forgotten window must not last forever). */
+exports.SHELL_ASK_REMEMBER_HOURS = 12;
+/** Normalize a console action into what a typed-command guard can enforce. */
+function toShellGuardAction(raw) {
+    if (raw === 'warn')
+        return 'warn';
+    if (raw === 'ask')
+        return 'ask';
+    return 'block';
+}
 /** Confine every lookahead to a single command segment (never span `;` `&` `|`). */
 const SEG = String.raw `[^;&|]*`;
 function compileSpec(spec) {
@@ -337,13 +369,14 @@ function cachedDisabledItemIds() {
     return disabled;
 }
 /**
- * Per-item enforcement actions from the cached local-safety snapshots. Only
- * 'warn' survives here: 'mask' cannot rewrite a typed command (degrades to
- * block by omission), and cross-snapshot conflicts resolve fail-strict — an
- * explicit 'block' anywhere wins over a 'warn' elsewhere.
+ * Per-item enforcement actions from the cached local-safety snapshots. 'warn'
+ * and 'ask' survive here; 'mask' cannot rewrite a typed command (degrades to
+ * block by omission). Cross-snapshot conflicts resolve fail-strict: an explicit
+ * 'block' anywhere wins over 'ask', which wins over 'warn'.
  */
 function cachedItemActions() {
     const warn = new Set();
+    const ask = new Set();
     const blocked = new Set();
     try {
         for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
@@ -359,6 +392,8 @@ function cachedItemActions() {
                         continue;
                     if (action === 'warn')
                         warn.add(itemId);
+                    else if (action === 'ask')
+                        ask.add(itemId);
                     else
                         blocked.add(itemId);
                 }
@@ -368,8 +403,12 @@ function cachedItemActions() {
     }
     catch { /* no snapshot cache yet */ }
     const result = new Map();
-    for (const itemId of warn) {
+    for (const itemId of ask) {
         if (!blocked.has(itemId))
+            result.set(itemId, 'ask');
+    }
+    for (const itemId of warn) {
+        if (!blocked.has(itemId) && !ask.has(itemId))
             result.set(itemId, 'warn');
     }
     return result;
@@ -398,8 +437,8 @@ function cachedCustomRules() {
                         pattern: escapeDotNetRegex(block.pattern.trim()),
                         reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
                         source: 'custom',
-                        // 'mask' cannot rewrite a typed command — only 'warn' relaxes here.
-                        ...(block.action === 'warn' ? { action: 'warn' } : {}),
+                        // 'mask' cannot rewrite a typed command — only 'warn' / 'ask' relax here.
+                        ...(block.action === 'warn' || block.action === 'ask' ? { action: block.action } : {}),
                     });
                 }
             }
@@ -423,7 +462,10 @@ function effectiveBuiltinRules() {
     const itemActions = cachedItemActions();
     return BUILTIN_RULES
         .filter(rule => !disabled.has(rule.id))
-        .map(rule => itemActions.get(rule.id) === 'warn' ? { ...rule, action: 'warn' } : rule);
+        .map(rule => {
+        const action = itemActions.get(rule.id);
+        return action ? { ...rule, action } : rule;
+    });
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
 function writeShellGuardRules() {
@@ -494,7 +536,7 @@ function refreshShellGuardRules() {
         // detection logic of the build that WROTE it. Rewrite when stale so new
         // shells load the current guard (rules refreshes alone never carry logic).
