fullcourtdefense-cli 1.27.4 → 1.29.0

package/dist/commands/posixShellGuard.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASK_CODE = void 0;
+exports.detectGitBash = detectGitBash;
+exports.posixGuardSupported = posixGuardSupported;
 exports.getPosixShellGuardStatus = getPosixShellGuardStatus;
 exports.isPosixShellGuardInstalled = isPosixShellGuardInstalled;
 exports.installPosixShellGuardCommand = installPosixShellGuardCommand;
@@ -75,6 +78,18 @@ const shellGuard_1 = require("./shellGuard");
  * (checker exit code 97) stops a command. Disable for a session with
  * `export FCD_SHELL_GUARD=off`.
  *
+ * "Ask the developer" rules (checker exit code 98): the checker prints one
+ * machine-readable `FCD_ASK\t<rule>\t<severity>\t<reason>` line and the SHELL
+ * (which owns the tty) shows `Run anyway? [y] / [s] remember for this shell /
+ * [N]` with a timeout. y/s run the line, anything else drops it; every answer
+ * is reported through the checker's `--record` mode as a developer decision.
+ * An ask that cannot be answered (no tty, timeout) is a block — the one place
+ * the guard fails STRICT, because the org explicitly asked for a human.
+ *
+ * Git Bash on Windows (MSYS2 runtime) is supported: same bash guard, wired into
+ * %USERPROFILE%\.bashrc, node invoked with MSYS path conversion disabled so
+ * typed lines like `/dev/tcp/...` reach the checker untouched.
+ *
  * Rules/mode refresh opportunistically on every telemetry flush (offline caches
  * only — never blocks a shell). Blocks are spooled and reported to the fleet
  * dashboard as `shell_terminal` events.
@@ -87,9 +102,49 @@ const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
 const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
 const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
 const BLOCK_CODE = 97;
+/** Checker exit code: the rule asks the developer — the shell must prompt. */
+exports.ASK_CODE = 98;
 function isPosixPlatform() {
     return process.platform === 'darwin' || process.platform === 'linux';
 }
+/**
+ * Git for Windows' bash.exe, if installed (the MSYS2-based "Git Bash"). WSL's
+ * System32\bash.exe is deliberately NOT a match — that is a Linux distro with
+ * its own home directory and rc files, not this Windows profile.
+ */
+function detectGitBash() {
+    if (process.platform !== 'win32')
+        return undefined;
+    const candidates = [
+        path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Git', 'bin', 'bash.exe'),
+        path.join(process.env.ProgramW6432 || '', 'Git', 'bin', 'bash.exe'),
+    ];
+    for (const candidate of candidates) {
+        try {
+            if (candidate && fs.existsSync(candidate))
+                return candidate;
+        }
+        catch { /* keep looking */ }
+    }
+    return undefined;
+}
+/**
+ * Where the bash/zsh guard can be planted: real POSIX hosts, or Windows with
+ * Git Bash installed (bash only — no zsh there).
+ */
+function posixGuardSupported() {
+    return isPosixPlatform() || Boolean(detectGitBash());
+}
+/**
+ * Path as the planted shell script should spell it. MSYS2 bash resolves
+ * `C:/Program Files/nodejs/node.exe` for `[ -x ]` and exec; backslashes would
+ * be read as escapes inside the script.
