fullcourtdefense-cli 1.35.10 → 1.36.0

package/dist/actionPolicyEngine.d.ts

@@ -268,6 +268,7 @@ export interface ShellAstOperationComparison {
     agree: boolean;
 }
 export declare function setShellAstProvider(provider: ((command: string) => ShellAstFactsLike | undefined) | undefined): void;
+export declare function setRemoteControlProvider(provider: ((command: string) => string | undefined) | undefined): void;
 export declare function setShellAstMode(mode: ShellAstMode): void;
 export declare function getShellAstMode(): ShellAstMode;
 /** Shadow telemetry: the comparison recorded by the most recent top-level shell classification (consumed once). */

package/dist/actionPolicyEngine.js

@@ -42,6 +42,7 @@ __export(actionPolicyEngine_exports, {
   resolveApprovalOptions: () => resolveApprovalOptions,
   roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
+  setRemoteControlProvider: () => setRemoteControlProvider,
   setShellAstMode: () => setShellAstMode,
   setShellAstProvider: () => setShellAstProvider,
   takeShellAstOperationComparison: () => takeShellAstOperationComparison,
@@ -6777,6 +6778,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "tool.status",
   "operation.status",
   "agent.baseline",
+  "toolArgs.remoteControl",
   // Identity / metadata — NOT action signals. Excluded so the tool/agent name can never
   // pollute operation matching.
   "toolName",
@@ -8160,6 +8162,10 @@ var lastShellAstOperationComparison;
 function setShellAstProvider(provider) {
   shellAstProvider = provider;
 }
+var remoteControlProvider;
+function setRemoteControlProvider(provider) {
+  remoteControlProvider = provider;
+}
 function setShellAstMode(mode) {
   shellAstMode = mode;
 }
@@ -8719,9 +8725,22 @@ function inferToolContext(toolName, args) {
     context["destination.type"] = context["request.destination.type"];
     context["destination.domain"] = context["request.destination.domain"];
   }
+  applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
+function applyRemoteControlFact(toolName, args, context) {
+  delete context["toolArgs.remoteControl"];
+  const shellText = remoteControlProvider ? shellCommandTextOf(toolName, args) : void 0;
+  if (!shellText || !remoteControlProvider) return;
+  let bridge;
+  try {
+    bridge = remoteControlProvider(shellText);
+  } catch {
+    bridge = void 0;
+  }
+  if (bridge) context["toolArgs.remoteControl"] = bridge;
+}
 var WEB_READ_TOOL_NAMES = /* @__PURE__ */ new Set(["webfetch", "fetchwebpage", "webextract"]);
 function applyWebReadFacts(toolName, args, context) {
   if (!WEB_READ_TOOL_NAMES.has(toolName.toLowerCase().replace(/[_\-.\s]/g, ""))) return;
@@ -8855,6 +8874,7 @@ function inferBundledToolContext(toolName, args) {
       context["destination.type"] = isInternalHost(context["destination.domain"]) ? "internal" : "external";
     }
   }
+  applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
@@ -8975,6 +8995,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   resolveApprovalOptions,
   roleExceptionError,
   ruleNeedsContentFact,
+  setRemoteControlProvider,
   setShellAstMode,
   setShellAstProvider,
   takeShellAstOperationComparison,

package/dist/commands/cmdGuard.js

@@ -106,6 +106,8 @@ const FIXED_INTERCEPTED_COMMANDS = [
 const CMD_HIGH_FREQUENCY_COMMANDS = new Set([
     'docker', 'git', 'kubectl', 'aws', 'gcloud', 'az', 'terraform', 'pulumi', 'wsl',
     'curl', 'wget', 'taskkill', 'robocopy', 'xcopy', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
+    // Package managers: `npm exec` / `pnpm dlx` bridges are covered in PowerShell and the IDE; cmd keeps `npx`.
+    'npm', 'pnpm', 'yarn', 'bun', 'uv',
 ]);
 /**
  * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that

package/dist/commands/daemon.js

@@ -466,7 +466,26 @@ function hookConfigFiles() {
 // ---------------------------------------------------------------------------
 // The resident loop
 // ---------------------------------------------------------------------------
+/**
+ * A daemon started while the updater replaces the install (logon trigger, a
+ * pre-fix watchdog, a manual start) would put the old build — and its own
+ * update kick — into the middle of msiexec. Wait for the run instead. Bounded
+ * by the lock's max age; stage 2 relaunches the daemon when it finishes.
