fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/boundaryVerification.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeRuntimeDigest = computeRuntimeDigest;
+exports.runBoundaryVerification = runBoundaryVerification;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+/** Fingerprint the packaged JavaScript; shared by checker evidence and benchmarks. */
+function computeRuntimeDigest() {
+    const digest = (0, crypto_1.createHash)('sha256');
+    const hashDirectory = (directory) => {
+        for (const item of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path.join(directory, item.name);
+            if (item.isSymbolicLink())
+                throw new Error('Cannot fingerprint redirected CLI runtime.');
+            if (item.isDirectory())
+                hashDirectory(file);
+            else if (item.name.endsWith('.js'))
+                digest.update(path.relative(__dirname, file).replace(/\\/g, '/')).update('\0').update(fs.readFileSync(file)).update('\0');
+        }
+    };
+    hashDirectory(__dirname);
+    return digest.digest('hex');
+}
+/** Exercises the installed hook executable, never the commands in its stdin.
+ * A private HOME, cache and IPC address isolate the probe from customer state.
+ * This is checker proof, not proof that an IDE invokes the hook or obeys it.
+ */
+async function runBoundaryVerification() {
+    const entry = path.join(__dirname, 'index.js');
+    const report = {
+        version: 1, ranAt: new Date().toISOString(), basis: 'isolated_hook_fixture',
+        runtimeDigest: computeRuntimeDigest(), checks: [],
+    };
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'fcd-boundary-check-'));
+    const shieldId = 'boundary-verification-fixture';
+    try {
+        fs.writeFileSync(path.join(home, '.fullcourtdefense.yml'), 'apiUrl: http://127.0.0.1:9\n');
+        fs.writeFileSync(path.join(home, '.fullcourtdefense-runtime.json'), JSON.stringify({ [shieldId]: {
+                mode: 'block', version: 'boundary-verification-v1', policyHash: 'boundary-verification-v1',
+                fetchedAt: Date.now(), failClosed: true,
+                actionPolicies: [{ id: 'boundary-verification-deny', name: 'Boundary verification deny fixture',
+                        resourceType: 'tool', enforcement: 'hard', rules: [
+                            { operations: ['ANY'], verdict: 'block', constraints: [{ field: 'command', operator: 'contains', value: 'fcd_probe_denied' }] },
+                            { operations: ['ANY'], verdict: 'block', constraints: [{ field: 'toolName', operator: 'contains', value: 'fcd_probe_denied' }] },
+                            { operations: ['ANY'], verdict: 'block', constraints: [{ field: 'path', operator: 'contains', value: 'fcd_probe_denied' }] },
+                        ] }],
+            } }));
+        // Do not inherit credentials, developer test overrides or a live daemon pipe.
+        const env = {};
+        for (const key of ['SystemRoot', 'WINDIR', 'PATH', 'PATHEXT', 'TEMP', 'TMP', 'LANG']) {
+            if (process.env[key])
+                env[key] = process.env[key];
+        }
+        Object.assign(env, { HOME: home, USERPROFILE: home, APPDATA: home, LOCALAPPDATA: home,
+            FCD_MACHINE_KIND: 'workstation', FCD_DISABLE_OS_NOTIFICATIONS: 'true', FULLCOURTDEFENSE_DEVELOPER_ID: 'boundary-fixture',
+            FCD_VERDICT_PIPE: process.platform === 'win32' ? `\\\\.\\pipe\\fcd-probe-${path.basename(home)}` : path.join(home, 'probe.sock') });
+        const samples = [
+            { boundary: 'shell', event: 'shell', payload: (denied) => ({ command: `echo fcd_probe_${denied ? 'denied' : 'allowed'}` }) },
+            { boundary: 'files', event: 'read', payload: (denied) => ({ file_path: path.join(home, `fcd_probe_${denied ? 'denied' : 'allowed'}.txt`) }) },
+            { boundary: 'mcp', event: 'mcp', payload: (denied) => ({ tool_name: `fcd_probe_${denied ? 'denied' : 'allowed'}`, tool_input: {} }) },
+        ];
+        for (const sample of samples) {
+            const start = Date.now();
+            let allowed = 0;
+            let denied = 0;
+            for (const block of [false, true]) {
+                const result = await new Promise(resolve => {
+                    const child = (0, child_process_1.spawn)(process.execPath, [entry, 'hook', '--event', sample.event,
