fullcourtdefense-cli 1.27.4 → 1.29.0

package/dist/commands/cmdGuard.d.ts

@@ -1,3 +1,13 @@
+/**
+ * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that
+ * are cheap enough to wrap in cmd: `gh`, `vault`, `security`, … — derived, not
+ * hand-listed, so a new shared rule reaches cmd's index automatically unless
+ * its command is on the high-frequency diet above. cmd stays PARTIAL by
+ * construction (first token only, no `git`/`kubectl`/`aws` wrappers); the
+ * console labels it that way.
+ */
+export declare const INTERCEPTED_COMMANDS: string[];
+export declare function buildGuardJs(nodePath: string, cliEntry: string): string;
 export interface CmdGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/cmdGuard.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERCEPTED_COMMANDS = void 0;
+exports.buildGuardJs = buildGuardJs;
 exports.isCmdGuardInstalled = isCmdGuardInstalled;
 exports.getCmdGuardStatus = getCmdGuardStatus;
 exports.installCmdGuardCommand = installCmdGuardCommand;
@@ -74,7 +76,7 @@ const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
  * so pipes/`&&` chains where the dangerous command is not first are NOT caught by
  * cmd (they ARE under PowerShell/zsh/bash and `shell-guard-check`).
  */
-const INTERCEPTED_COMMANDS = [
+const FIXED_INTERCEPTED_COMMANDS = [
     // Destructive filesystem / disk / permission tampering
     'del', 'erase', 'rd', 'rmdir', 'format', 'cipher', 'diskpart', 'fsutil',
     'takeown', 'icacls', 'attrib', 'compact',
@@ -96,8 +98,25 @@ const INTERCEPTED_COMMANDS = [
  * Coverage is NOT lost where it matters: agent-driven commands go through the
  * IDE hooks (full ruleset, any position in the line), and humans typing in
  * PowerShell are covered in-process by the PSReadLine guard. Interactive
- * cmd.exe keeps only the rare, high-signal destructive/tamper commands above.
+ * cmd.exe keeps only the rare, high-signal destructive/tamper commands above
+ * plus the low-frequency anchors of the shared command rules (below).
  */
+const CMD_HIGH_FREQUENCY_COMMANDS = new Set([
+    'docker', 'git', 'kubectl', 'aws', 'gcloud', 'az', 'terraform', 'pulumi', 'wsl',
+    'curl', 'wget', 'taskkill', 'robocopy', 'xcopy', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
+]);
+/**
+ * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that
+ * are cheap enough to wrap in cmd: `gh`, `vault`, `security`, … — derived, not
+ * hand-listed, so a new shared rule reaches cmd's index automatically unless
+ * its command is on the high-frequency diet above. cmd stays PARTIAL by
+ * construction (first token only, no `git`/`kubectl`/`aws` wrappers); the
+ * console labels it that way.