         if (guardArtifactStale(GUARD_PS1_PATH)) {
-            writeGuardArtifact(GUARD_PS1_PATH, buildGuardPs1(process.execPath, process.argv[1] || ''));
+            writeGuardArtifact(GUARD_PS1_PATH, buildGuardPs1(process.execPath, guardCliEntry()));
         }
     }
     catch { /* best-effort */ }
@@ -517,6 +559,10 @@ function buildGuardPs1(nodePath, cliEntry) {
         `$global:FcdCliEntry  = ${psQuote(cliEntry)}`,
         `$global:FcdGuardMode = 'monitor'`,
         `$global:FcdGuardRules = @()`,
+        `# "s = remember for this shell" answers: rule id -> expiry. Lives and dies with this PowerShell process.`,
+        `if ($null -eq $global:FcdAskRemembered) { $global:FcdAskRemembered = @{} }`,
+        `$global:FcdAskTimeoutSeconds = ${exports.SHELL_ASK_TIMEOUT_SECONDS}`,
+        `$global:FcdAskRememberHours = ${exports.SHELL_ASK_REMEMBER_HOURS}`,
         ``,
         `try {`,
         `  if (Test-Path $global:FcdRulesPath) {`,
@@ -530,7 +576,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `          Severity = [string]$_.severity`,
         `          Reason   = [string]$_.reason`,
         `          Source   = [string]$_.source`,
-        `          Action   = $(if ([string]$_.action -eq 'warn') { 'warn' } else { 'block' })`,
+        `          Action   = $(switch ([string]$_.action) { 'warn' { 'warn' } 'ask' { 'ask' } default { 'block' } })`,
         `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
         `        }`,
         `      } catch { $null }`,
@@ -571,6 +617,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
         `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
+        `  $askHit = $null`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
         `      # Built-in rules ask "can this text ACT?" — they see the execution`,
@@ -580,27 +627,71 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      $target = if ($isCustom) { $CommandLine } else { $execView }`,
         `      $targetNorm = if ($isCustom) { $normalized } else { $execNormalized }`,
         `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
-        `        # A block rule always outranks a warn rule matching the same line.`,
-        `        if ($rule.Action -ne 'warn') { return $rule }`,
-        `        if ($null -eq $warnHit) { $warnHit = $rule }`,
+        `        # Precedence on one line: block outranks ask, ask outranks warn.`,
+        `        if ($rule.Action -eq 'block') { return $rule }`,
+        `        if ($rule.Action -eq 'ask') { if ($null -eq $askHit) { $askHit = $rule } }`,
+        `        elseif ($null -eq $warnHit) { $warnHit = $rule }`,
         `      }`,
         `    } catch { }`,
         `  }`,
+        `  if ($null -ne $askHit) { return $askHit }`,
         `  return $warnHit`,
         `}`,
         ``,
+        `# Read one key for an "ask" prompt without going through PSReadLine (we are`,
+        `# inside its Enter handler, so the console input is ours). y / s / anything`,
+        `# else / timeout / no console => n. Never throws.`,
+        `function global:Read-FcdAskAnswer {`,
+        `  param([int]$TimeoutSeconds = 30)`,
+        `  try {`,
+        `    if ([Console]::IsInputRedirected) { return 'n' }`,
+        `    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)`,
+        `    while ((Get-Date) -lt $deadline) {`,
+        `      if ([Console]::KeyAvailable) {`,
+        `        $key = [Console]::ReadKey($true)`,
+        `        $char = ([string]$key.KeyChar).ToLowerInvariant()`,
+        `        if ($char -eq 'y') { return 'y' }`,
+        `        if ($char -eq 's') { return 's' }`,
+        `        return 'n'`,
+        `      }`,
+        `      Start-Sleep -Milliseconds 40`,
+        `    }`,
+        `    return 't'`,
+        `  } catch { }`,
+        `  return 'n'`,
+        `}`,
+        ``,
