fullcourtdefense-cli 1.28.0 → 1.29.0

package/dist/commands/cmdGuard.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that
+ * are cheap enough to wrap in cmd: `gh`, `vault`, `security`, … — derived, not
+ * hand-listed, so a new shared rule reaches cmd's index automatically unless
+ * its command is on the high-frequency diet above. cmd stays PARTIAL by
+ * construction (first token only, no `git`/`kubectl`/`aws` wrappers); the
+ * console labels it that way.
+ */
+export declare const INTERCEPTED_COMMANDS: string[];
 export declare function buildGuardJs(nodePath: string, cliEntry: string): string;
 export interface CmdGuardStatus {
     supported: boolean;

package/dist/commands/cmdGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERCEPTED_COMMANDS = void 0;
 exports.buildGuardJs = buildGuardJs;
 exports.isCmdGuardInstalled = isCmdGuardInstalled;
 exports.getCmdGuardStatus = getCmdGuardStatus;
@@ -75,7 +76,7 @@ const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
  * so pipes/`&&` chains where the dangerous command is not first are NOT caught by
  * cmd (they ARE under PowerShell/zsh/bash and `shell-guard-check`).
  */
-const INTERCEPTED_COMMANDS = [
+const FIXED_INTERCEPTED_COMMANDS = [
     // Destructive filesystem / disk / permission tampering
     'del', 'erase', 'rd', 'rmdir', 'format', 'cipher', 'diskpart', 'fsutil',
     'takeown', 'icacls', 'attrib', 'compact',
@@ -97,8 +98,25 @@ const INTERCEPTED_COMMANDS = [
  * Coverage is NOT lost where it matters: agent-driven commands go through the
  * IDE hooks (full ruleset, any position in the line), and humans typing in
  * PowerShell are covered in-process by the PSReadLine guard. Interactive
- * cmd.exe keeps only the rare, high-signal destructive/tamper commands above.
+ * cmd.exe keeps only the rare, high-signal destructive/tamper commands above
+ * plus the low-frequency anchors of the shared command rules (below).
  */
+const CMD_HIGH_FREQUENCY_COMMANDS = new Set([
+    'docker', 'git', 'kubectl', 'aws', 'gcloud', 'az', 'terraform', 'pulumi', 'wsl',
+    'curl', 'wget', 'taskkill', 'robocopy', 'xcopy', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
+]);
+/**
+ * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that
+ * are cheap enough to wrap in cmd: `gh`, `vault`, `security`, … — derived, not
+ * hand-listed, so a new shared rule reaches cmd's index automatically unless
+ * its command is on the high-frequency diet above. cmd stays PARTIAL by
+ * construction (first token only, no `git`/`kubectl`/`aws` wrappers); the
+ * console labels it that way.
+ */
+exports.INTERCEPTED_COMMANDS = Array.from(new Set([
+    ...FIXED_INTERCEPTED_COMMANDS,
+    ...(0, shellGuard_1.builtinRuleCommandNames)().filter(name => !CMD_HIGH_FREQUENCY_COMMANDS.has(name)),
+]));
 function regString(key, value) {
     try {
         const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
@@ -180,7 +198,7 @@ function buildGuardJs(nodePath, cliEntry) {
 function buildMacroFile(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);
     const node = batQuote(nodePath);
-    return `${INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
+    return `${exports.INTERCEPTED_COMMANDS.map(cmd => `${cmd}=${node} ${guardJs} ${cmd} $*`).join('\r\n')}\r\n`;
 }
 function buildAutorunBat(nodePath) {
     const guardJs = batQuote(GUARD_JS_PATH);

package/dist/commands/deterministicGuard.d.ts

@@ -69,6 +69,41 @@ export interface LocalSafetyScanOptions {
      */
     trustedScriptPaths?: string[];
 }
+/**
+ * Built-ins that ship OFF until an org switches them on in the console. Shared
+ * with the terminal guards so a machine with no snapshot yet (fresh install,
+ * wiped cache) enforces the SAME default set in the IDE and in a shell.