+ */
+exports.INTERCEPTED_COMMANDS = Array.from(new Set([
+    ...FIXED_INTERCEPTED_COMMANDS,
+    ...(0, shellGuard_1.builtinRuleCommandNames)().filter(name => !CMD_HIGH_FREQUENCY_COMMANDS.has(name)),
+]));
 function regString(key, value) {
     try {
         const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
@@ -127,16 +146,25 @@ function buildGuardJs(nodePath, cliEntry) {
         `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `const ASK_TIMEOUT_S=${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS};const ASK_REMEMBER_MS=${shellGuard_1.SHELL_ASK_REMEMBER_HOURS}*3600*1000;`,
+        `// "s = remember for this cmd window": keyed by the parent cmd.exe pid (doskey runs us directly under it); dies with the window, capped in time.`,
+        `const ASK_MEMORY_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense'))}+'/cmd-ask-'+process.ppid+'.json';`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Precedence on one line: block outranks ask, ask outranks warn.`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
         `// made the user's terminal wait for a full CLI process INCLUDING the network`,
         `// flush after every finding. Monitor mode must never add synchronous latency.`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `function askRemembered(ruleId){try{const m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'));const until=m&&m[ruleId];return typeof until==='number'&&until>Date.now();}catch{return false;}}`,
+        `function rememberAsk(ruleId){try{let m={};try{m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'))||{};}catch{}m[ruleId]=Date.now()+ASK_REMEMBER_MS;fs.mkdirSync(path.dirname(ASK_MEMORY_PATH),{recursive:true});fs.writeFileSync(ASK_MEMORY_PATH,JSON.stringify(m),{encoding:'utf8',mode:0o600});}catch{}}`,
+        `// One key via choice.exe (ships with Windows): Y run once, S run + remember for this window, N / timeout not executed. FCD_ASK_TEST_ANSWER overrides for the drill.`,
+        `function askDeveloper(hit){const forced=process.env.FCD_ASK_TEST_ANSWER;if(forced)return forced;try{const r=spawnSync('choice',['/c','YSN','/n','/t',String(ASK_TIMEOUT_S),'/d','N','/m','Run anyway?  [Y] yes   [S] yes, remember for this cmd window   [N] no   ('+ASK_TIMEOUT_S+'s):'],{stdio:'inherit',windowsHide:true});if(r.status===1)return 'y';if(r.status===2)return 's';if(r.status===3)return 'n';}catch{}return 'n';}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
         // TOP-LEVEL FAIL-OPEN: any unexpected exception in rule loading/matching
@@ -144,8 +172,15 @@ function buildGuardJs(nodePath, cliEntry) {
         // delegate. A stack trace or nonzero exit here IS an outage for the shell.
         `const line=args.join(' ');let mode='monitor';let hit=null;try{const r=loadRules();mode=r.mode;hit=matchLine(line,r.rules);}catch{hit=null;}`,
         `if(!hit)delegate(args);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
+        `if(hit.action==='ask'){`,
+        `  if(askRemembered(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this cmd window.');spoolEvent(hit,line,'allow','remembered');delegate(args);}`,
+        `  console.error('[FullCourtDefense] ASK ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
+        `  const a=askDeveloper(hit);`,
+        `  if(a==='y'||a==='s'){if(a==='s')rememberAsk(hit.id);console.error('[FullCourtDefense] yes'+(a==='s'?' — remembered for this cmd window.':'')+' Reported to your security dashboard as allowed by you.');spoolEvent(hit,line,'allow','confirmed');delegate(args);}`,
+        `  const outcome=a==='t'?'timeout':'declined';console.error('[FullCourtDefense] '+(outcome==='timeout'?'no answer':'no')+' — this command was not executed ('+outcome+'). Reported to your security dashboard.');spoolEvent(hit,line,'block',outcome);process.exit(1);`,
+        `}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(1);`,
@@ -163,7 +198,7 @@ function buildGuardJs(nodePath, cliEntry) {
 function buildMacroFile(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);
     const node = batQuote(nodePath);
-    return `${INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
+    return `${exports.INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
 }
 function buildAutorunBat(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);
@@ -263,7 +298,7 @@ async function installCmdGuardCommand(_args = {}) {
     }
     const rules = (0, shellGuard_1.writeShellGuardRules)();
     const nodePath = process.execPath;
-    const cliEntry = process.argv[1] || '';
+    const cliEntry = (0, shellGuard_1.guardCliEntry)();
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 'utf8');
     // Macro file BEFORE the bat: the bat refuses to register macros without it,
     // so this order can never leave a window where cmd.exe sources a bat whose
@@ -324,7 +359,7 @@ function refreshCmdGuardRules() {
         // registering no macros at all. This is the only path that repairs that.
         if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH) || !fs.existsSync(MACRO_FILE_PATH)) {
             const nodePath = process.execPath;
-            (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, process.argv[1] || ''));
+            (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, (0, shellGuard_1.guardCliEntry)()));
             (0, shellGuard_1.writeGuardArtifact)(MACRO_FILE_PATH, buildMacroFile(nodePath));
             (0, shellGuard_1.writeGuardArtifact)(AUTORUN_BAT_PATH, buildAutorunBat(nodePath));
         }

package/dist/commands/deterministicGuard.d.ts

@@ -69,6 +69,41 @@ export interface LocalSafetyScanOptions {
      */
     trustedScriptPaths?: string[];
 }
+/**
+ * Built-ins that ship OFF until an org switches them on in the console. Shared
+ * with the terminal guards so a machine with no snapshot yet (fresh install,
+ * wiped cache) enforces the SAME default set in the IDE and in a shell.