+                        '--api-url', 'http://127.0.0.1:9', '--shield-id', shieldId, '--shield-key', 'fixture-only',
+                        '--timeout', '100', '--approval-mode', 'block'], {
+                        env, cwd: home, windowsHide: true, stdio: ['pipe', 'pipe', 'ignore'],
+                    });
+                    let stdout = '';
+                    let failed = false;
+                    const timeout = setTimeout(() => { failed = true; child.kill(); }, 5000);
+                    child.stdout.setEncoding('utf8');
+                    child.stdout.on('data', (chunk) => {
+                        if (stdout.length + chunk.length > 128 * 1024) {
+                            failed = true;
+                            child.kill();
+                        }
+                        else
+                            stdout += chunk;
+                    });
+                    child.on('error', () => { clearTimeout(timeout); resolve({ stdout: '', ok: false }); });
+                    child.on('close', code => { clearTimeout(timeout); resolve({ stdout, ok: !failed && code === 0 }); });
+                    child.stdin.on('error', () => { failed = true; });
+                    child.stdin.end(JSON.stringify(sample.payload(block)));
+                });
+                try {
+                    const verdict = JSON.parse(result.stdout || '');
+                    if (result.ok) {
+                        if (!block && verdict.permission === 'allow')
+                            allowed++;
+                        // Require the expected policy evidence: an unrelated infrastructure deny isn't a pass.
+                        if (block && verdict.permission === 'deny' && /Boundary verification deny fixture/.test(verdict.user_message || ''))
+                            denied++;
+                    }
+                }
+                catch { /* Invalid output is a failed probe, never an allow. */ }
+            }
+            report.checks.push({ boundary: sample.boundary, status: allowed === 1 && denied === 1 ? 'passed' : 'failed', allowed, denied, durationMs: Date.now() - start });
+        }
+        report.checks.push({ boundary: 'network', status: 'unavailable', allowed: 0, denied: 0, durationMs: 0 });
+        return report;
+    }
+    finally {
+        // Only the exact directory returned by mkdtemp above; no user-provided path.
+        await fs.promises.rm(home, { recursive: true, force: true, maxRetries: 20, retryDelay: 100 });
+    }
+}

package/dist/commands/daemon.js

@@ -71,9 +71,11 @@ const protectionRepair_1 = require("./protectionRepair");
 const runtimeConfig_1 = require("../runtimeConfig");
 const discoverPaths_1 = require("./discoverPaths");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
+const policyRefresh_1 = require("../policyRefresh");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
+const protectionMaintenance_1 = require("../protectionMaintenance");
 const machineIdentity_1 = require("../machineIdentity");
 const localDetectionUpdates_1 = require("../localDetectionUpdates");
 const discoveryMarker_1 = require("../discoveryMarker");
@@ -102,19 +104,18 @@ function envMs(name, fallback) {
     const value = Number(process.env[name]);
     return Number.isFinite(value) && value > 0 ? value : fallback;
 }
-/** How long after our own protect-all writes we ignore watcher events (self-inflicted churn). */
-const SELF_WRITE_QUIET_MS = envMs('FCD_DAEMON_QUIET_MS', 5_000);
 /** Debounce window for filesystem events before re-protecting. */
 const DEBOUNCE_MS = envMs('FCD_DAEMON_DEBOUNCE_MS', 2_000);
+/** Recheck a failed repair after concurrent editor writes have settled. */
+const PROTECTION_NOTICE_DELAY_MS = envMs('FCD_PROTECTION_NOTICE_DELAY_MS', 5_000);
 /** Re-enumerate config files this often to pick up newly installed clients. */
 const RESCAN_INTERVAL_MS = envMs('FCD_DAEMON_RESCAN_MS', 5 * 60_000);
 /** Heartbeat / spool flush cadence. */
 const HEARTBEAT_INTERVAL_MS = envMs('FCD_DAEMON_HEARTBEAT_MS', 5 * 60_000);
 /**
- * Floor between integrity-triggered repairs. The drift watcher reacts to config
- * CHANGES; this path reacts to a failing verdict, which persists until fixed. If
- * a repair cannot fix it (no write permission, a config owned by another
- * install) an uncooled retry would re-run protect-all every heartbeat forever.