+ */
+export declare const DEFAULT_DISABLED_BUILT_INS: ReadonlySet<string>;
+/**
+ * One command rule shared by EVERY surface that can see a typed command: the
+ * IDE/agent hooks (this module), the PowerShell / bash / zsh profile guards and
+ * the cmd.exe doskey guard (shellGuard.ts loads this table into the terminal
+ * rule file verbatim). `pattern` is a regex SOURCE that must compile — and
+ * mean the same thing — under both JS and .NET with IgnoreCase: `\b`, `\s`,
+ * `(?:…)`, lookaheads and `[^\n;|&]` only. No lookbehind, no named groups,
+ * no `\d`-class differences. `commands` are the leading binaries a rule can
+ * fire on — the only thing a first-token hook (doskey) can key on.
+ */
+export interface SharedCommandRule {
+    itemId: string;
+    /** Catalog category id (local-safety-catalog.ts). */
+    categoryId: 'credential_commands';
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    pattern: string;
+    reason: string;
+    /** Leading command names this rule anchors on (for name-keyed hooks such as cmd.exe doskey). */
+    commands: string[];
+}
+/**
+ * Commands that PRINT stored credentials to stdout — the file-path rules are
+ * useless against them because the secret never comes from a watched file
+ * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
+ * rarely-legitimate-for-agents forms are on by default; cloud token printers
+ * that legitimate deploy tooling uses constantly are strict (off by default,
+ * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
+ */
+export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
@@ -189,7 +190,12 @@ const SQL_KEYS = new Set([
     'toolArgs.query',
     'toolArgs.sql',
 ]);
-const DEFAULT_DISABLED_BUILT_INS = new Set([
+/**
+ * Built-ins that ship OFF until an org switches them on in the console. Shared
+ * with the terminal guards so a machine with no snapshot yet (fresh install,
+ * wiped cache) enforces the SAME default set in the IDE and in a shell.
+ */
+exports.DEFAULT_DISABLED_BUILT_INS = new Set([
     'git_clean_force',
     'generic_kubectl_delete',
     'truncate_table',
@@ -413,7 +419,7 @@ function collectStrings(value, keyPath = 'args', out = [], depth = 0) {
     return out;
 }
 function disabled(options) {
-    return new Set(options?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS));
+    return new Set(options?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS));
 }
 function isEnabled(itemId, options) {
     return !disabled(options).has(itemId);
@@ -587,39 +593,47 @@ function containsSensitiveCredentialPath(value) {
  * useless against them because the secret never comes from a watched file
  * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
  * rarely-legitimate-for-agents forms are on by default; cloud token printers
- * that legitimate deploy tooling uses constantly are strict (off by default).