+        `# Is this ask rule already answered "s" in this shell (and not expired)?`,
+        `function global:Test-FcdAskRemembered {`,
+        `  param([string]$RuleId)`,
+        `  try {`,
+        `    $until = $global:FcdAskRemembered[$RuleId]`,
+        `    if ($null -ne $until -and $until -gt (Get-Date)) { return $true }`,
+        `    if ($null -ne $until) { $global:FcdAskRemembered.Remove($RuleId) }`,
+        `  } catch { }`,
+        `  return $false`,
+        `}`,
+        ``,
         `function global:Write-FcdGuardEvent {`,
-        `  param($Rule, [string]$CommandLine, [string]$Decision)`,
+        `  param($Rule, [string]$CommandLine, [string]$Decision, [string]$Developer = '')`,
         `  try {`,
         `    $evidence = $CommandLine.Trim()`,
         `    if ($evidence.Length -gt 180) { $evidence = $evidence.Substring(0, 180) + '...' }`,
-        `    $event = [pscustomobject]@{`,
+        `    # $Developer: '' (none) | 'confirmed' | 'remembered' | 'declined' | 'timeout'`,
+        `    $reason = 'Shell guard: ' + $Rule.Reason`,
+        `    switch ($Developer) {`,
+        `      'confirmed'  { $reason = 'developer confirmed in terminal prompt — ' + $reason }`,
+        `      'remembered' { $reason = 'developer confirmed earlier in this shell (session memory) — ' + $reason }`,
+        `      'declined'   { $reason = 'developer declined in terminal prompt — ' + $reason }`,
+        `      'timeout'    { $reason = 'developer confirmation not given (terminal prompt timed out) — ' + $reason }`,
+        `    }`,
+        `    $event = [ordered]@{`,
         `      eventId    = [guid]::NewGuid().ToString()`,
         `      type       = 'verdict'`,
         `      decision   = $Decision`,
         `      toolName   = 'powershell_terminal'`,
         `      operation  = 'shell_command'`,
-        `      reason     = ('Shell guard: ' + $Rule.Reason)`,
+        `      reason     = $reason`,
         `      ruleId     = $Rule.Id`,
         `      category   = $Rule.Category`,
         `      severity   = $Rule.Severity`,
@@ -608,6 +699,11 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      evidence   = $evidence`,
         `      occurredAt = (Get-Date).ToUniversalTime().ToString('o')`,
         `    }`,
+        `    if ($Developer -ne '') {`,
+        `      $event['approvalScope'] = 'developer'`,
+        `      if ($Developer -eq 'confirmed' -or $Developer -eq 'remembered') { $event['approvedBy'] = 'developer' }`,
+        `    }`,
+        `    $event = [pscustomobject]$event`,
         `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,
         `    [System.IO.File]::AppendAllText($global:FcdSpoolPath, (($event | ConvertTo-Json -Compress) + "\`n"), (New-Object System.Text.UTF8Encoding($false)))`,
         `    if ((Test-Path $global:FcdNodePath) -and (Test-Path $global:FcdCliEntry)) {`,
@@ -636,13 +732,53 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      # Cursor/VS Code terminals). InvokePrompt() re-renders the prompt+buffer`,
         `      # BELOW the message so the warning stays in the scrollback permanently.`,
         `      if ($global:FcdGuardMode -eq 'monitor') {`,
+        `        $would = if ($hit.Action -eq 'ask') { 'would ask you to confirm' } else { 'would block' }`,
         `        Write-Host ''`,
-        `        Write-Host ('[FullCourtDefense] monitor: would block [' + $hit.Severity + '] ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-Host ('[FullCourtDefense] monitor: ' + $would + ' [' + $hit.Severity + '] ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
         `        try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
         `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'warn'`,
         `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
         `        return`,
         `      }`,