+ */
+async function waitForActiveUpdaterRun() {
+    let run = (0, selfUpdate_1.readActiveUpdaterRun)();
+    if (!run)
+        return;
+    log(`An updater run is installing${run.targetVersion ? ` ${run.targetVersion}` : ''} (${run.stage || 'running'}, since ${run.startedAt || 'unknown'}) — daemon start waits for it to finish.`);
+    const deadline = Date.now() + (0, selfUpdate_1.updaterLockMaxAgeMs)();
+    while (run && Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, 5_000));
+        run = (0, selfUpdate_1.readActiveUpdaterRun)();
+    }
+    log('Updater run finished — continuing daemon start.');
+}
 async function runDaemon(args, config) {
+    await waitForActiveUpdaterRun();
     if (!acquirePidLock(await detectRecycledPidOwner())) {
         console.log(`${COLOR.yellow}Another FullCourtDefense daemon is already running (pid file: ${pidFile()}).${COLOR.reset}`);
         return;
@@ -518,7 +537,11 @@ async function runDaemon(args, config) {
         log(`Shield key UNAVAILABLE${ph && !ph.spawnOk ? ' — powershell.exe could not start (EDR/policy block?), so the DPAPI-protected key cannot be decrypted' : ''}. Telemetry/control-plane sync disabled; retrying periodically.`);
     }
     // Crash forensics: was the previous daemon killed without a clean shutdown?
+    const previousMarker = (0, daemonForensics_1.readAliveMarker)();
     const postmortem = (0, daemonForensics_1.recordDaemonStart)({ version: cliVersion(), isPidAlive });
+    if (previousMarker?.cleanExit?.reason === 'stopped-for-update' && previousMarker.pid !== process.pid) {
+        log(`Previous daemon (v${previousMarker.version || '?'}) was stopped for update by the updater (${previousMarker.cleanExit.at}) — expected, not a crash.`);
+    }
     if (postmortem) {
         const current = cliVersion();
         if (postmortem.version && current && postmortem.version !== current) {
@@ -529,6 +552,13 @@ async function runDaemon(args, config) {
         else if (postmortem.cause === 'machine_restart') {
             log(`Previous daemon (v${postmortem.version || '?'}) stopped when the machine restarted (booted ${postmortem.machineBootedAt || 'after its last heartbeat'}; last alive ${postmortem.lastAliveAt || 'unknown'}). Expected, not a crash. Post-mortem recorded for the timeline.`);
         }
+        else if ((0, selfUpdate_1.deathDuringUpdaterRun)(postmortem.lastAliveAt, (0, selfUpdate_1.readActiveUpdaterRun)() || (0, selfUpdate_1.readLastUpdaterResult)())) {
+            // Same version, but an updater run was replacing the install when it
+            // died (an update that failed, or a run whose marker stamp was lost):
+            // stopped for update — never an EDR/AV kill in the console.
+            (0, daemonForensics_1.markPostmortemReported)();
+            log(`Previous daemon (v${postmortem.version || '?'}) stopped for update — an updater run was replacing the install when it died (last alive ${postmortem.lastAliveAt || 'unknown'}). Not a crash; not reported as one.`);
+        }
         else {
             log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
         }
@@ -1067,13 +1097,23 @@ async function runDaemon(args, config) {
             return;
         }
         const startedAt = marker.startedAt ? Date.parse(marker.startedAt) : NaN;
-        if (!Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
+        // The install is still running: its own outcome settles this, not a timer.
+        if ((0, selfUpdate_1.readActiveUpdaterRun)())
+            return;
+        // The updater recorded a failed run for this target after the kick —
+        // report its reason now instead of waiting out the stale timer.
+        const lastRun = (0, selfUpdate_1.readLastUpdaterResult)();
+        const runFailed = lastRun?.outcome === 'failed' && lastRun.targetVersion === marker.target
+            && Number.isFinite(startedAt) && Date.parse(lastRun.finishedAt || '') >= startedAt;
+        if (runFailed || !Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
             try {
                 fs.unlinkSync(pendingUpgradeFile());
             }
             catch { /* ignore */ }
             await reportMachineAction(marker.actionId, 'failed', {
-                error: `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
+                error: runFailed
+                    ? `The updater could not install ${marker.target}: ${lastRun?.error || 'unknown error'} The machine stays on ${current || 'unknown'}; see %ProgramData%\\FullCourtDefense\\updater.log.`
+                    : `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
             }, marker.signatureProof);
             log(`Upgrade verification failed: still on ${current || 'unknown'}, target was ${marker.target} (action ${marker.actionId}).`);
             await uploadLogTail();

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,5 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot' | 'agent_guard_tamper';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'remote_control' | 'honeypot' | 'agent_guard_tamper';
 /**
  * Per-rule enforcement action (org-configured, shipped in the Local Safety
  * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and
@@ -34,6 +34,8 @@ export interface DeterministicFinding {
      * findings — the seam 'mask' uses to redact tool responses. Never spooled.