+ * that legitimate deploy tooling uses constantly are strict (off by default,
+ * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
+exports.CREDENTIAL_COMMAND_RULES = [
+    { itemId: 'gh_auth_token_cmd', categoryId: 'credential_commands', severity: 'critical', commands: ['gh'],
+        reason: 'GitHub CLI token print (gh auth token)',
+        pattern: String.raw `\bgh\s+auth\s+token\b|\bgh\s+auth\s+status\b(?=[^\n;|&]*(?:--show-token|\s-t\b))` },
+    { itemId: 'git_credential_fill', categoryId: 'credential_commands', severity: 'critical', commands: ['git'],
+        reason: 'git credential helper dump',
+        pattern: String.raw `\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b` },
+    { itemId: 'macos_keychain_dump', categoryId: 'credential_commands', severity: 'critical', commands: ['security'],
+        reason: 'macOS keychain password dump',
+        pattern: String.raw `\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b|\bsecurity\s+dump-keychain\b` },
+    { itemId: 'kubectl_config_raw', categoryId: 'credential_commands', severity: 'high', commands: ['kubectl'],
+        reason: 'raw kubeconfig dump (kubectl config view --raw)',
+        pattern: String.raw `\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b` },
+    { itemId: 'aws_export_credentials', categoryId: 'credential_commands', severity: 'critical', commands: ['aws'],
+        reason: 'AWS secret access key export',
+        pattern: String.raw `\baws\s+configure\s+export-credentials\b|\baws\s+configure\s+get\b[^\n;|&]*secret` },
+    { itemId: 'gcloud_access_token_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['gcloud'],
+        reason: 'gcloud access-token print',
+        pattern: String.raw `\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b` },
+    { itemId: 'gcloud_secret_access_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['gcloud'],
+        reason: 'GCP Secret Manager read',
+        pattern: String.raw `\bgcloud\s+secrets\s+versions\s+access\b` },
+    { itemId: 'az_access_token_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['az'],
+        reason: 'Azure access-token print',
+        pattern: String.raw `\baz\s+account\s+get-access-token\b` },
+    { itemId: 'aws_secret_fetch_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['aws'],
+        reason: 'AWS secret fetch',
+        pattern: String.raw `\baws\s+secretsmanager\s+get-secret-value\b|\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b` },
+    { itemId: 'vault_read_cmd', categoryId: 'credential_commands', severity: 'high', commands: ['vault'],
+        reason: 'Vault secret read',
+        pattern: String.raw `\bvault\s+(?:kv\s+get|read)\b` },
+];
+const CREDENTIAL_COMMAND_REGEXES = exports.CREDENTIAL_COMMAND_RULES.map(rule => ({ rule, re: new RegExp(rule.pattern, 'i') }));
 function credentialCommandReason(value) {
-    return matchCommand(value, (_text, lower) => {
-        if (/\bgh\s+auth\s+token\b/.test(lower) || (/\bgh\s+auth\s+status\b/.test(lower) && /(?:--show-token|\s-t\b)/.test(lower))) {
-            return { itemId: 'gh_auth_token_cmd', reason: 'GitHub CLI token print (gh auth token)' };
-        }
-        if (/\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b/.test(lower)) {
-            return { itemId: 'git_credential_fill', reason: 'git credential helper dump' };
-        }
-        if (/\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b/.test(lower) || /\bsecurity\s+dump-keychain\b/.test(lower)) {
-            return { itemId: 'macos_keychain_dump', reason: 'macOS keychain password dump' };
-        }
-        if (/\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b/.test(lower)) {
-            return { itemId: 'kubectl_config_raw', reason: 'raw kubeconfig dump (kubectl config view --raw)' };
-        }
-        if (/\baws\s+configure\s+export-credentials\b/.test(lower) || /\baws\s+configure\s+get\b[^\n;|&]*secret/.test(lower)) {
-            return { itemId: 'aws_export_credentials', reason: 'AWS secret access key export' };
-        }
-        if (/\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b/.test(lower)) {
-            return { itemId: 'gcloud_access_token_cmd', reason: 'gcloud access-token print' };
-        }
-        if (/\bgcloud\s+secrets\s+versions\s+access\b/.test(lower)) {
-            return { itemId: 'gcloud_secret_access_cmd', reason: 'GCP Secret Manager read' };