+ */
+export declare const DEFAULT_DISABLED_BUILT_INS: ReadonlySet<string>;
+/**
+ * One command rule shared by EVERY surface that can see a typed command: the
+ * IDE/agent hooks (this module), the PowerShell / bash / zsh profile guards and
+ * the cmd.exe doskey guard (shellGuard.ts loads this table into the terminal
+ * rule file verbatim). `pattern` is a regex SOURCE that must compile — and
+ * mean the same thing — under both JS and .NET with IgnoreCase: `\b`, `\s`,
+ * `(?:…)`, lookaheads and `[^\n;|&]` only. No lookbehind, no named groups,
+ * no `\d`-class differences. `commands` are the leading binaries a rule can
+ * fire on — the only thing a first-token hook (doskey) can key on.
+ */
+export interface SharedCommandRule {
+    itemId: string;
+    /** Catalog category id (local-safety-catalog.ts). */
+    categoryId: 'credential_commands';
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    pattern: string;
+    reason: string;
+    /** Leading command names this rule anchors on (for name-keyed hooks such as cmd.exe doskey). */
+    commands: string[];
+}
+/**
+ * Commands that PRINT stored credentials to stdout — the file-path rules are
+ * useless against them because the secret never comes from a watched file
+ * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
+ * rarely-legitimate-for-agents forms are on by default; cloud token printers
+ * that legitimate deploy tooling uses constantly are strict (off by default,
+ * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
+ */
+export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
@@ -189,7 +190,12 @@ const SQL_KEYS = new Set([
     'toolArgs.query',
     'toolArgs.sql',
 ]);
-const DEFAULT_DISABLED_BUILT_INS = new Set([
+/**
+ * Built-ins that ship OFF until an org switches them on in the console. Shared
+ * with the terminal guards so a machine with no snapshot yet (fresh install,
+ * wiped cache) enforces the SAME default set in the IDE and in a shell.
+ */
+exports.DEFAULT_DISABLED_BUILT_INS = new Set([
     'git_clean_force',
     'generic_kubectl_delete',
     'truncate_table',
@@ -413,7 +419,7 @@ function collectStrings(value, keyPath = 'args', out = [], depth = 0) {
     return out;
 }
 function disabled(options) {
-    return new Set(options?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS));
+    return new Set(options?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS));
 }
 function isEnabled(itemId, options) {
     return !disabled(options).has(itemId);
@@ -587,39 +593,47 @@ function containsSensitiveCredentialPath(value) {
  * useless against them because the secret never comes from a watched file
  * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
  * rarely-legitimate-for-agents forms are on by default; cloud token printers
- * that legitimate deploy tooling uses constantly are strict (off by default).