+ */
+function shellPath(p) {
+    return process.platform === 'win32' ? p.replace(/\\/g, '/') : p;
+}
 function shSingleQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -104,27 +159,107 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `const ASK_CODE=${exports.ASK_CODE};`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
         `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Precedence on one line: block outranks ask, ask outranks warn.`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null,askHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){if(!askHit)askHit=r;}else if(!warnHit)warnHit=r;}}catch{}}return askHit||warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
-        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
-        `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this shell (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
+        `let argv=process.argv.slice(2);`,
+        `// --record <confirmed|remembered|declined|timeout> <ruleId> -- <line>: the shell answered an ask prompt; report it and exit.`,
+        `if(argv[0]==='--record'){const kind=argv[1],ruleId=argv[2];let rest=argv.slice(3);if(rest[0]==='--')rest=rest.slice(1);const rline=rest.join(' ');try{const{rules}=loadRules();const rule=rules.find(r=>r.id===ruleId)||{id:ruleId,reason:'ask rule '+ruleId,category:'',severity:'',source:'builtin'};spoolEvent(rule,rline,(kind==='confirmed'||kind==='remembered')?'allow':'block',kind);}catch{}process.exit(0);}`,
+        `if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,
         `if(!line.trim())process.exit(0);`,
         `if(process.env.FCD_SHELL_GUARD==='off')process.exit(0);`,
         `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)process.exit(0);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
+        `if(hit.action==='ask'){`,
+        `  // "s = remember for this shell": the shell exports FCD_SHELL_ASK_OK=<ruleId>,<ruleId>... — dies with the shell.`,
+        `  const ok=String(process.env.FCD_SHELL_ASK_OK||'').split(',').map(s=>s.trim()).filter(Boolean);`,
+        `  if(ok.includes(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this shell.');spoolEvent(hit,line,'allow','remembered');process.exit(0);}`,
+        `  // Machine-readable ask line on stdout; the sourcing shell owns the prompt (it has the tty).`,
+        `  process.stdout.write('FCD_ASK\\t'+hit.id+'\\t'+(hit.severity||'')+'\\t'+String(hit.reason||'').replace(/[\\t\\n\\r]+/g,' ')+'\\n');`,
+        `  process.exit(ASK_CODE);`,
+        `}`,
         `console.error('[FullCourtDefense] BLOCKED ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `console.error('This command was not executed. Reported to your security dashboard.');`,
         `spoolEvent(hit,line,'block');process.exit(BLOCK_CODE);`,
         ``,
     ].join('\n');
 }
+/**
+ * Shared POSIX-shell prompt for an ask hit (sourced by both the bash and zsh
+ * guards — plain POSIX/bash syntax, no ZLE). Args: <meta line> <typed line>.
+ * Returns 0 = run the command, 1 = do not. Reads ONE key from /dev/tty with a
+ * timeout; y = run once, s = run + export FCD_SHELL_ASK_OK for this shell,
+ * anything else / timeout / no tty = not executed. Every answer is reported
+ * through the checker's --record mode. Fail-strict: an ask that cannot be
+ * answered is a block, never a silent allow.
+ */
+function buildAskShellFunction(shell) {
+    // One key, with timeout: bash `read -n 1 -t`, zsh `read -k 1 -t`.
+    const readKey = shell === 'zsh'
+        ? `read -k 1 -t ${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS} __fcd_ans </dev/tty`
+        : `IFS= read -r -n 1 -t ${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS} __fcd_ans </dev/tty`;
+    return [
+        `__fcd_ask_prompt() {`,
+        `  local __fcd_meta="$1" __fcd_line="$2" __fcd_tag __fcd_id __fcd_sev __fcd_reason __fcd_ans=""`,
+        `  local __fcd_oldifs="$IFS"; IFS="$(printf '\\t')"; read -r __fcd_tag __fcd_id __fcd_sev __fcd_reason <<< "$__fcd_meta"; IFS="$__fcd_oldifs"`,
+        `  printf '[FullCourtDefense] ASK [%s]: %s (rule %s)\\n' "$__fcd_sev" "$__fcd_reason" "$__fcd_id" >&2`,
+        `  # Only a shell with a REAL keyboard may be asked: stdin must be this shell's`,
+        `  # terminal. A spawned / piped / embedded shell (stdin not a tty) never opens`,
+        `  # /dev/tty — on MSYS that can be some OTHER window's console — it blocks now.`,
+        `  if [ -t 0 ] && [ -r /dev/tty ] && [ -w /dev/tty ]; then`,
+        `    printf 'Run anyway?  [y] yes   [s] yes, remember for this shell   [N] no   (%ss): ' "${shellGuard_1.SHELL_ASK_TIMEOUT_SECONDS}" >/dev/tty`,
+        `    if ${readKey}; then :; else __fcd_ans="__timeout__"; fi`,
+        `    printf '\\n' >/dev/tty`,
+        `  else`,
+        `    __fcd_ans="__notty__"`,
+        `    printf '[FullCourtDefense] no terminal to ask on — not executed.\\n' >&2`,
+        `  fi`,
+        `  case "$__fcd_ans" in`,
+        `    y|Y)`,
+        `      printf '[FullCourtDefense] yes — reported to your security dashboard as allowed by you.\\n' >&2`,
+        `      __fcd_run_checker --record confirmed "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 0 ;;`,
+        `    s|S)`,
+        `      export FCD_SHELL_ASK_OK="\${FCD_SHELL_ASK_OK:+$FCD_SHELL_ASK_OK,}$__fcd_id"`,
+        `      printf '[FullCourtDefense] yes — remembered for this shell. Reported to your security dashboard as allowed by you.\\n' >&2`,
+        `      __fcd_run_checker --record confirmed "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 0 ;;`,
+        `    __timeout__)`,
+        `      printf '[FullCourtDefense] no answer — this command was not executed (timeout). Reported to your security dashboard.\\n' >&2`,
+        `      __fcd_run_checker --record timeout "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 1 ;;`,
+        `    *)`,
+        `      printf '[FullCourtDefense] no — this command was not executed (declined). Reported to your security dashboard.\\n' >&2`,
+        `      __fcd_run_checker --record declined "$__fcd_id" -- "$__fcd_line" >/dev/null 2>&1`,
+        `      return 1 ;;`,
+        `  esac`,
+        `}`,
+    ].join('\n');
+}
+/**
+ * How the shell scripts invoke the Node checker. On Git Bash (MSYS2 runtime on
+ * Windows) node.exe is a NATIVE program, so the runtime would rewrite any
+ * argument that looks like a POSIX path (e.g. the typed line "/usr/bin/rm -rf /"
+ * or "/dev/tcp/...") into a Windows path before node sees it — disable that for
+ * this one call. Both variables are inert on real macOS/Linux shells.