      */
     matchedSecret?: string;
+    /** Catalog facts for remote_control findings (bridge id, mode, launcher) — no argument text. */
+    remoteControl?: RemoteControlFacts;
 }
 export interface LocalSafetyCustomBlock {
     id: string;
@@ -90,7 +92,7 @@ export declare const DEFAULT_DISABLED_BUILT_INS: ReadonlySet<string>;
 export interface SharedCommandRule {
     itemId: string;
     /** Catalog category id (local-safety-catalog.ts). */
-    categoryId: 'credential_commands';
+    categoryId: 'credential_commands' | 'remote_control';
     severity: 'critical' | 'high' | 'medium' | 'low';
     pattern: string;
     reason: string;
@@ -106,6 +108,64 @@ export interface SharedCommandRule {
  * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+export declare const REMOTE_CONTROL_CATALOG_VERSION = "2026-09-26.1";
+export interface RemoteControlFacts {
+    /** Catalog entry id. */
+    bridge: string;
+    /** Catalog mode label: 'remote' | 'serve' | 'connect'. */
+    mode: string;
+    /** How it was started: 'npx', 'npm exec', 'pnpm dlx', …, or 'direct' for an installed binary. */
+    launcher: string;
+}
+export interface RemoteControlBridge {
+    id: string;
+    title: string;
+    kind: 'remote_control' | 'remote_connector';
+    /** Registry package names (npm / PyPI), as typed after a launcher. */
+    packages: string[];
+    /** Executable names when installed globally or run from node_modules/.bin. */
+    bins: string[];
+    mode: 'remote' | 'serve' | 'connect';
+    /** Regex source applied right after the package token (JS + .NET, IgnoreCase). */
+    modePattern: string;
+    /** Short label for the console and evidence. */
+    label: string;
+    /** Decision Card sentence — what starting it means, in plain words. */
+    card: string;
+}
+export declare const REMOTE_CONTROL_BRIDGES: readonly RemoteControlBridge[];
+/** The positional pattern for one catalog entry: program at a statement start, package, then its mode. */
+export declare function remoteControlBridgePattern(bridge: RemoteControlBridge): string;
+/** Shared command rules for the terminal guards: one per remote-control entry, same Local Safety item. */
+export declare const REMOTE_CONTROL_COMMAND_RULES: readonly SharedCommandRule[];
+export interface RemoteControlMatch {
+    bridge: RemoteControlBridge;
+    facts: RemoteControlFacts;
+}
+/** A shell line that starts a remote-control bridge (any statement, any de-obfuscated variant). */
+export declare function remoteControlBridgeInCommand(command: string): RemoteControlMatch | undefined;
+/**
+ * An MCP server launch (config `command` + `args`) that is a catalogued bridge:
+ * a remote-control bridge first, else a remote connector. Arguments with
+ * spaces are re-quoted so a `--stdio "npx server"` value stays one argument.
+ */
+export declare function classifyRemoteMcpLaunch(command: string | undefined, args?: readonly string[]): RemoteControlMatch | undefined;
+/** Wire-supplied facts constrained to the catalog vocabulary (backend ingest); anything else is dropped. */
+export declare function sanitizeRemoteControlFacts(raw: unknown): RemoteControlFacts | undefined;
+/** The engine fact provider: the catalog id of the remote-control bridge this line starts. */
+export declare function remoteControlFactFor(command: string): string | undefined;
+/** What an "Always allow" on a bridge is bound to: the package and its mode, never the launcher that ran it. */
+export declare function remoteControlGrantKey(bridge: RemoteControlBridge): string;
+/**
+ * Every distinct remote-control bridge a line starts (as grant keys), plus the
+ * line with each verbatim launch cut out — statement separators kept — so the
+ * caller can still read the OTHER programs on the line. A launch seen only in a
+ * de-obfuscated variant is not cut: the rest is over-counted, never under-counted.