+ * Backoff after an unsuccessful repair. A successful repair must not delay a
+ * later, independent gap (for example a new Git worktree's MCP configuration).
+ * If a repair cannot fix a gap, retrying every heartbeat would churn configs.
  */
 const INTEGRITY_HEAL_COOLDOWN_MS = envMs('FCD_INTEGRITY_HEAL_COOLDOWN_MS', 60 * 60_000);
 /** Bundle (mode / suspension / policy version) poll cadence. */
@@ -536,11 +537,14 @@ async function runDaemon(args, config) {
     // --- state ---------------------------------------------------------------
     const watchers = new Map(); // directory -> watcher
     const rootWatchers = new Map(); // admin protection roots -> recursive watcher
-    const watchedFiles = new Set(); // lowercased absolute file paths we react to
-    let quietUntil = 0; // ignore events until this time (self-writes)
+    const watchedFiles = new Set(); // actual paths, also read on case-sensitive filesystems
+    const watchedFileKeys = new Set();
     let debounceTimer = null;
-    let reprotecting = false;
-    let lastIntegrityHealAt = 0; // cooldown anchor for integrity-triggered repairs
+    let repairInFlight;
+    let repairFailed = false;
+    let observedConfigurations = new Map();
+    let refreshPending = false;
+    let lastIntegrityHealFailureAt;
     let suspended = false;
     let stopped = false;
     const executingActionIds = new Set();
@@ -637,62 +641,173 @@ async function runDaemon(args, config) {
         }
         catch { /* next tick */ }
     };
-    /**
-     * One repair path, two triggers: a watched config CHANGED (drift), or the
-     * integrity check reported a reason protect-all can fix (integrity). Keeping
-     * them on the same function preserves the reprotecting/quiet-window guards —
-     * a second copy would race this one and re-enter protect-all concurrently.
-     */
+    // Persist only whether the user has been warned, so daemon restarts do not
+    // repeat the same unresolved incident. No configuration or action contents.
+    const noticeFile = path.join(daemonDir(), 'protection-notice.json');
+    let attentionShown = false;
+    let attentionTimer;
+    try {
+        attentionShown = JSON.parse(fs.readFileSync(noticeFile, 'utf8')).attentionShown === true;
+    }
+    catch { /* first run */ }
+    const deliverProtectionHealth = (healthy) => {
+        const next = (0, protectionMaintenance_1.protectionNoticeTransition)(attentionShown, healthy, quiet);
+        if (next.attentionShown !== attentionShown) {
+            attentionShown = next.attentionShown;
+            try {
+                const tmp = `${noticeFile}.tmp-${process.pid}`;
+                fs.writeFileSync(tmp, JSON.stringify({ attentionShown }), 'utf8');
+                fs.renameSync(tmp, noticeFile);
+            }
+            catch { /* notification persistence is best-effort */ }
+        }
+        if (!next.notice)
+            return;
+        (0, notify_1.notifyOs)({
+            title: next.notice === 'attention' ? 'FullCourtDefense needs attention' : 'FullCourtDefense protection restored',
+            message: next.notice === 'attention'
+                ? 'Some protection checks are still failing. Open this machine to review and repair its protection.'
+                : 'Protection checks now pass. You can review the repair in this machine’s activity.',
+            url: (0, notify_1.consoleUrl)(`/agent-security/machines/${encodeURIComponent((0, machineIdentity_1.getMachineIdentity)().machineId)}`),
+        });
+    };
+    const reportProtectionHealth = (healthy) => {
+        if (healthy) {
+            if (attentionTimer)
+                clearTimeout(attentionTimer);
+            attentionTimer = undefined;
+            deliverProtectionHealth(true);
+        }
+        else if (!quiet && !attentionShown && !attentionTimer && !suspended && !stopped) {
+            // This delays only the courtesy notice. Repairs and unhealthy heartbeat
+            // evidence continue immediately, even while this one recheck is pending.