+ * that legitimate deploy tooling uses constantly are strict (off by default,
+ * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
+exports.CREDENTIAL_COMMAND_RULES = [
+    { itemId: 'gh_auth_token_cmd', categoryId: 'credential_commands', severity: 'critical', commands: ['gh'],
+        reason: 'GitHub CLI token print (gh auth token)',
+        pattern: String.raw `\bgh\s+auth\s+token\b|\bgh\s+auth\s+status\b(?=[^\n;|&]*(?:--show-token|\s-t\b))` },
+    { itemId: 'git_credential_fill', categoryId: 'credential_commands', severity: 'critical', commands: ['git'],
+        reason: 'git credential helper dump',
+        pattern: String.raw `\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b` },
+    { itemId: 'macos_keychain_dump', categoryId: 'credential_commands', severity: 'critical', commands: ['security'],
+        reason: 'macOS keychain password dump',
+        pattern: String.raw `\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b|\bsecurity\s+dump-keychain\b` },
+    { itemId: 'kubectl_config_raw', categoryId: 'credential_commands', severity: 'high', commands: ['kubectl'],
+        reason: 'raw kubeconfig dump (kubectl config view --raw)',
+        pattern: String.raw `\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b` },
+    { itemId: 'aws_export_credentials', categoryId: 'credential_commands', severity: 'critical', commands: ['aws'],
+        reason: 'AWS secret access key export',
+        pattern: String.raw `\baws\s+configure\s+export-credentials\b|\baws\s+configure\s+get\b[^\n;|&]*secret` },
+    { itemId: 'gcloud_access_token_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['gcloud'],
+        reason: 'gcloud access-token print',
+        pattern: String.raw `\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b` },
+    { itemId: 'gcloud_secret_access_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['gcloud'],
+        reason: 'GCP Secret Manager read',
+        pattern: String.raw `\bgcloud\s+secrets\s+versions\s+access\b` },
+    { itemId: 'az_access_token_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['az'],
+        reason: 'Azure access-token print',
+        pattern: String.raw `\baz\s+account\s+get-access-token\b` },
+    { itemId: 'aws_secret_fetch_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['aws'],
+        reason: 'AWS secret fetch',
+        pattern: String.raw `\baws\s+secretsmanager\s+get-secret-value\b|\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b` },
+    { itemId: 'vault_read_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['vault'],
+        reason: 'Vault secret read',
+        pattern: String.raw `\bvault\s+(?:kv\s+get|read)\b` },
+];
+const CREDENTIAL_COMMAND_REGEXES = exports.CREDENTIAL_COMMAND_RULES.map(rule => ({ rule, re: new RegExp(rule.pattern, 'i') }));
 function credentialCommandReason(value) {
-    return matchCommand(value, (_text, lower) => {
-        if (/\bgh\s+auth\s+token\b/.test(lower) || (/\bgh\s+auth\s+status\b/.test(lower) && /(?:--show-token|\s-t\b)/.test(lower))) {
-            return { itemId: 'gh_auth_token_cmd', reason: 'GitHub CLI token print (gh auth token)' };
-        }
-        if (/\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b/.test(lower)) {
-            return { itemId: 'git_credential_fill', reason: 'git credential helper dump' };
-        }
-        if (/\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b/.test(lower) || /\bsecurity\s+dump-keychain\b/.test(lower)) {
-            return { itemId: 'macos_keychain_dump', reason: 'macOS keychain password dump' };
-        }
-        if (/\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b/.test(lower)) {
-            return { itemId: 'kubectl_config_raw', reason: 'raw kubeconfig dump (kubectl config view --raw)' };
-        }
-        if (/\baws\s+configure\s+export-credentials\b/.test(lower) || /\baws\s+configure\s+get\b[^\n;|&]*secret/.test(lower)) {
-            return { itemId: 'aws_export_credentials', reason: 'AWS secret access key export' };
-        }
-        if (/\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b/.test(lower)) {
-            return { itemId: 'gcloud_access_token_cmd', reason: 'gcloud access-token print' };
-        }
-        if (/\bgcloud\s+secrets\s+versions\s+access\b/.test(lower)) {
-            return { itemId: 'gcloud_secret_access_cmd', reason: 'GCP Secret Manager read' };
-        }
-        if (/\baz\s+account\s+get-access-token\b/.test(lower)) {
-            return { itemId: 'az_access_token_cmd', reason: 'Azure access-token print' };
-        }
-        if (/\baws\s+secretsmanager\s+get-secret-value\b/.test(lower) || /\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b/.test(lower)) {
-            return { itemId: 'aws_secret_fetch_cmd', reason: 'AWS secret fetch' };
-        }
-        if (/\bvault\s+(?:kv\s+get|read)\b/.test(lower)) {
-            return { itemId: 'vault_read_cmd', reason: 'Vault secret read' };
+    return matchCommand(value, text => {
+        for (const { rule, re } of CREDENTIAL_COMMAND_REGEXES) {
+            if (re.test(text))
+                return { itemId: rule.itemId, reason: rule.reason };
         }
         return undefined;
     });
@@ -1190,7 +1204,7 @@ function scanReferencedScript(command, cwd, options) {
         while (finding
             && (finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf')
             && !scriptActsOnFinding(content, finding.category)) {
-            const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+            const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS);
             scanOptions = { ...(scanOptions || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
             finding = scanTextValue('script_file', content, scanOptions);
         }
@@ -1212,7 +1226,7 @@ function withRuleSuppressed(options, finding) {
             customBlocks: (options?.customBlocks || []).filter(block => block.id !== finding.itemId),
         };
     }
-    const baseDisabled = options?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+    const baseDisabled = options?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS);
     return { ...(options || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
 }
 function findingAction(finding) {

package/dist/commands/installAll.js

@@ -126,10 +126,12 @@ async function installAllCommand(args, config) {
         }
     }
     // Interactive macOS/Linux guard — same rules, zsh accept-line widget + bash
-    // function wrappers, from the local cache (no admin, no network hot path).