+        `      # Per-rule 'ask' action from the console: pause the line and ask the`,
+        `      # human at the keyboard. y = run once, s = run + remember for this`,
+        `      # shell window, anything else / timeout = not executed. Every answer is`,
+        `      # reported to the fleet as a developer decision (same facts as the IDE`,
+        `      # prompt). No answerable console => block, never a silent allow.`,
+        `      if ($hit.Action -eq 'ask') {`,
+        `        if (Test-FcdAskRemembered -RuleId ([string]$hit.Id)) {`,
+        `          Write-Host ''`,
+        `          Write-Host ('[FullCourtDefense] allowed — you confirmed rule ' + $hit.Id + ' earlier in this shell.') -ForegroundColor DarkGray`,
+        `          try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
+        `          Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow' -Developer 'remembered'`,
+        `          [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `          return`,
+        `        }`,
+        `        Write-Host ''`,
+        `        Write-Host ('[FullCourtDefense] ASK [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-Host ('Run anyway?  [y] yes   [s] yes, remember for this shell   [N] no   (' + $global:FcdAskTimeoutSeconds + 's): ') -NoNewline`,
+        `        $answer = Read-FcdAskAnswer -TimeoutSeconds $global:FcdAskTimeoutSeconds`,
+        `        if ($answer -eq 'y' -or $answer -eq 's') {`,
+        `          if ($answer -eq 's') {`,
+        `            $global:FcdAskRemembered[[string]$hit.Id] = (Get-Date).AddHours($global:FcdAskRememberHours)`,
+        `            Write-Host 'yes — remembered for this shell. Reported to your security dashboard as allowed by you.' -ForegroundColor Green`,
+        `          } else {`,
+        `            Write-Host 'yes — reported to your security dashboard as allowed by you.' -ForegroundColor Green`,
+        `          }`,
+        `          try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
+        `          Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow' -Developer 'confirmed'`,
+        `          [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `          return`,
+        `        }`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
+        `        $outcome = if ($answer -eq 't') { 'timeout' } else { 'declined' }`,
+        `        Write-Host $(if ($outcome -eq 'timeout') { 'no answer' } else { 'no' }) -ForegroundColor Red`,
+        `        Write-Host ('This command was not executed (' + $outcome + '). Reported to your security dashboard.') -ForegroundColor DarkGray`,
+        `        try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block' -Developer $outcome`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `        return`,
+        `      }`,
         `      # Per-rule 'warn' action from the console: notice + the command runs.`,
         `      if ($hit.Action -eq 'warn') {`,
         `        Write-Host ''`,
@@ -830,7 +966,7 @@ async function installShellGuardCommand(args = {}) {
     }
     const rules = writeShellGuardRules();
     const nodePath = process.execPath;
-    const cliEntry = process.argv[1] || '';
+    const cliEntry = guardCliEntry();
     fs.writeFileSync(GUARD_PS1_PATH, buildGuardPs1(nodePath, cliEntry), 'utf8');
     console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
     if (args.profiles === 'false') {

package/dist/index.js

@@ -822,6 +822,12 @@ async function main() {
             if (process.platform === 'win32') {
                 const { installShellGuardCommand } = await Promise.resolve().then(() => __importStar(require('./commands/shellGuard')));
                 await installShellGuardCommand({ profiles: flags.profiles });
+                // Git Bash (MSYS2) on Windows gets the bash guard too — same rules file.