+ */
+export declare function remoteControlLaunches(command: string): {
+    bridges: string[];
+    rest: string;
+};
 export type ShellAstMode = 'off' | 'shadow' | 'primary';
 /** Structural subset of shellAst.ts ShellFacts that the guard reads. */
 export interface ShellAstFactsLike {

package/dist/commands/deterministicGuard.js

@@ -33,8 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
+exports.REMOTE_CONTROL_COMMAND_RULES = exports.REMOTE_CONTROL_BRIDGES = exports.REMOTE_CONTROL_CATALOG_VERSION = exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.remoteControlBridgePattern = remoteControlBridgePattern;
+exports.remoteControlBridgeInCommand = remoteControlBridgeInCommand;
+exports.classifyRemoteMcpLaunch = classifyRemoteMcpLaunch;
+exports.sanitizeRemoteControlFacts = sanitizeRemoteControlFacts;
+exports.remoteControlFactFor = remoteControlFactFor;
+exports.remoteControlGrantKey = remoteControlGrantKey;
+exports.remoteControlLaunches = remoteControlLaunches;
 exports.setShellAstProvider = setShellAstProvider;
 exports.setShellAstMode = setShellAstMode;
 exports.getShellAstMode = getShellAstMode;
@@ -446,7 +453,7 @@ const DEFAULT_WARN_BUILT_INS = new Set(['env_workspace']);
  * snapshot built before the item existed (older backend) must not turn a new
  * ask-first rule into a hard block. An explicit org 'block' still wins.
  */
-const DEFAULT_ASK_BUILT_INS = new Set(['agent_hooks_switched_off', 'agent_hook_config_removed', 'fcd_uninstalled_by_agent']);
+const DEFAULT_ASK_BUILT_INS = new Set(['agent_hooks_switched_off', 'agent_hook_config_removed', 'fcd_uninstalled_by_agent', 'remote_control_bridge']);
 function actionFor(itemId, options) {
     const action = toLocalSafetyRuleAction(options?.itemActions?.[itemId]);
     if (action)
@@ -726,6 +733,181 @@ function credentialCommandReason(value, options) {
         return undefined;
     });
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// Remote-control AI bridges: tools that hand THIS machine's terminal / files /
+// MCP tools to an AI running somewhere else (a remote MCP device, a local MCP
+// server re-published on a network port). The catalog is the one place these
+// are named; every surface — IDE hooks, the PowerShell / cmd / bash guards,
+// MCP config discovery, the action-policy engine fact — matches through the
+// patterns generated below. A package matches only in its REMOTE mode, chosen
+// by the argument after the package (`desktop-commander remote`) or by the
+// serving flag (`supergateway --stdio`); the same package in local stdio mode is
+// an ordinary local MCP server.
+//
+// `remote_connector` entries (mcp-remote, supergateway --sse) connect a LOCAL
+// agent to a remote server — they do not give an outside AI this machine, so
+// they are labelled in the MCP inventory and never asked about.
+// ─────────────────────────────────────────────────────────────────────────────
+exports.REMOTE_CONTROL_CATALOG_VERSION = '2026-09-26.1';
+// The first positional argument after the package (flags may precede it).
+const RC_FIRST_POSITIONAL_REMOTE = String.raw `(?:\s+-{1,2}[a-z][\w-]*(?:=[^\s;&|]*)?)*\s+["']?remote["']?(?=[\s;&|)]|$)`;
+const RC_SERVES_STDIO = String.raw `(?=[^;&|\n]*\s--stdio(?:[=\s]|$))`;
+const RC_SERVES_PORT = String.raw `(?=[^;&|\n]*\s--(?:sse-)?(?:port|host)(?:[=\s]|$))`;
+const RC_CONNECTS_URL = String.raw `(?=[^;&|\n]*\s["']?https?://)`;
+exports.REMOTE_CONTROL_BRIDGES = [
+    {
+        id: 'desktop_commander_remote', title: 'Desktop Commander', kind: 'remote_control',
+        packages: ['@wonderwhy-er/desktop-commander'], bins: ['desktop-commander'],
+        mode: 'remote', modePattern: RC_FIRST_POSITIONAL_REMOTE,
+        label: 'Desktop Commander in remote mode',
+        card: "This starts Desktop Commander in remote mode, which lets an AI outside your company control this computer's terminal and files.",
+    },
+    {
+        id: 'supergateway_stdio_serve', title: 'Supergateway', kind: 'remote_control',
+        packages: ['supergateway'], bins: ['supergateway'],
+        mode: 'serve', modePattern: RC_SERVES_STDIO,
+        label: 'Supergateway publishing a local MCP server',
+        card: "This starts Supergateway, which publishes a local MCP server on a network port so an AI outside this computer can use its tools — often this computer's terminal and files.",
+    },
+    {
+        id: 'mcp_proxy_serve', title: 'mcp-proxy', kind: 'remote_control',
+        packages: ['mcp-proxy'], bins: ['mcp-proxy'],
+        mode: 'serve', modePattern: RC_SERVES_PORT,
+        label: 'mcp-proxy publishing a local MCP server',
+        card: "This starts mcp-proxy in server mode, which publishes a local MCP server on a network port so an AI outside this computer can use its tools — often this computer's terminal and files.",
+    },
+    {
+        id: 'mcp_remote_connector', title: 'mcp-remote', kind: 'remote_connector',
+        packages: ['mcp-remote'], bins: ['mcp-remote'],
+        mode: 'connect', modePattern: RC_CONNECTS_URL,
+        label: 'mcp-remote connecting to a remote MCP server',
+        card: 'This connects a local AI client to an MCP server on the internet. It does not give an outside AI control of this computer.',
+    },
+    {
+        id: 'supergateway_connector', title: 'Supergateway', kind: 'remote_connector',
+        packages: ['supergateway'], bins: ['supergateway'],
+        mode: 'connect', modePattern: String.raw `(?![^;&|\n]*\s--stdio(?:[=\s]|$))(?=[^;&|\n]*\s--(?:sse|streamablehttp)(?:[=\s]|$))`,
+        label: 'Supergateway connecting to a remote MCP server',
+        card: 'This connects a local AI client to an MCP server on the internet. It does not give an outside AI control of this computer.',
+    },
+];
+function escapeRegexLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+const RC_EXT = String.raw `(?:\.cmd|\.exe|\.ps1)?`;
+// Statement start, then transparent wrappers (`sudo`, `env X=1`, `cmd /c`, `bash -c "`, `pwsh -Command "`).
