fullcourtdefense-cli 1.35.9 → 1.36.0

package/dist/actionPolicyEngine.d.ts

@@ -268,6 +268,7 @@ export interface ShellAstOperationComparison {
     agree: boolean;
 }
 export declare function setShellAstProvider(provider: ((command: string) => ShellAstFactsLike | undefined) | undefined): void;
+export declare function setRemoteControlProvider(provider: ((command: string) => string | undefined) | undefined): void;
 export declare function setShellAstMode(mode: ShellAstMode): void;
 export declare function getShellAstMode(): ShellAstMode;
 /** Shadow telemetry: the comparison recorded by the most recent top-level shell classification (consumed once). */

package/dist/actionPolicyEngine.js

@@ -42,6 +42,7 @@ __export(actionPolicyEngine_exports, {
   resolveApprovalOptions: () => resolveApprovalOptions,
   roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
+  setRemoteControlProvider: () => setRemoteControlProvider,
   setShellAstMode: () => setShellAstMode,
   setShellAstProvider: () => setShellAstProvider,
   takeShellAstOperationComparison: () => takeShellAstOperationComparison,
@@ -6777,6 +6778,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "tool.status",
   "operation.status",
   "agent.baseline",
+  "toolArgs.remoteControl",
   // Identity / metadata — NOT action signals. Excluded so the tool/agent name can never
   // pollute operation matching.
   "toolName",
@@ -8160,6 +8162,10 @@ var lastShellAstOperationComparison;
 function setShellAstProvider(provider) {
   shellAstProvider = provider;
 }
+var remoteControlProvider;
+function setRemoteControlProvider(provider) {
+  remoteControlProvider = provider;
+}
 function setShellAstMode(mode) {
   shellAstMode = mode;
 }
@@ -8719,9 +8725,22 @@ function inferToolContext(toolName, args) {
     context["destination.type"] = context["request.destination.type"];
     context["destination.domain"] = context["request.destination.domain"];
   }
+  applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
+function applyRemoteControlFact(toolName, args, context) {
+  delete context["toolArgs.remoteControl"];
+  const shellText = remoteControlProvider ? shellCommandTextOf(toolName, args) : void 0;
+  if (!shellText || !remoteControlProvider) return;
+  let bridge;
+  try {
+    bridge = remoteControlProvider(shellText);
+  } catch {
+    bridge = void 0;
+  }
+  if (bridge) context["toolArgs.remoteControl"] = bridge;
+}
 var WEB_READ_TOOL_NAMES = /* @__PURE__ */ new Set(["webfetch", "fetchwebpage", "webextract"]);
 function applyWebReadFacts(toolName, args, context) {
   if (!WEB_READ_TOOL_NAMES.has(toolName.toLowerCase().replace(/[_\-.\s]/g, ""))) return;
@@ -8855,6 +8874,7 @@ function inferBundledToolContext(toolName, args) {
       context["destination.type"] = isInternalHost(context["destination.domain"]) ? "internal" : "external";
     }
   }
+  applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
@@ -8975,6 +8995,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   resolveApprovalOptions,
   roleExceptionError,
   ruleNeedsContentFact,
+  setRemoteControlProvider,
   setShellAstMode,
   setShellAstProvider,
   takeShellAstOperationComparison,

package/dist/askDialog.js

@@ -141,8 +141,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         return { ...clean, resolution: 'ide' };
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
-    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits)
-        && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
+    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits) && (0, devConfirm_1.grantOffered)(envelope.scope);
     const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope, { policyId: envelope.policyId, policyName: envelope.policyName }) : undefined;
     const limitsLabel = allowAlways && grantLimits ? (0, devConfirm_1.describeGrantLimits)(grantLimits) : undefined;
     const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;

package/dist/callerEnv.d.ts

@@ -23,6 +23,16 @@ export declare function callerEnv(): NodeJS.ProcessEnv;
  * from the daemon. No snapshot (older client) = this process's env, as before.
  */
 export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+export declare const IDE_HOOK_TIMEOUT_MS = 90000;
+export declare const IDE_TIMEOUT_MARGIN_MS = 15000;
+export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**