-        }
-        if (/\baz\s+account\s+get-access-token\b/.test(lower)) {
-            return { itemId: 'az_access_token_cmd', reason: 'Azure access-token print' };
-        }
-        if (/\baws\s+secretsmanager\s+get-secret-value\b/.test(lower) || /\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b/.test(lower)) {
-            return { itemId: 'aws_secret_fetch_cmd', reason: 'AWS secret fetch' };
-        }
-        if (/\bvault\s+(?:kv\s+get|read)\b/.test(lower)) {
-            return { itemId: 'vault_read_cmd', reason: 'Vault secret read' };
+    return matchCommand(value, text => {
+        for (const { rule, re } of CREDENTIAL_COMMAND_REGEXES) {
+            if (re.test(text))
+                return { itemId: rule.itemId, reason: rule.reason };
         }
         return undefined;
     });
@@ -1190,7 +1204,7 @@ function scanReferencedScript(command, cwd, options) {
         while (finding
             && (finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf')
             && !scriptActsOnFinding(content, finding.category)) {
-            const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+            const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS);
             scanOptions = { ...(scanOptions || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
             finding = scanTextValue('script_file', content, scanOptions);
         }
@@ -1212,7 +1226,7 @@ function withRuleSuppressed(options, finding) {
             customBlocks: (options?.customBlocks || []).filter(block => block.id !== finding.itemId),
         };
     }
-    const baseDisabled = options?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+    const baseDisabled = options?.disabledBuiltInItemIds || Array.from(exports.DEFAULT_DISABLED_BUILT_INS);
     return { ...(options || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
 }
 function findingAction(finding) {

package/dist/commands/shellGuard.d.ts

@@ -51,6 +51,16 @@ export declare const SHELL_ASK_TIMEOUT_SECONDS = 30;
 export declare const SHELL_ASK_REMEMBER_HOURS = 12;
 /** Normalize a console action into what a typed-command guard can enforce. */
 export declare function toShellGuardAction(raw: unknown): ShellGuardAction;
+/**
+ * Leading command names that anchor a built-in rule — what a first-token hook
+ * (cmd.exe doskey) can key on. Derived from the shared tables so a new rule
+ * cannot be added without its command name reaching the cmd guard's index.
+ */
+/** Every built-in terminal rule id, ignoring console toggles (parity tests, docs). */
+export declare function builtinRuleIds(): string[];
+/** Every built-in terminal rule, all switched ON with default action (parity tests). */
+export declare function builtinRulesAllOn(): ShellGuardRule[];
+export declare function builtinRuleCommandNames(): string[];
 interface ShellGuardRulesFile {
     updatedAt: string;
     mode: 'block' | 'monitor';

package/dist/commands/shellGuard.js

@@ -39,6 +39,9 @@ exports.guardArtifactStale = guardArtifactStale;
 exports.writeGuardArtifact = writeGuardArtifact;
 exports.guardCliEntry = guardCliEntry;
 exports.toShellGuardAction = toShellGuardAction;
+exports.builtinRuleIds = builtinRuleIds;
+exports.builtinRulesAllOn = builtinRulesAllOn;
+exports.builtinRuleCommandNames = builtinRuleCommandNames;
 exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
@@ -52,6 +55,7 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const deterministicGuard_1 = require("./deterministicGuard");
 /**
  * Interactive PowerShell guard — real-time blocking of dangerous commands
  * TYPED by a human in a terminal (inside or outside the IDE).
@@ -195,7 +199,10 @@ const BUILTIN_RULES = [
         command: ['rd', 'rmdir'], flags: [String.raw `/s\b`], target: [String.raw `["']?[a-z]:[\\/]?["']?\s*(?:$|[;&|])`] }),
     compileSpec({ id: 'windows_system_dir_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of a Windows system directory',
         command: ['del', 'erase', 'rd', 'rmdir'], flags: [String.raw `/s\b`], target: [T_WIN_SYSDIR] }),
-    compileSpec({ id: 'remove_item_drive', category: 'destructive_command', severity: 'critical', reason: 'recursive Remove-Item on a drive root',
+    // Same catalog item as the `del /s` form above (windows_drive_delete): ONE
+    // console toggle, two syntaxes. Duplicate ids are intended — they share a
+    // switch and an action.