+const RC_START = String.raw `(?:^|[;&|(\n])\s*`;
+const RC_WRAPPERS = String.raw `(?:(?:(?:sudo|doas)(?:\s+-[a-z]+)*|env|nohup|time|exec|command|call|start|[a-z_][a-z0-9_]*=[^\s;&|]*|(?:ba|z|da|k)?sh\s+-l?c|cmd(?:\.exe)?\s+/[ck]|(?:powershell|pwsh)(?:\.exe)?(?:\s+-[a-z]+)*?\s+-c(?:ommand)?)\s+["']?)*`;
+const RC_PATH = String.raw `(?:[^\s;&|"']*[\\/])?`;
+const RC_LAUNCHER = String.raw `(?:(?:npx|pnpx|bunx|uvx)${RC_EXT}|npm${RC_EXT}\s+(?:exec|x)|pnpm${RC_EXT}\s+(?:dlx|exec)|yarn${RC_EXT}\s+dlx|bun${RC_EXT}\s+x|uv${RC_EXT}\s+tool\s+run|pipx${RC_EXT}\s+run)`;
+// Launcher options (`-y`, `--package=x`, `-p x`, `--from x`); a value never starts with `-`.
+const RC_LAUNCHER_OPTIONS = String.raw `(?:\s+-{1,2}[a-z][\w-]*(?:=[^\s;&|]*)?(?:\s+[^\s;&|-][^\s;&|]*)?)*?`;
+const RC_TOKEN_END = String.raw `(?=[\s;&|)]|$)`;
+/** The positional pattern for one catalog entry: program at a statement start, package, then its mode. */
+function remoteControlBridgePattern(bridge) {
+    const names = Array.from(new Set([...bridge.packages, ...bridge.bins]))
+        .sort((a, b) => b.length - a.length).map(escapeRegexLiteral).join('|');
+    const bins = bridge.bins.slice().sort((a, b) => b.length - a.length).map(escapeRegexLiteral).join('|');
+    const packageToken = String.raw `["']?(?:${names})(?:@[^\s"';&|)]*|==[^\s"';&|)]*|\[[^\]\s]*\])?["']?${RC_TOKEN_END}`;
+    const binToken = String.raw `(?:${bins})${RC_EXT}${RC_TOKEN_END}`;
+    return `${RC_START}${RC_WRAPPERS}${RC_PATH}(?:${RC_LAUNCHER}${RC_LAUNCHER_OPTIONS}(?:\\s+--)?\\s+${packageToken}|${binToken})${bridge.modePattern}`;
+}
+const REMOTE_CONTROL_BRIDGE_REGEXES = exports.REMOTE_CONTROL_BRIDGES.map(bridge => ({ bridge, re: new RegExp(remoteControlBridgePattern(bridge), 'i') }));
+/** Shared command rules for the terminal guards: one per remote-control entry, same Local Safety item. */
+exports.REMOTE_CONTROL_COMMAND_RULES = exports.REMOTE_CONTROL_BRIDGES
+    .filter(bridge => bridge.kind === 'remote_control')
+    .map(bridge => ({
+    itemId: 'remote_control_bridge',
+    categoryId: 'remote_control',
+    severity: 'critical',
+    reason: bridge.card,
+    pattern: remoteControlBridgePattern(bridge),
+    commands: ['npx', 'pnpx', 'bunx', 'uvx', 'pipx', 'npm', 'pnpm', 'yarn', 'bun', 'uv', ...bridge.bins],
+}));
+const RC_LAUNCHER_NAME = /(?:^|[\s\\/"'(;&|])(npx|pnpx|bunx|uvx|npm\s+(?:exec|x)|pnpm\s+(?:dlx|exec)|yarn\s+dlx|bun\s+x|uv\s+tool\s+run|pipx\s+run)(?=\s)/i;
+function launcherOf(matched) {
+    const hit = RC_LAUNCHER_NAME.exec(matched.replace(/\.(?:cmd|exe|ps1)\b/gi, ''));
+    return hit ? hit[1].toLowerCase().replace(/\s+/g, ' ') : 'direct';
+}
+function matchRemoteBridge(text, kind) {
+    for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+        if (bridge.kind !== kind)
+            continue;
+        const hit = re.exec(text);
+        if (hit)
+            return { bridge, facts: { bridge: bridge.id, mode: bridge.mode, launcher: launcherOf(hit[0]) } };
+    }
+    return undefined;
+}
+/** A shell line that starts a remote-control bridge (any statement, any de-obfuscated variant). */
+function remoteControlBridgeInCommand(command) {
+    if (!command || command.length > 32_000)
+        return undefined;
+    return matchCommand(stripInertDataSegments(command), text => matchRemoteBridge(text, 'remote_control'));
+}
+/**
+ * An MCP server launch (config `command` + `args`) that is a catalogued bridge:
+ * a remote-control bridge first, else a remote connector. Arguments with
+ * spaces are re-quoted so a `--stdio "npx server"` value stays one argument.