+            attentionTimer = setTimeout(() => {
+                attentionTimer = undefined;
+                if (stopped || suspended)
+                    return;
+                let verified = false;
+                try {
+                    verified = !repairFailed && (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true }).ok;
+                }
+                catch { /* cannot verify */ }
+                deliverProtectionHealth(verified);
+            }, PROTECTION_NOTICE_DELAY_MS);
+        }
+    };
+    const inspectProtection = () => {
+        // Snapshot BEFORE verification. An external write during/after inspection
+        // remains different from this baseline and its queued event gets checked.
+        const snapshot = (0, protectionMaintenance_1.captureProtectionConfiguration)(watchedFiles);
+        const integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+        observedConfigurations = snapshot;
+        return integrity;
+    };
+    /** One serialized repair path, including remote requests and new discovery. */
     const reprotect = async (reasonPaths, cause = 'drift') => {
-        const headline = cause === 'integrity' ? 'Integrity self-heal' : 'Config drift detected';
-        if (reprotecting || stopped)
+        if (repairInFlight) {
+            await repairInFlight;
+            // Re-check after the previous pass: do not discard damage discovered
+            // while it was running, or overlap a remote repair with a watch repair.
+            return reprotect(reasonPaths, cause);
+        }
+        const headline = cause === 'integrity' ? 'Integrity self-heal'
+            : cause === 'discovery' ? 'New protection configuration discovered' : 'Config drift detected';
+        if (stopped)
             return;
         if (suspended) {
             log(`${headline} (${reasonPaths.join(', ')}) but machine is suspended — not re-protecting.`);
             return;
         }
-        reprotecting = true;
-        quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
-        log(`${headline}: ${reasonPaths.join(', ')} — re-running protect-all.`);
-        try {
-            const repaired = await (0, protectionRepair_1.repairProtection)({ ...args, dryRun: undefined }, config);
-            quietUntil = Date.now() + SELF_WRITE_QUIET_MS;
-            log(`Re-protection pass complete (Cursor hooks ${repaired.cursorHooksHealthy ? 'healthy' : 'unhealthy'}, Claude hooks ${repaired.claudeHooksHealthy ? 'healthy' : 'unhealthy'}).`);
-            refreshWatchTargets();
-            await uploadLogTail();
-            if (!quiet) {
-                (0, notify_1.notifyOs)({
-                    title: 'FullCourtDefense re-protected this machine',
-                    message: cause === 'integrity'
-                        ? 'Protection was reported incomplete; the FullCourtDefense gateway was re-applied.'
-                        : 'An MCP or hook config changed; the FullCourtDefense gateway was re-applied.',
-                    url: (0, notify_1.consoleUrl)('/agent-security/users?view=desktop'),
-                });
+        repairInFlight = (async () => {
+            try {
+                const before = inspectProtection();
+                // Integrity/discovery triggers use the shared healable taxonomy. A real
+                // content change still runs the full idempotent repair pipeline: the
+                // integrity summary does not cover every hook migration/companion.
+                if ((cause === 'integrity' || cause === 'discovery') && !repairFailed && !(0, integrity_1.hasHealableIntegrityReason)(before.reasons)) {
+                    reportProtectionHealth(before.ok && !repairFailed);
+                    return before;
+                }
+                const startedAt = Date.now();
+                const beforeFiles = observedConfigurations;
+                log(`${headline}: ${reasonPaths.join(', ')} — re-running protect-all.`);
+                let integrity = before;
+                // One bounded convergence retry handles an editor writing immediately
+                // after our write, including when its watch event is lost. Persistent
+                // failures still enter the existing backoff, never a repair spin loop.