-    // Gated to darwin/linux so Windows install-all behavior is unchanged.
-    if ((process.platform === 'darwin' || process.platform === 'linux') && args.posixGuard !== 'false') {
-        console.log('\n\x1b[1mInstalling interactive shell guard (bash + zsh)…\x1b[0m');
+    // DEBUG-trap hook, from the local cache (no admin, no network hot path). On
+    // Windows the same bash guard covers Git Bash (MSYS2) when it is installed.
+    if ((0, posixShellGuard_1.posixGuardSupported)() && args.posixGuard !== 'false') {
+        console.log(process.platform === 'win32'
+            ? '\n\x1b[1mGit Bash detected — installing interactive shell guard (bash)…\x1b[0m'
+            : '\n\x1b[1mInstalling interactive shell guard (bash + zsh)…\x1b[0m');
         try {
             await (0, posixShellGuard_1.installPosixShellGuardCommand)();
         }

package/dist/commands/mcpGateway.js

@@ -67,6 +67,7 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const machineIdentity_1 = require("../machineIdentity");
 const backupManifest_1 = require("../backupManifest");
+const devConfirm_1 = require("../devConfirm");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
 const INSTALL_GATEWAY_ARGS = { includeShieldKey: false };
@@ -876,6 +877,8 @@ function blockError(message) {
 function isBlockError(err) {
     return err instanceof Error && err.fcdDeliberateBlock === true;
 }
+/** How long an MCP elicitation ("Ask the developer" dialog in the client) waits before it counts as declined. */
+const ELICITATION_TIMEOUT_MS = 5 * 60_000;
 class McpGatewayServer {
     gatewayConfig;
     downstreamSpec;
@@ -883,6 +886,20 @@ class McpGatewayServer {
     downstreamReady;
     buffer = '';
     api;
+    /**
+     * The MCP client declared `capabilities.elicitation` on initialize — it can
+     * show the user a server-initiated question. That is the only channel a stdio
+     * proxy has to "Ask the developer"; without it an ask rule fails strict.
+     */
+    clientSupportsElicitation = false;
+    /** Server -> client requests (elicitation) awaiting the client's response, by id. */
+    clientPending = new Map();
+    clientRequestSeq = 0;
+    /**
+     * "Remember for this session" scope when the client passes no session id: the
+     * gateway process lives exactly as long as the client's MCP session does.
+     */
+    gatewaySessionId = `gateway-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
     constructor(gatewayConfig, downstreamSpec) {
         this.gatewayConfig = gatewayConfig;
         this.downstreamSpec = downstreamSpec;
@@ -924,10 +941,29 @@ class McpGatewayServer {
         // id may legally be 0 or "" — only a genuinely ABSENT id marks a notification.
         if ((message.id === undefined || message.id === null) && message.method?.startsWith('notifications/'))
             return;
+        // A RESPONSE from the client to one of OUR requests (elicitation): no
+        // method, an id we issued. Route it to the waiter instead of the -32601 path.