+ */
+function classifyRemoteMcpLaunch(command, args = []) {
+    if (!command)
+        return undefined;
+    const line = [command, ...args].map(part => (/\s/.test(part) ? `"${part.replace(/"/g, '')}"` : part)).join(' ');
+    return matchRemoteBridge(line, 'remote_control') || matchRemoteBridge(line, 'remote_connector');
+}
+const RC_LAUNCHERS = new Set(['npx', 'pnpx', 'bunx', 'uvx', 'npm exec', 'npm x', 'pnpm dlx', 'pnpm exec', 'yarn dlx', 'bun x', 'uv tool run', 'pipx run', 'direct']);
+/** Wire-supplied facts constrained to the catalog vocabulary (backend ingest); anything else is dropped. */
+function sanitizeRemoteControlFacts(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const value = raw;
+    const bridge = exports.REMOTE_CONTROL_BRIDGES.find(entry => entry.id === value.bridge);
+    if (!bridge || value.mode !== bridge.mode || typeof value.launcher !== 'string' || !RC_LAUNCHERS.has(value.launcher))
+        return undefined;
+    return { bridge: bridge.id, mode: bridge.mode, launcher: value.launcher };
+}
+/** The engine fact provider: the catalog id of the remote-control bridge this line starts. */
+function remoteControlFactFor(command) {
+    return remoteControlBridgeInCommand(command)?.bridge.id;
+}
+/** What an "Always allow" on a bridge is bound to: the package and its mode, never the launcher that ran it. */
+function remoteControlGrantKey(bridge) {
+    return `${bridge.packages[0]} ${bridge.mode}`;
+}
+/**
+ * Every distinct remote-control bridge a line starts (as grant keys), plus the
+ * line with each verbatim launch cut out — statement separators kept — so the
+ * caller can still read the OTHER programs on the line. A launch seen only in a
+ * de-obfuscated variant is not cut: the rest is over-counted, never under-counted.
+ */
+function remoteControlLaunches(command) {
+    if (!command || command.length > 32_000)
+        return { bridges: [], rest: command || '' };
+    const seen = new Set();
+    matchCommand(stripInertDataSegments(command), text => {
+        for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+            if (bridge.kind === 'remote_control' && !seen.has(bridge.id) && re.test(text))
+                seen.add(bridge.id);
+        }
+        return undefined;
+    });
+    const bridges = new Set();
+    let rest = command;
+    for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+        if (!seen.has(bridge.id))
+            continue;
+        bridges.add(remoteControlGrantKey(bridge));
+        rest = rest.replace(new RegExp(re.source, 'gi'), hit => `${/^[;&|(\n]/.test(hit) ? hit[0] : ''} `);
+    }
+    return { bridges: [...bridges].sort(), rest };
+}
+function canonicalRemoteLaunch(match) {
+    const direct = match.facts.launcher === 'direct';
+    const program = direct ? match.bridge.bins[0] : `${match.facts.launcher} ${match.bridge.packages[0]}`;
+    const mode = match.bridge.mode === 'remote' ? ' remote' : match.bridge.id === 'supergateway_stdio_serve' ? ' --stdio' : ' --port';
+    return `${program}${mode}`;
+}
 // Container-scoped execution context immediately before an `rm` hit: a
 // docker/podman/nerdctl/kubectl exec|run (incl. `compose exec/run`) earlier in
 // the SAME statement (no ; & | between). Inside that context a bare `rm -rf *`
@@ -1173,12 +1355,29 @@ const METADATA_SEARCH_PROGRAMS = new Set([
  * Split on unquoted `;` / `&&` / `||` / `|` / newline so a pipe cannot hide a
  * later client (`rg … | curl http://169.254…`) while `rg "a|b"` stays one segment.