+                for (let attempt = 1; attempt <= 2; attempt++) {
+                    const repaired = await (0, protectionRepair_1.repairProtection)({ ...args, dryRun: undefined }, config);
+                    refreshWatchTargets();
+                    integrity = inspectProtection();
+                    log(`Re-protection pass complete (Cursor hooks ${repaired.cursorHooksHealthy ? 'healthy' : 'unhealthy'}, Claude hooks ${repaired.claudeHooksHealthy ? 'healthy' : 'unhealthy'}).`);
+                    if (!(0, integrity_1.hasHealableIntegrityReason)(integrity.reasons) || suspended || stopped)
+                        break;
+                    if (attempt === 1)
+                        log('Re-protection has not converged; rechecking once before failure backoff.');
+                }
+                const changedFiles = (0, protectionMaintenance_1.changedProtectionConfiguration)(beforeFiles, observedConfigurations);
+                repairFailed = false;
+                log(`Re-protection verified: ${integrity.ok ? 'healthy' : 'incomplete'}; ${changedFiles.length} config file(s) changed; ${Date.now() - startedAt}ms.`);
+                lastIntegrityHealFailureAt = (0, integrity_1.hasHealableIntegrityReason)(integrity.reasons) ? Date.now() : undefined;
+                if (!integrity.ok)
+                    log(`Re-protection verification still failing: ${integrity.reasons.join(', ')}.`);
+                reportProtectionHealth(integrity.ok);
+                await uploadLogTail();
+                return integrity;
             }
-        }
-        catch (error) {
-            log(`Re-protection failed: ${error.message}`);
+            catch (error) {
+                repairFailed = true;
+                lastIntegrityHealFailureAt = Date.now();
+                log(`Re-protection failed: ${error.message}`);
+                reportProtectionHealth(false);
+                // A remote repair must report its execution failure even when the
+                // narrower integrity summary does not describe the failing component.
+                if (cause === 'manual')
+                    throw error;
+            }
+        })();
+        try {
+            return await repairInFlight;
         }
         finally {
-            reprotecting = false;
+            repairInFlight = undefined;
         }
     };
+    const scheduleProtectionCheck = () => {
+        if (debounceTimer)
+            clearTimeout(debounceTimer);
+        debounceTimer = setTimeout(() => {
+            debounceTimer = null;
+            void (async () => {
+                if (repairInFlight)
+                    await repairInFlight;
+                if (stopped)
+                    return;
+                if (refreshPending) {
+                    refreshPending = false;
+                    refreshWatchTargets();
+                }
+                const current = (0, protectionMaintenance_1.captureProtectionConfiguration)(watchedFiles);
+                const changed = (0, protectionMaintenance_1.changedProtectionConfiguration)(observedConfigurations, current);
+                if (changed.length > 0)
+                    await reprotect(changed);
+            })().catch(error => log(`Protection change check failed: ${error.message}`));
+        }, DEBOUNCE_MS);
+    };
     const onFsEvent = (dir, filename) => {
-        if (stopped || Date.now() < quietUntil)
+        if (stopped)
             return;
         const full = filename ? path.resolve(dir, filename.toString()) : dir;
         const key = full.toLowerCase();
         // Ignore our own backup files and unrelated churn in watched directories.
         if (key.includes('.fcd-backup-'))
             return;
-        if (filename && !watchedFiles.has(key))
+        if (filename && !watchedFileKeys.has(key))
             return;
-        if (debounceTimer)
-            clearTimeout(debounceTimer);
-        debounceTimer = setTimeout(() => { void reprotect([full]); }, DEBOUNCE_MS);
+        scheduleProtectionCheck();
     };
     const onAdminRootEvent = (root, filename) => {
-        if (stopped || Date.now() < quietUntil || !filename)
+        if (stopped || !filename)
             return;
         const full = path.resolve(root, filename.toString());
         const normalized = full.replace(/\\/g, '/').toLowerCase();
@@ -703,12 +818,8 @@ async function runDaemon(args, config) {
         const { disabledScanRoots } = (0, runtimeConfig_1.getCachedScanRootOverrides)();
         if ((0, discoverPaths_1.isExcludedPath)(full, disabledScanRoots))
             return;
-        if (debounceTimer)
-            clearTimeout(debounceTimer);
-        debounceTimer = setTimeout(() => {
-            refreshWatchTargets();
-            void reprotect([full]);
-        }, DEBOUNCE_MS);
+        refreshPending = true;
+        scheduleProtectionCheck();
     };
     /**
      * (Re)build the watch set from the current MCP client configs + hook files.