+ */
+function buildRunCheckerFunction() {
+    return [
+        `__fcd_run_checker() {`,
+        `  MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' "$FCD_GUARD_NODE" "$FCD_GUARD_JS" "$@"`,
+        `}`,
+    ].join('\n');
+}
 /** zsh guard — sourced ONLY from .zshrc (contains zsh-specific ZLE syntax). */
 function buildGuardZsh(nodePath) {
     return [
@@ -135,8 +270,12 @@ function buildGuardZsh(nodePath) {
         ``,
         `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
         ``,
-        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
-        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        `FCD_GUARD_NODE=${shSingleQuote(shellPath(nodePath))}`,
+        `FCD_GUARD_JS=${shSingleQuote(shellPath(GUARD_JS_PATH))}`,
+        ``,
+        buildRunCheckerFunction(),
+        ``,
+        buildAskShellFunction('zsh'),
         ``,
         `# Inspect the WHOLE typed line against every rule before accepting it`,
         `# (command-agnostic: catches any command, pipes, and chained segments).`,
@@ -145,12 +284,23 @@ function buildGuardZsh(nodePath) {
         `  local __fcd_line=$BUFFER`,
         `  if [[ -n "$__fcd_line" && "\${FCD_SHELL_GUARD:-}" != "off" && -x "$FCD_GUARD_NODE" && -f "$FCD_GUARD_JS" ]]; then`,
         `    local __fcd_out`,
-        `    __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `    __fcd_out="$(__fcd_run_checker -- "$__fcd_line" 2>&1)"`,
         `    local __fcd_rc=$?`,
-        `    if [[ $__fcd_rc -eq 97 ]]; then`,
+        `    if [[ $__fcd_rc -eq ${BLOCK_CODE} ]]; then`,
         `      zle -M -- "$__fcd_out"`,
         `      return`,
         `    fi`,
+        `    if [[ $__fcd_rc -eq ${exports.ASK_CODE} ]]; then`,
+        `      # Ask the human: leave ZLE for the prompt, then run or drop the line.`,
+        `      zle -I`,
+        `      if __fcd_ask_prompt "$__fcd_out" "$__fcd_line"; then`,
+        `        zle .accept-line`,
+        `      else`,
+        `        BUFFER=""`,
+        `        zle .accept-line`,
+        `      fi`,
+        `      return`,
+        `    fi`,
         `    [[ -n "$__fcd_out" ]] && print -u2 -r -- "$__fcd_out"`,
         `  fi`,
         `  zle .accept-line`,
@@ -182,10 +332,14 @@ function buildGuardBash(nodePath) {
         ``,
         `case $- in *i*) ;; *) return 0 2>/dev/null || true ;; esac`,
         ``,
-        `FCD_GUARD_NODE=${shSingleQuote(nodePath)}`,
-        `FCD_GUARD_JS=${shSingleQuote(GUARD_JS_PATH)}`,
+        `FCD_GUARD_NODE=${shSingleQuote(shellPath(nodePath))}`,
+        `FCD_GUARD_JS=${shSingleQuote(shellPath(GUARD_JS_PATH))}`,
         `__fcd_last_line=""`,
         ``,
+        buildRunCheckerFunction(),
+        ``,
+        buildAskShellFunction('bash'),
+        ``,
         `# Run the shared checker on one full line. Returns 1 to cancel (extdebug).`,
         `__fcd_check_line() {`,
         `  local __fcd_line="$1"`,
@@ -193,10 +347,14 @@ function buildGuardBash(nodePath) {
         `  [ "\${FCD_SHELL_GUARD:-}" = "off" ] && return 0`,
         `  if [ ! -x "$FCD_GUARD_NODE" ] || [ ! -f "$FCD_GUARD_JS" ]; then return 0; fi`,
         `  local __fcd_out __fcd_rc`,
-        `  __fcd_out="$("$FCD_GUARD_NODE" "$FCD_GUARD_JS" -- "$__fcd_line" 2>&1)"`,
+        `  __fcd_out="$(__fcd_run_checker -- "$__fcd_line" 2>&1)"`,
         `  __fcd_rc=$?`,
+        `  if [ "$__fcd_rc" -eq ${exports.ASK_CODE} ]; then`,
+        `    __fcd_ask_prompt "$__fcd_out" "$__fcd_line" && return 0`,
+        `    return 1`,
+        `  fi`,
         `  [ -n "$__fcd_out" ] && printf '%s\\n' "$__fcd_out" >&2`,
-        `  [ "$__fcd_rc" -eq 97 ] && return 1`,
+        `  [ "$__fcd_rc" -eq ${BLOCK_CODE} ] && return 1`,
         `  return 0`,
         `}`,
         ``,
@@ -222,13 +380,18 @@ function buildGuardBash(nodePath) {
         ``,
     ].join('\n');
 }
-/** rc files we wire the guard into. .bash_profile only when it already exists. */
+/**
+ * rc files we wire the guard into. .bash_profile only when it already exists.