  */
+/**
+ * PowerShell escape: inside `"…"` a backtick makes the next character literal
+ * (`` `" `` does not close the string); outside quotes `` `" `` / `` `' `` /
+ * `` `$ `` and a trailing backtick (line continuation) are escapes, not a
+ * POSIX command substitution.
+ */
+function isPowerShellBacktickEscape(text, i, quote) {
+    if (text[i] !== '`' || i + 1 >= text.length)
+        return false;
+    if (quote === '"')
+        return true;
+    return quote === null && /["'$\s]/.test(text[i + 1]);
+}
 function splitUnquotedCommandSegments(command) {
     const out = [];
     let cur = '';
     let quote = null;
     for (let i = 0; i < command.length; i++) {
         const c = command[i];
+        if (isPowerShellBacktickEscape(command, i, quote)) {
+            cur += c + command[++i];
+            continue;
+        }
         if (quote) {
             cur += c;
             if (c === '\\' && i + 1 < command.length) {
@@ -1344,11 +1543,15 @@ function unquotedCode(text) {
     let out = '';
     for (let i = 0; i < text.length; i++) {
         const c = text[i];
+        if (isPowerShellBacktickEscape(text, i, null)) {
+            out += c + text[++i];
+            continue;
+        }
         if (c === "'" || c === '"' || c === '`') {
             const q = c;
             i += 1;
             while (i < text.length) {
-                if (text[i] === '\\') {
+                if (text[i] === '\\' || (q === '"' && text[i] === '`')) {
                     i += 2;
                     continue;
                 }
@@ -1376,7 +1579,7 @@ function stripInertDataSegments(text) {
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
-    out = src.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
+    out = src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
         const body = dq !== undefined ? dq : (sq || '');
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
@@ -1671,6 +1874,13 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
         if (finding)
             return finding;
     }
+    const remoteBridge = remoteControlBridgeInCommand(value);
+    if (remoteBridge) {
+        // Evidence is the canonical launch (launcher, package, mode) — never the argument text.
+        const finding = builtIn('remote_control_bridge', 'remote_control', 'remote_control', 'local-remote-control-bridge', remoteBridge.bridge.card, canonicalRemoteLaunch(remoteBridge), remoteBridge.bridge.label, options);
+        if (finding)
+            return { ...finding, remoteControl: remoteBridge.facts };
+    }
     const destructive = destructiveCommandDecision(value);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
@@ -1716,7 +1926,7 @@ function mentionsAgentHookConfig(text) {
     return AGENT_HOOK_CONFIG_RE.test(normalizeForPath(text));
 }
 function segmentTokens(segment) {
-    return (segment.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).map(token => token.replace(/^["']|["']$/g, ''));
+    return (segment.match(/(?:[^\s"']+|"(?:[^"`]|`[\s\S])*"|'[^']*')+/g) || []).map(token => token.replace(/^["']|["']$/g, ''));
 }
 function segmentProgram(tokens) {
     let i = 0;
@@ -1732,7 +1942,7 @@ function redirectTargets(segment) {
         out.push(match[2]);
     return out;
 }
-function isFcdUninstall(program, rest, segment) {
+function isFcdUninstall(program, rest) {
     let prog = program;
     let args = rest;
     if (prog === 'npx' || prog === 'pnpx' || prog === 'bunx') {
@@ -1746,18 +1956,75 @@ function isFcdUninstall(program, rest, segment) {
         return args.some(token => /^(?:uninstall|remove|rm|r|un|unlink)$/i.test(token))
             && args.some(token => /^fullcourtdefense-cli(?:@|$)/i.test(token));
     }
-    if (!/fullcourtdefense/i.test(segment))
-        return false;
-    if (prog === 'msiexec')
-        return args.some(token => /^[/-](?:x|uninstall)$/i.test(token));
-    if (prog === 'schtasks')
-        return args.some(token => /^[/-](?:delete|disable)$/i.test(token));
-    if (prog === 'unregister-scheduledtask' || prog === 'disable-scheduledtask')
-        return true;
+    if (prog === 'msiexec') {