@@ -721,9 +832,11 @@ async function runDaemon(args, config) {
             ...hookConfigFiles(),
         ];
         watchedFiles.clear();
+        watchedFileKeys.clear();
         const wantedDirs = new Set();
         for (const file of targets) {
-            watchedFiles.add(path.resolve(file).toLowerCase());
+            watchedFiles.add(path.resolve(file));
+            watchedFileKeys.add(path.resolve(file).toLowerCase());
             wantedDirs.add(path.dirname(path.resolve(file)));
         }
         for (const [dir, watcher] of watchers) {
@@ -1036,16 +1149,9 @@ async function runDaemon(args, config) {
                     throw new Error('Shield not configured on this machine.');
                 const shieldId = creds.shieldId;
                 const identity = (0, machineIdentity_1.getMachineIdentity)();
-                log('Policy refresh: clearing Local Safety snapshot caches…');
-                // Clear EVERY snapshot cache file, not one derived key: the hooks key
-                // their cache by hookSnapshotIdentity() (raw username@hostname) while
-                // getMachineIdentity() normalizes both — a targeted unlink under the
-                // normalized key used to MISS the hooks' actual cache file, so
-                // "policy refresh" never actually refreshed the hot-path snapshot.
-                (0, localSafetySnapshot_1.clearAllLocalSafetySnapshotCaches)();
                 await uploadLogTail();
                 log('Policy refresh: pulling latest policy bundle from control plane…');
-                const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
+                const bundle = await (0, policyRefresh_1.refreshMachinePolicies)({
                     apiUrl: creds.apiUrl,
                     shieldId,
                     shieldKey: creds.shieldKey,
@@ -1068,7 +1174,7 @@ async function runDaemon(args, config) {
                     throw new Error('Machine is suspended; resume it before repairing protection.');
                 log('Repair protection: running protect-all (IDE hooks + MCP gateways)…');
                 await uploadLogTail();
-                await (0, protectionRepair_1.repairProtection)({ ...args, dryRun: undefined }, config);
+                await reprotect(['remote repair request'], 'manual');
                 log('Repair protection: verifying hooks, gateways and daemon integrity…');
                 const verification = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
                 if (!verification.ok) {
@@ -1206,6 +1312,7 @@ async function runDaemon(args, config) {
         if (!creds.shieldId)
             return;
         void localDetectionUpdates_1.localDetectionUpdates.refresh();
+        void localDetectionUpdates_1.localDetectorUpdates.refresh();
         if (!creds.shieldKey) {
             // Credential-broken machine: stay reachable via the key-less signed-
             // action channel while credential recovery keeps retrying.
@@ -1343,23 +1450,33 @@ async function runDaemon(args, config) {
         let reported = false;
         try {
             let integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
+            // Recovery outside our repair pass (for example a manual fix) also clears
+            // the old failure's backoff. It must not suppress an unrelated later gap.
+            // An execution error can concern a component outside this summary (e.g.
+            // Copilot settings); keep its backoff until the full pipeline retries.
+            if (integrity.ok && !repairFailed)
+                lastIntegrityHealFailureAt = undefined;
             // A failing verdict used to be REPORTED and nothing more, so a machine
             // could sit "Damaged" in the console indefinitely on a reason the daemon
             // already knows how to fix — the drift watcher only fires when a config
             // file changes, and a stale gateway path changes nothing. Heal first, then
             // report what is true AFTER the repair rather than the verdict that
             // triggered it.