+ * Windows (Git Bash) is bash-only: Git for Windows' login shell reads
+ * ~/.bash_profile, and auto-creates one that sources ~/.bashrc when only the
+ * latter exists — so ~/.bashrc is the right home there too.
+ */
 function resolveRcTargets() {
     const home = os.homedir();
-    const out = [
-        { shell: 'zsh', rcPath: path.join(home, '.zshrc'), guardPath: GUARD_ZSH_PATH },
-        { shell: 'bash', rcPath: path.join(home, '.bashrc'), guardPath: GUARD_BASH_PATH },
-    ];
+    const out = [];
+    if (process.platform !== 'win32')
+        out.push({ shell: 'zsh', rcPath: path.join(home, '.zshrc'), guardPath: GUARD_ZSH_PATH });
+    out.push({ shell: 'bash', rcPath: path.join(home, '.bashrc'), guardPath: GUARD_BASH_PATH });
     const bashProfile = path.join(home, '.bash_profile');
     if (fs.existsSync(bashProfile))
         out.push({ shell: 'bash', rcPath: bashProfile, guardPath: GUARD_BASH_PATH });
@@ -272,7 +435,7 @@ function removeSnippetFromRc(rcPath) {
 }
 /** Read-only probe. Never throws. */
 function getPosixShellGuardStatus() {
-    if (!isPosixPlatform()) {
+    if (!posixGuardSupported()) {
         return { supported: false, installed: false, rcFiles: [], rulesPresent: false };
     }
     try {
@@ -310,7 +473,7 @@ function getPosixShellGuardStatus() {
 /** Lightweight boolean for the telemetry heartbeat / discovery report. */
 function isPosixShellGuardInstalled() {
     try {
-        if (!isPosixPlatform())
+        if (!posixGuardSupported())
             return false;
         if (!fs.existsSync(GUARD_ZSH_PATH) && !fs.existsSync(GUARD_BASH_PATH))
             return false;
@@ -327,17 +490,18 @@ function isPosixShellGuardInstalled() {
         return false;
     }
 }
-/** `fullcourtdefense install-shell-guard` on macOS/Linux — enable the bash/zsh guard. */
+/** `fullcourtdefense install-shell-guard` on macOS/Linux (bash/zsh) or Windows with Git Bash (bash). */
 async function installPosixShellGuardCommand(args = {}) {
-    if (!isPosixPlatform()) {
-        console.log('The POSIX shell guard supports macOS and Linux (bash/zsh).');
+    if (!posixGuardSupported()) {
+        console.log('The POSIX shell guard supports macOS and Linux (bash/zsh), and Git Bash on Windows.');
         return;
     }
     const rules = (0, shellGuard_1.writeShellGuardRules)();
     const nodePath = process.execPath;
-    const cliEntry = process.argv[1] || '';
+    const cliEntry = (0, shellGuard_1.guardCliEntry)();
     fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), { encoding: 'utf8', mode: 0o600 });
-    fs.writeFileSync(GUARD_ZSH_PATH, buildGuardZsh(nodePath), { encoding: 'utf8', mode: 0o600 });
+    if (process.platform !== 'win32')
+        fs.writeFileSync(GUARD_ZSH_PATH, buildGuardZsh(nodePath), { encoding: 'utf8', mode: 0o600 });
     fs.writeFileSync(GUARD_BASH_PATH, buildGuardBash(nodePath), { encoding: 'utf8', mode: 0o600 });
     console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
     if (args.profiles === 'false') {
@@ -358,14 +522,14 @@ async function installPosixShellGuardCommand(args = {}) {
             console.log(`\x1b[33m⚠ ${target.shell}: could not update ${target.rcPath} (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
         }
     }
-    console.log('\x1b[2mTakes effect in NEW terminals (or run: source ~/.zshrc). Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+    console.log('\x1b[2mTakes effect in NEW terminals (or run: source ~/.zshrc / ~/.bashrc). Dangerous typed commands are blocked, asked about, or warned (per rule and machine mode) and reported to the fleet dashboard.\x1b[0m');
     if (wired === 0) {
         console.log('\x1b[33m⚠ Guard scripts written but no rc file was newly wired — check the entries above.\x1b[0m');
     }
 }
-/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux — remove the guard. */
+/** `fullcourtdefense uninstall-shell-guard` on macOS/Linux (or Git Bash on Windows) — remove the guard. */
 async function uninstallPosixShellGuardCommand() {
-    if (!isPosixPlatform()) {
+    if (!posixGuardSupported()) {
         console.log('Nothing to remove on this OS.');
         return;
     }
@@ -400,9 +564,10 @@ function refreshPosixShellGuardRules() {
         // logic of the build that wrote them — rewrite when the stamp is stale.