+        const at = args.findIndex(token => /^[/-](?:x|uninstall)$/i.test(token));
+        return at >= 0 && /fullcourtdefense/i.test(args[at + 1] || '');
+    }
+    if (prog === 'schtasks') {
+        if (!args.some(token => /^[/-](?:delete|disable)$/i.test(token)))
+            return false;
+        const at = args.findIndex(token => /^[/-]tn$/i.test(token));
+        return at >= 0 && isFcdTaskName(args[at + 1] || '');
+    }
+    if (prog === 'unregister-scheduledtask' || prog === 'disable-scheduledtask') {
+        return optionValues(args, /^-taskname$/i, /^-(?:taskpath|cimsession)$/i).some(isFcdTaskName);
+    }
     if (prog === 'winget')
-        return /^(?:uninstall|remove)$/i.test(args[0] || '');
+        return /^(?:uninstall|remove)$/i.test(args[0] || '') && args.slice(1).some(token => /fullcourtdefense/i.test(token));
+    if (prog === 'taskkill') {
+        const at = args.findIndex(token => /^[/-]im$/i.test(token));
+        return at >= 0 && /^fullcourtdefense/i.test(args[at + 1] || '');
+    }
+    if (prog === 'stop-process' || prog === 'spps' || prog === 'kill' || prog === 'pkill' || prog === 'killall') {
+        return optionValues(args, /^-(?:name|processname)$/i, /^-id$/i).some(name => /^fullcourtdefense/i.test(name));
+    }
+    if (INSTALL_ROOT_REMOVERS.has(prog)) {
+        return args.filter(token => !/^-/.test(token) && !/^\/[a-z]{1,3}$/i.test(token)).some(isFcdInstallRoot);
+    }
     return false;
 }
+/** Scheduled tasks the installer and CLI register. A name outside the product namespace is not ours. */
+const FCD_TASK_NAMES = [
+    'FullCourtDefense Updater', 'FullCourtDefense Daemon', 'FullCourtDefense Daemon Watchdog',
+    'FullCourtDefense Recovery', 'FullCourtDefense Auto-Protect', 'FullCourtDefenseDesktopDiscover',
+];
+const INSTALL_ROOT_REMOVERS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'rd', 'remove-item', 'ri', 'rimraf', 'mv', 'move', 'move-item', 'mi', 'ren', 'rename-item', 'rni']);
+/** A task name (or wildcard) that selects a FullCourtDefense task — by its product-namespace name, not a substring. */
+function isFcdTaskName(raw) {
+    const name = raw.replace(/^["']|["']$/g, '').replace(/\\$/, '').replace(/^.*\\/, '').trim();
+    if (!name)
+        return false;
+    if (!/[*?]/.test(name))
+        return /^fullcourtdefense/i.test(name);
+    const glob = new RegExp(`^${name.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')}$`, 'i');
+    return FCD_TASK_NAMES.some(task => glob.test(task));
+}
+/** The install root (`Program Files\FullCourtDefense`) or the machine state root (`ProgramData\FullCourtDefense`), or a path inside them. */
+function isFcdInstallRoot(raw) {
+    const path = raw.replace(/^["']|["']$/g, '').replace(/\\/g, '/').toLowerCase();
+    return /(?:^|\/|%|\$(?:env:|\{env:))(?:program ?files(?: ?\(x86\))?|programfiles\(x86\)|programdata|allusersprofile)[%}]?\/fullcourtdefense(?:\/|$)/.test(path);
+}
+/** Values of a named parameter plus positional operands (skipping the values of `skipNamed`). */
+function optionValues(args, named, skipNamed) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const token = args[i];
+        if (named.test(token)) {
+            if (args[i + 1] !== undefined)
+                out.push(...args[i + 1].split(','));
+            i++;
+            continue;
+        }
+        if (skipNamed.test(token)) {
+            i++;
+            continue;
+        }
+        if (/^-/.test(token))
+            continue;
+        out.push(...token.split(','));
+    }
+    return out;
+}
 /**
  * Shell view: per unquoted segment, the leading program decides. Quoted prose
  * (commit messages, issue bodies, echo text) is removed before redirections
@@ -1769,7 +2036,7 @@ function hookConfigShellChange(command) {
         if (!raw)
             continue;
         const { program, rest } = segmentProgram(segmentTokens(raw));
-        if (isFcdUninstall(program, rest, raw)) {
+        if (isFcdUninstall(program, rest)) {
             return { itemId: 'fcd_uninstalled_by_agent', reason: 'agent removing FullCourtDefense from this machine' };
         }
         const stripped = stripInertDataSegments(raw);