-            if (!integrity.ok
+            if ((!integrity.ok || repairFailed)
                 && !suspended
-                && Date.now() - lastIntegrityHealAt >= INTEGRITY_HEAL_COOLDOWN_MS
-                && (0, integrity_1.hasHealableIntegrityReason)(integrity.reasons)) {
-                lastIntegrityHealAt = Date.now();
-                await reprotect(integrity.reasons, 'integrity');
+                && (lastIntegrityHealFailureAt === undefined
+                    || Date.now() - lastIntegrityHealFailureAt >= INTEGRITY_HEAL_COOLDOWN_MS)
+                && (repairFailed || (0, integrity_1.hasHealableIntegrityReason)(integrity.reasons))) {
+                const repaired = await reprotect(integrity.reasons, 'integrity');
                 integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
-                log(integrity.ok
-                    ? 'Integrity self-heal: protection restored.'
-                    : `Integrity self-heal: still failing (${integrity.reasons.join(', ')}) — reported for support.`);
+                if (repaired) {
+                    log(integrity.ok
+                        ? 'Integrity self-heal: protection restored.'
+                        : `Integrity self-heal: still failing (${integrity.reasons.join(', ')}) — reported for support.`);
+                }
             }
+            if (!suspended)
+                reportProtectionHealth(integrity.ok && !repairFailed);
             // Report a previous daemon's unclean death exactly once.
             const crash = (0, daemonForensics_1.readPostmortem)();
             const unreportedCrash = crash && !crash.reportedAt ? crash : undefined;
@@ -1437,7 +1554,7 @@ async function runDaemon(args, config) {
     // legitimately leave stale hook/wrap paths behind, and heartbeating first
     // would report a false "damaged" state (and fire admin integrity alerts)
     // for a condition the very next line repairs.
-    await reprotect(['startup pass']);
+    await reprotect(['startup pass'], 'startup');
     // The FIRST beat must not be able to abort the rest of this function.
     // `heartbeat` throws when the report did not reach the backend (that is how
     // the poll loop knows to retry in seconds), and an exception here propagates
@@ -1553,8 +1670,17 @@ async function runDaemon(args, config) {
     const discoverCatchUpBootTimer = setTimeout(() => { void maybeCatchUpDiscovery('after start'); }, DISCOVER_BOOT_CATCHUP_DELAY_MS + Math.floor(Math.random() * DISCOVER_BOOT_CATCHUP_JITTER_MS));
     const discoverCatchUpTimer = setInterval(() => { void maybeCatchUpDiscovery('hourly check'); }, DISCOVER_CHECK_INTERVAL_MS);
     const rescanTimer = setInterval(() => {
+        const previousTargets = new Set(watchedFiles);
         const count = refreshWatchTargets();
         log(`Rescan: watching ${count} config file(s).`);
+        // A config created before its parent was watched emits no event for us.
+        // Discovery is therefore a repair trigger, even during another gap's
+        // failure backoff. Repeated scans of the same targets do not retry it.
+        const added = [...watchedFiles].filter(file => !previousTargets.has(file));
+        if (added.length > 0 && !suspended && !stopped
+            && (0, integrity_1.hasHealableIntegrityReason)((0, integrity_1.getLocalIntegrityReport)().reasons)) {
+            void reprotect(added, 'discovery');
+        }
     }, RESCAN_INTERVAL_MS);
     // Jittered self-rescheduling polls (±20%) instead of fixed setInterval:
     // a fleet enrolled behind one corporate proxy must not hit the gate in
@@ -1679,6 +1805,8 @@ async function runDaemon(args, config) {
             clearTimeout(initialDiscoverTimer);
         if (debounceTimer)
             clearTimeout(debounceTimer);
+        if (attentionTimer)
+            clearTimeout(attentionTimer);
         if (desktopChatGuard)
             desktopChatGuard.stop();
         if (verdictServer)

package/dist/commands/deterministicGuard.d.ts

@@ -55,6 +55,8 @@ export interface LocalSafetyScanOptions {
      * legacy "absent item = block" contract for callers that don't set it.
      */
     snapshotPresent?: boolean;
+    /** Captured transport identity, separate from untrusted tool argument data. */
+    mcpServerName?: string;
     customBlocks?: LocalSafetyCustomBlock[];
     policyHash?: string;
     cwd?: string;