+    compileSpec({ id: 'windows_drive_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive Remove-Item on a drive root',
         command: ['remove-item', 'ri'], flags: [String.raw `-recurse\w*`], target: [String.raw `["']?[a-z]:[\\/]?["']?(?:\s|$|[;&|])`] }),
     compileSpec({ id: 'chmod_root_777', category: 'destructive_command', severity: 'high', reason: 'recursive world-writable permission change on root',
         command: ['chmod'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`, String.raw `[0-7]?777`], target: [T_UNIX_ROOT] }),
@@ -243,8 +250,16 @@ const BUILTIN_RULES = [
     { id: 'php_reverse_shell', category: 'reverse_shell', severity: 'high', reason: 'php reverse shell', source: 'builtin',
         pattern: String.raw `\bphp\s+-r\b(?=.*fsockopen)` },
     // Cloud metadata / credential exfiltration
-    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to cloud metadata endpoint', source: 'builtin',
-        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
+    // One terminal rule per CONSOLE toggle (catalog ids) — a single combined rule
+    // meant switching off / asking on one endpoint changed nothing in a shell.
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to the AWS/GCP metadata endpoint (169.254.169.254)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*169\.254\.169\.254)` },
+    { id: 'gcp_metadata_host', category: 'metadata_ssrf', severity: 'high', reason: 'request to the GCP metadata host (metadata.google.internal)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*metadata\.google\.internal)` },
+    { id: 'azure_metadata_host', category: 'metadata_ssrf', severity: 'high', reason: 'request to the Azure metadata host (metadata.azure.com)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*metadata\.azure\.com)` },
+    { id: 'alibaba_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to the Alibaba metadata endpoint (100.100.100.200)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*100\.100\.100\.200)` },
     { id: 'credential_exfiltration', category: 'secret_exfiltration', severity: 'critical', reason: 'credential file sent to the network', source: 'builtin',
         pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
     // Infra destroy — spec-compiled where flags matter (order-independent).
@@ -268,6 +283,10 @@ const BUILTIN_RULES = [
         command: ['kubectl'], extra: [String.raw `\bdelete\s+(?:pvc|persistentvolumeclaims?)\b`], flags: [String.raw `--all`] }),
     { id: 'kubectl_delete_namespace', category: 'infra_destroy', severity: 'high', reason: 'destructive kubectl namespace delete', source: 'builtin',
         pattern: String.raw `\bkubectl\s+delete\s+(?:namespace|ns)\b` },
+    // Catalog item (strict, OFF by default — DEFAULT_DISABLED_BUILT_INS): any
+    // kubectl delete. Present so the console toggle means something in a shell.
+    { id: 'generic_kubectl_delete', category: 'infra_destroy', severity: 'medium', reason: 'kubectl delete (any resource)', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\b` },
     { id: 'gcloud_project_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP project deletion', source: 'builtin',
         pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
     { id: 'gcloud_sql_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP SQL instance deletion', source: 'builtin',
@@ -287,10 +306,11 @@ const BUILTIN_RULES = [
     // Version-control footguns — imported from shellfirm / Sigma (git group).
     compileSpec({ id: 'git_force_push', category: 'vcs_danger', severity: 'high', reason: 'git force push (overwrites remote history)',
         command: ['git'], extra: [String.raw `\bpush\b`], flags: [String.raw `--force|-f\b`], neg: [String.raw `\s--force-with-lease`] }),
-    compileSpec({ id: 'git_reset_hard', category: 'vcs_danger', severity: 'medium', reason: 'git reset --hard (discards local changes)',
-        command: ['git'], extra: [String.raw `\breset\b`], flags: [String.raw `--hard`] }),
-    compileSpec({ id: 'git_clean_force', category: 'vcs_danger', severity: 'medium', reason: 'git clean -fd (deletes untracked files)',
-        command: ['git'], extra: [String.raw `\bclean\b`], flags: [String.raw `-[a-z]*f`, String.raw `-[a-z]*d`] }),
+    // One catalog item covers both forms (console: "Git destructive clean/reset",
+    // OFF by default) — same id + regex as the IDE guard, so the console toggle
+    // means the same thing in a terminal as it does for an agent.