+        if (!message.method && message.id !== undefined && message.id !== null && ('result' in message || 'error' in message)) {
+            const waiter = this.clientPending.get(String(message.id));
+            if (waiter) {
+                clearTimeout(waiter.timer);
+                this.clientPending.delete(String(message.id));
+                waiter.resolve(message);
+            }
+            return;
+        }
         try {
             if (message.method === 'initialize') {
+                const caps = message.params?.capabilities;
+                this.clientSupportsElicitation = Boolean(caps && typeof caps === 'object' && caps.elicitation !== undefined && caps.elicitation !== null);
+                // Echo the client's own protocol version (it necessarily supports it);
+                // elicitation is a 2025-06-18+ feature, but the capability flag — not
+                // the version string — is what tells us the client can show a dialog.
+                const requested = typeof message.params?.protocolVersion === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(message.params.protocolVersion)
+                    ? message.params.protocolVersion
+                    : '2024-11-05';
                 this.respond(message.id, {
-                    protocolVersion: '2024-11-05',
+                    protocolVersion: requested,
                     capabilities: { tools: {} },
                     serverInfo: { name: 'agentguard-mcp-gateway', version: '0.1.0' },
                 });
@@ -1099,12 +1135,77 @@ class McpGatewayServer {
                 this.spoolLocalFinding(warning, toolName, operation, 'warn');
                 process.stderr.write(`FullCourtDefense warning (${warning.itemId}): ${warning.reason}\n`);
             }
-            // The gateway is a stdio proxy with no developer prompt of its own — an
-            // "Ask the developer" rule fails strict here (block), never a silent allow.
-            const localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
+            // "Ask the developer" rule with no hard block on the same call: ask the
+            // human through the MCP client (elicitation) when the client can show a
+            // dialog and a human is present. Session memory reuses the IDE hook's
+            // ledger (same tool + rule => remembered). Decline, cancel, timeout, a
+            // client without elicitation, or no human => block, never a silent allow.
+            let localBlock = requestOutcome.blockingFinding || requestOutcome.askFinding;
+            let askNote = '';
+            if (!requestOutcome.blockingFinding && requestOutcome.askFinding && !reportOnlyMode) {
+                const ask = requestOutcome.askFinding;
+                const origin = ask.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+                const rememberScope = { toolName, operation: operation || (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs).operation, policyId: `local-safety:${ask.itemId}`, matchedRule: ask.ruleId };
+                const sessionId = runtimeSessionId() || this.gatewaySessionId;
+                const remembered = (0, devConfirm_1.isConfirmationRemembered)(rememberScope, sessionId);
+                if (remembered) {
+                    (0, telemetry_1.spoolEvent)({
+                        decision: 'allow', toolName, operation: rememberScope.operation,
+                        reason: `developer confirmed earlier this session (session memory) — ${ask.reason}`,
+                        ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                        evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                        approvalScope: 'developer', approvedBy: 'developer',
+                    });
+                    (0, telemetry_1.triggerFlush)(false);
+                    localBlock = undefined;
+                }
+                else if (this.clientSupportsElicitation && (0, devConfirm_1.isHumanPresent)()) {
+                    const digest = (0, devConfirm_1.actionDigest)(toolArgs);
+                    const marker = (0, devConfirm_1.raiseDeveloperConfirmation)({
+                        event: 'mcp_gateway', toolName, operation: rememberScope.operation, argsDigest: digest,
+                        policyId: rememberScope.policyId, policyName: `Local Safety: ${ask.itemId}`, matchedRule: ask.ruleId,
+                        sessionId, remember: 'none',
+                    });
+                    process.stderr.write(`FullCourtDefense asking the developer to confirm ${toolName}: ${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId})\n`);
+                    const answer = await this.elicitDeveloperConfirmation({ toolName, reason: ask.reason, ruleLabel: `${origin} "${ask.itemId}" (${ask.ruleId})`, evidence: ask.evidence });
+                    if (answer.answer === 'accept') {
+                        // Settle through the shared ledger so "remember for this session" is
+                        // recorded exactly like an IDE approval would be.