         if ((0, shellGuard_1.guardArtifactStale)(GUARD_JS_PATH)) {
             const nodePath = process.execPath;
-            const cliEntry = process.argv[1] || '';
+            const cliEntry = (0, shellGuard_1.guardCliEntry)();
             (0, shellGuard_1.writeGuardArtifact)(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 0o600);
-            (0, shellGuard_1.writeGuardArtifact)(GUARD_ZSH_PATH, buildGuardZsh(nodePath), 0o600);
+            if (process.platform !== 'win32')
+                (0, shellGuard_1.writeGuardArtifact)(GUARD_ZSH_PATH, buildGuardZsh(nodePath), 0o600);
             (0, shellGuard_1.writeGuardArtifact)(GUARD_BASH_PATH, buildGuardBash(nodePath), 0o600);
         }
     }

package/dist/commands/shellGuard.d.ts

@@ -27,11 +27,40 @@ export interface ShellGuardRule {
     /**
      * Per-rule enforcement action from the console (Local Safety). Absent =
      * 'block'. 'warn' → yellow notice, the command still runs (like monitor
-     * mode, but for this one rule). 'mask' is meaningless for a typed command
-     * and degrades to block.
+     * mode, but for this one rule). 'ask' → the guard pauses the typed line and
+     * asks the human at the keyboard (y / N / s = remember for this shell);
+     * declined, timed out, or no answerable terminal → block, never a silent
+     * allow. 'mask' is meaningless for a typed command and degrades to block.
      */
-    action?: 'block' | 'warn';
+    action?: ShellGuardAction;
 }
+export type ShellGuardAction = 'block' | 'warn' | 'ask';
+/**
+ * The CLI entry a planted guard should spawn for `flush-spool`. Resolved from
+ * THIS module's location (dist/commands -> dist/index.js), never from
+ * process.argv[1]: when the guard installer runs embedded in another process
+ * (daemon, test drill, host script), argv[1] is the HOST — baking it in would
+ * make every spooled event re-launch the host, hidden, recursively (a fork
+ * bomb that has frozen a developer machine). argv[1] is only a last resort
+ * when the packaged entry is not on disk.
+ */
+export declare function guardCliEntry(): string;
+/** Seconds a terminal "ask" prompt waits for an answer before it counts as declined. */
+export declare const SHELL_ASK_TIMEOUT_SECONDS = 30;
+/** How long "s = remember for this shell" lasts (capped — a forgotten window must not last forever). */
+export declare const SHELL_ASK_REMEMBER_HOURS = 12;
+/** Normalize a console action into what a typed-command guard can enforce. */
+export declare function toShellGuardAction(raw: unknown): ShellGuardAction;
+/**
+ * Leading command names that anchor a built-in rule — what a first-token hook
+ * (cmd.exe doskey) can key on. Derived from the shared tables so a new rule
+ * cannot be added without its command name reaching the cmd guard's index.
+ */
+/** Every built-in terminal rule id, ignoring console toggles (parity tests, docs). */
+export declare function builtinRuleIds(): string[];
+/** Every built-in terminal rule, all switched ON with default action (parity tests). */
+export declare function builtinRulesAllOn(): ShellGuardRule[];
+export declare function builtinRuleCommandNames(): string[];
 interface ShellGuardRulesFile {
     updatedAt: string;
     mode: 'block' | 'monitor';