+    { id: 'git_clean_force', category: 'vcs_danger', severity: 'medium', reason: 'destructive git clean/reset (discards local work)', source: 'builtin',
+        pattern: String.raw `\bgit\s+(?:reset\s+--hard|clean\s+-f(?:d|x|dx)?\b)` },
     { id: 'git_branch_delete_force', category: 'vcs_danger', severity: 'low', reason: 'git force-delete branch', source: 'builtin',
         pattern: String.raw `\bgit\s+branch\b(?=[^;&|]*\s-D\b)` },
     // Anti-forensics / tamper
@@ -321,7 +341,38 @@ const BUILTIN_RULES = [
         pattern: String.raw `\btruncate\s+table\b` },
     { id: 'drop_table', category: 'destructive_sql', severity: 'medium', reason: 'DROP TABLE', source: 'builtin',
         pattern: String.raw `\bdrop\s+table\b` },
+    // Credential-revealing commands — the SAME table the IDE/agent guard
+    // evaluates (deterministicGuard.CREDENTIAL_COMMAND_RULES). One definition,
+    // every surface: a rule the console shows as "asks the developer" must ask
+    // the human typing `gh auth token` in PowerShell exactly as it asks an agent.
+    ...deterministicGuard_1.CREDENTIAL_COMMAND_RULES.map((rule) => ({
+        id: rule.itemId,
+        category: rule.categoryId,
+        severity: rule.severity,
+        reason: rule.reason,
+        source: 'builtin',
+        pattern: rule.pattern,
+    })),
 ];
+/**
+ * Leading command names that anchor a built-in rule — what a first-token hook
+ * (cmd.exe doskey) can key on. Derived from the shared tables so a new rule
+ * cannot be added without its command name reaching the cmd guard's index.
+ */
+/** Every built-in terminal rule id, ignoring console toggles (parity tests, docs). */
+function builtinRuleIds() {
+    return BUILTIN_RULES.map(rule => rule.id);
+}
+/** Every built-in terminal rule, all switched ON with default action (parity tests). */
+function builtinRulesAllOn() {
+    return BUILTIN_RULES.map(rule => ({ ...rule, action: 'block' }));
+}
+function builtinRuleCommandNames() {
+    const names = new Set();
+    for (const rule of deterministicGuard_1.CREDENTIAL_COMMAND_RULES)
+        rule.commands.forEach(name => names.add(name));
+    return Array.from(names).sort();
+}
 function escapeDotNetRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -348,6 +399,7 @@ function cachedMode() {
  */
 function cachedDisabledItemIds() {
     const disabled = new Set();
+    let snapshots = 0;
     try {
         for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
@@ -356,6 +408,7 @@ function cachedDisabledItemIds() {
                 const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
                 const ids = parsed?.snapshot?.disabledBuiltInItemIds;
                 if (Array.isArray(ids)) {
+                    snapshots++;
                     for (const id of ids) {
                         if (typeof id === 'string' && id)
                             disabled.add(id);
@@ -366,6 +419,14 @@ function cachedDisabledItemIds() {
         }
     }
     catch { /* no snapshot cache yet */ }
+    // No console snapshot on this machine yet (fresh install, wiped cache): fall
+    // back to the catalog's own default-off set — the same set the IDE/agent
+    // guard applies offline — so a shell never enforces MORE than the IDE does.
+    // The moment a snapshot exists it is authoritative (it lists every off item).
+    if (snapshots === 0) {
+        for (const id of deterministicGuard_1.DEFAULT_DISABLED_BUILT_INS)
+            disabled.add(id);
+    }
     return disabled;
 }
 /**

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.28.0"
+  "version": "1.29.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -32,6 +32,7 @@
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:cmd-guard-perf": "npm run build && node scripts/test-cmd-guard-perf.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
+    "test:shell-parity": "npm run build && node scripts/test-shell-parity.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
     "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",
     "test:realworld-posture": "npm run build && node scripts/test-realworld-posture-fixtures.js",
@@ -86,7 +87,7 @@
     "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
     "test:s4u-migration": "npm run build && node scripts/test-s4u-task-migration.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",