+                        if (answer.remember)
+                            (0, devConfirm_1.raiseDeveloperConfirmation)({ ...marker, remember: 'session' });
+                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        (0, telemetry_1.spoolEvent)({
+                            decision: 'allow', toolName, operation: rememberScope.operation,
+                            reason: `developer confirmed in MCP client prompt${answer.remember ? ' (remembered for this session)' : ''} — ${ask.reason}`,
+                            ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                            evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                            approvalScope: 'developer', approvedBy: 'developer', confirmLatencyMs: answer.latencyMs,
+                        });
+                        (0, telemetry_1.triggerFlush)(false);
+                        localBlock = undefined;
+                    }
+                    else {
+                        (0, devConfirm_1.settleDeveloperConfirmation)('mcp_gateway', toolName, digest);
+                        const how = answer.answer === 'timeout' ? 'developer confirmation not given (prompt timed out)' : 'developer declined in MCP client prompt';
+                        (0, telemetry_1.spoolEvent)({
+                            decision: 'block', toolName, operation: rememberScope.operation,
+                            reason: `${how} — ${ask.reason}`,
+                            ruleId: ask.ruleId, category: ask.category, categoryId: ask.categoryId, itemId: ask.itemId, source: ask.source,
+                            evidence: ask.evidence, policyHash: ask.policyHash, offlineEnforced: true,
+                            approvalScope: 'developer', confirmLatencyMs: answer.latencyMs,
+                        });
+                        (0, telemetry_1.triggerFlush)(true);
+                        throw blockError(`${ask.reason} (${origin} "${ask.itemId}", ${ask.ruleId}: ${ask.evidence}) — ${answer.answer === 'timeout' ? 'you did not answer the confirmation prompt in time' : 'you declined the confirmation prompt'}, so this tool call was not executed. Logged to your org's console. This is a security policy decision, not a transient error — do not retry.`);
+                    }
+                }
+                else {
+                    askNote = this.clientSupportsElicitation
+                        ? ' This rule asks the developer to confirm, but no human is present on this machine (CI / ephemeral workload), so it blocks here.'
+                        : ' This rule asks the developer to confirm; this MCP client cannot show a confirmation dialog (no elicitation support), so it blocks here (the IDE hook can ask).';
+                }
+            }
             if (localBlock) {
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
-                const askNote = !requestOutcome.blockingFinding ? ' This rule asks the developer to confirm; the MCP gateway cannot prompt, so it blocks here (the IDE hook can ask).' : '';
                 if (reportOnlyMode) {
                     // MONITOR CONTRACT: a monitor/shadow machine (or one with no bundle
                     // signal at all) must NEVER hard-block. Online, the server already
@@ -1112,8 +1213,9 @@ class McpGatewayServer {
                     // the client-side belt for offline/no-cache/stale-cache states,
                     // where the scan can still yield block-action findings. Record the
                     // would-block and let the call through.
+                    const would = requestOutcome.blockingFinding ? 'would block' : 'would ask you to confirm';
                     this.spoolLocalFinding({ ...localBlock, reason: `[monitor] ${localBlock.reason}` }, toolName, operation, 'warn');
-                    process.stderr.write(`FullCourtDefense (monitor) would block ${toolName}: ${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId})\n`);
+                    process.stderr.write(`FullCourtDefense (monitor) ${would} ${toolName}: ${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId})\n`);
                 }
                 else {
                     this.spoolLocalFinding(localBlock, toolName, operation);
@@ -1614,6 +1716,63 @@ class McpGatewayServer {
     error(id, code, message) {
         process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, error: { code, message } })}\n`);
     }
+    /**
+     * Server -> client JSON-RPC request (MCP lets servers ask the client for
+     * things: elicitation, sampling, roots). Resolves with the client's response
+     * message; a timeout resolves to `undefined`. Never rejects.