+                const { installPosixShellGuardCommand, detectGitBash } = await Promise.resolve().then(() => __importStar(require('./commands/posixShellGuard')));
+                if (detectGitBash()) {
+                    console.log('\n\x1b[1mGit Bash detected — installing the bash guard as well…\x1b[0m');
+                    await installPosixShellGuardCommand({ profiles: flags.profiles });
+                }
             }
             else {
                 const { installPosixShellGuardCommand } = await Promise.resolve().then(() => __importStar(require('./commands/posixShellGuard')));
@@ -833,6 +839,9 @@ async function main() {
             if (process.platform === 'win32') {
                 const { uninstallShellGuardCommand } = await Promise.resolve().then(() => __importStar(require('./commands/shellGuard')));
                 await uninstallShellGuardCommand();
+                const { uninstallPosixShellGuardCommand, posixGuardSupported } = await Promise.resolve().then(() => __importStar(require('./commands/posixShellGuard')));
+                if (posixGuardSupported())
+                    await uninstallPosixShellGuardCommand();
             }
             else {
                 const { uninstallPosixShellGuardCommand } = await Promise.resolve().then(() => __importStar(require('./commands/posixShellGuard')));
@@ -850,6 +859,15 @@ async function main() {
                 }
                 if (status.rulesPresent)
                     console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+                const { getPosixShellGuardStatus, detectGitBash } = await Promise.resolve().then(() => __importStar(require('./commands/posixShellGuard')));
+                const gitBash = detectGitBash();
+                if (gitBash) {
+                    const posix = getPosixShellGuardStatus();
+                    console.log(`\nInteractive Git Bash guard: ${posix.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'} \x1b[2m(${gitBash})\x1b[0m`);
+                    for (const rc of posix.rcFiles) {
+                        console.log(`  ${rc.shell}: ${rc.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${rc.rcPath}\x1b[0m`);
+                    }
+                }
                 console.log('');
                 break;
             }
@@ -898,7 +916,10 @@ async function main() {
                 const matches = evaluateShellCommand(cmd, rules);
                 if (matches.length)
                     blocked++;
-                return { command: cmd, blocked: matches.length > 0, matches: matches.map(m => ({ ruleId: m.rule.id, severity: m.rule.severity, category: m.rule.category, reason: m.rule.reason, segment: m.segment })) };
+                // The action the terminal guard would take: block > ask > warn across matches.
+                const actions = matches.map(m => m.rule.action || 'block');
+                const action = actions.includes('block') ? 'block' : actions.includes('ask') ? 'ask' : actions.length ? 'warn' : undefined;
+                return { command: cmd, blocked: matches.length > 0, action, matches: matches.map(m => ({ ruleId: m.rule.id, severity: m.rule.severity, category: m.rule.category, action: m.rule.action || 'block', reason: m.rule.reason, segment: m.segment })) };
             });
             if (asJson) {
                 console.log(JSON.stringify({ total: cmds.length, blocked, ruleCount: rules.length, results }, null, 2));
@@ -908,8 +929,9 @@ async function main() {
                 for (const r of results) {
                     if (r.blocked) {
                         const m = r.matches[0];
-                        console.log(`  \x1b[31mBLOCK\x1b[0m [\x1b[1m${m.severity}\x1b[0m] ${r.command}`);
-                        console.log(`        \x1b[2m${m.reason} (rule ${m.ruleId})${r.matches.length > 1 ? ` +${r.matches.length - 1} more` : ''}\x1b[0m`);
+                        const label = r.action === 'ask' ? '\x1b[33mASK  \x1b[0m' : r.action === 'warn' ? '\x1b[33mWARN \x1b[0m' : '\x1b[31mBLOCK\x1b[0m';
+                        console.log(`  ${label} [\x1b[1m${m.severity}\x1b[0m] ${r.command}`);
+                        console.log(`        \x1b[2m${m.reason} (rule ${m.ruleId})${r.matches.length > 1 ? ` +${r.matches.length - 1} more` : ''}${r.action === 'ask' ? ' — asks you to confirm in the terminal' : r.action === 'warn' ? ' — runs with a warning' : ''}\x1b[0m`);
                     }
                     else {
                         console.log(`  \x1b[32mALLOW\x1b[0m ${r.command}`);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.27.4"
+  "version": "1.28.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.27.4",
+  "version": "1.28.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -78,6 +78,7 @@
     "test:offline-policy": "npm run build && node scripts/test-offline-policy-enforcement.js",
     "test:developer-confirmation": "npm run build && node scripts/test-developer-confirmation.js",
     "test:local-safety-ask": "npm run build && node scripts/test-local-safety-ask.js",
+    "test:terminal-mcp-ask": "npm run build && node scripts/test-terminal-mcp-ask.js",
     "test:demo-actions": "npm run build && node scripts/test-demo-actions.js",
     "test:real-scenario": "npm run build && node scripts/test-real-scenario-drill.js",
     "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",