+     */
+    requestClient(method, params, timeoutMs) {
+        const id = `fcd-${++this.clientRequestSeq}`;
+        return new Promise(resolve => {
+            const timer = setTimeout(() => {
+                this.clientPending.delete(id);
+                resolve(undefined);
+            }, timeoutMs);
+            this.clientPending.set(id, { resolve, timer });
+            process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`);
+        });
+    }
+    /**
+     * "Ask the developer" through the MCP client. Shows the same question the IDE
+     * hook would: what is about to run, which rule asked, yes / no, and an
+     * optional "remember for this session". Returns the human's answer; anything
+     * that is not an explicit accept (decline, cancel, timeout, malformed) is a
+     * decline. The caller decides what a decline means (block).
+     */
+    async elicitDeveloperConfirmation(input) {
+        const started = Date.now();
+        const evidence = input.evidence ? `\n\nEvidence: ${input.evidence.slice(0, 240)}` : '';
+        const response = await this.requestClient('elicitation/create', {
+            message: `FullCourtDefense — your organization asks you to confirm this action.\n\nTool: ${input.toolName}\nRule: ${input.ruleLabel}\nWhy: ${input.reason}${evidence}\n\nAllow this tool call? Your answer is reported to your security dashboard as your decision.`,
+            requestedSchema: {
+                type: 'object',
+                properties: {
+                    confirm: {
+                        type: 'boolean',
+                        title: 'Allow this tool call',
+                        description: 'Yes runs the tool call once. No (or closing this dialog) does not run it.',
+                        default: false,
+                    },
+                    remember: {
+                        type: 'boolean',
+                        title: 'Remember for this session',
+                        description: 'Do not ask again for this tool and rule until this MCP session ends (max 12 hours).',
+                        default: false,
+                    },
+                },
+                required: ['confirm'],
+            },
+        }, ELICITATION_TIMEOUT_MS);
+        const latencyMs = Date.now() - started;
+        if (!response)
+            return { answer: 'timeout', remember: false, latencyMs };
+        const result = (response.result && typeof response.result === 'object') ? response.result : undefined;
+        const content = (result?.content && typeof result.content === 'object') ? result.content : undefined;
+        if (result?.action === 'accept' && content?.confirm === true) {
+            return { answer: 'accept', remember: content.remember === true, latencyMs };
+        }
+        return { answer: 'decline', remember: false, latencyMs };
+    }
 }
 async function mcpGatewayCommand(args, config) {
     // The gateway is a resident proxy in front of the IDE's MCP servers — if it

package/dist/commands/posixShellGuard.d.ts

@@ -1,3 +1,16 @@
+/** Checker exit code: the rule asks the developer — the shell must prompt. */
+export declare const ASK_CODE = 98;
+/**
+ * Git for Windows' bash.exe, if installed (the MSYS2-based "Git Bash"). WSL's
+ * System32\bash.exe is deliberately NOT a match — that is a Linux distro with
+ * its own home directory and rc files, not this Windows profile.
+ */
+export declare function detectGitBash(): string | undefined;
+/**
+ * Where the bash/zsh guard can be planted: real POSIX hosts, or Windows with
+ * Git Bash installed (bash only — no zsh there).
+ */
+export declare function posixGuardSupported(): boolean;
 export interface PosixShellGuardStatus {
     supported: boolean;
     installed: boolean;
@@ -18,9 +31,9 @@ export interface InstallPosixShellGuardArgs {
     /** 'false' to write the guard scripts + rules without wiring rc files. */
     profiles?: string;
 }
-/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+/** `fullcourtdefense install-shell-guard` on macOS/Linux (bash/zsh) or Windows with Git Bash (bash). */
 export declare function installPosixShellGuardCommand(args?: InstallPosixShellGuardArgs): Promise<void>;
-/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux (or Git Bash on Windows) — remove the guard. */
 export declare function uninstallPosixShellGuardCommand(): Promise<void>;
 /** Refresh the shared rules JSON when the POSIX guard is installed. Never throws. */
 export declare function refreshPosixShellGuardRules(): void;