package/dist/callerEnv.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CALLER_ENV_KEYS = void 0;
+exports.IDE_TIMEOUT_MARGIN_MS = exports.IDE_HOOK_TIMEOUT_MS = exports.CALLER_ENV_KEYS = void 0;
 exports.snapshotCallerEnv = snapshotCallerEnv;
 exports.callerEnv = callerEnv;
 exports.withCallerEnv = withCallerEnv;
+exports.ideHookTimeoutMs = ideHookTimeoutMs;
+exports.ideWaitCutoff = ideWaitCutoff;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 const async_hooks_1 = require("async_hooks");
@@ -66,6 +68,21 @@ function withCallerEnv(snapshot, fn) {
     }
     return requestEnv.run(env, fn);
 }
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+exports.IDE_HOOK_TIMEOUT_MS = 90_000;
+exports.IDE_TIMEOUT_MARGIN_MS = 15_000;
+function ideHookTimeoutMs(env = callerEnv()) {
+    const override = Number(env.FCD_HOOK_IDE_TIMEOUT_MS);
+    return override > 0 ? override : exports.IDE_HOOK_TIMEOUT_MS;
+}
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+function ideWaitCutoff(startedAt, ideTimeoutMs = ideHookTimeoutMs()) {
+    return startedAt + ideTimeoutMs - Math.min(exports.IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4);
+}
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = callerEnv()) {
     return env.GITHUB_ACTIONS === 'true'

package/dist/commandNarrative.d.ts

@@ -20,6 +20,14 @@ export interface CommandStep {
     text: string;
     /** The grammar recognised the program and its verb. */
     known: boolean;
+    /** A credential stored in a variable by this step (`$tok = gcloud auth print-access-token`). */
+    captures?: {
+        variable: string;
+        issuer?: {
+            name: string;
+            domains: string[];
+        };
+    };
 }
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 export declare function splitCommandSteps(command: string): string[];

package/dist/commandNarrative.js

@@ -20,6 +20,12 @@ exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
+/** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
+const TOKEN_PRINTERS = [
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+(?:application-default\s+)?print-access-token\b/i, issuer: { name: 'Google', domains: ['googleapis.com'] } },
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+print-identity-token\b/i },
+    { re: /^gh(?:\.exe)?\s+auth\s+token\b/i, issuer: { name: 'GitHub', domains: ['github.com', 'githubusercontent.com'] } },
+];
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 function splitCommandSteps(command) {
     const steps = [];
@@ -158,7 +164,11 @@ function describeSecretVersions(toks, verbAt, where) {
         return `${state[verb]} ${version}${secret(flagSecret)} in Secret Manager${where}`;
     return `Runs \`gcloud secrets versions ${verb}\`${where}`;
 }
-function describeGcloud(toks) {
+/**
+ * `captured` = the variable the command's output is assigned to (`$tok = gcloud …`,
+ * `TOKEN=$(gcloud …)`): the output never reaches the terminal.
+ */
+function describeGcloud(toks, captured) {
     let i = 1;
     while (i < toks.length && toks[i].startsWith('-'))
         i++;
@@ -210,8 +220,10 @@ function describeGcloud(toks) {
         return `Reads the contents of ${isStorageUri(first) ? `an object in storage bucket ${bucketOf(first)}` : shortValue(first, 60)}`;
     if (verb === 'rm')
         return `Deletes ${named(first)}`;
-    if (/^print-(?:access|identity)-token$/.test(verb))
-        return 'Prints a cloud access token to the terminal';
+    if (/^print-(?:access|identity)-token$/.test(verb)) {
+        const kind = verb === 'print-identity-token' ? 'identity' : 'access';
+        return captured ? `Stores a cloud ${kind} token in variable ${captured}` : `Prints a cloud ${kind} token to the terminal`;
+    }
     if (verb === 'login')
         return 'Signs in to Google Cloud';
     if (verb === 'add-iam-policy-binding' || verb === 'remove-iam-policy-binding') {
@@ -334,7 +346,7 @@ function peelGroups(text) {
     }
     return value;
 }
-function describeOne(segmentIn) {
+function describeOne(segmentIn, captured) {
     const segment = segmentIn.trim();
     const [head, ...pipe] = splitPipe(segment);
     const tail = describePipeTail(pipe);
@@ -370,8 +382,13 @@ function describeOne(segmentIn) {
             }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
-        const inner = rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
-        const innerStep = describeOne(inner);
+        const substituted = /^\$\((.*)\)$/s.exec(rhs) || /^`(.*)`$/s.exec(rhs);
+        const inner = substituted ? substituted[1].trim() : rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
+        const innerStep = describeOne(inner, name);
+        const printer = TOKEN_PRINTERS.find(p => p.re.test(inner));
+        if (printer) {
+            return { segment, text: shortValue(`${innerStep.text}${tail}`, MAX_LINE), known: innerStep.known, captures: { variable: name, ...(printer.issuer ? { issuer: printer.issuer } : {}) } };
+        }
         return { segment, text: shortValue(`Stores in ${name}: ${innerStep.text.charAt(0).toLowerCase()}${innerStep.text.slice(1)}${tail}`, MAX_LINE), known: innerStep.known };
     }
     // A bare string statement: PowerShell writes it to the output (`"len=$($t.Length)"`).
@@ -412,7 +429,7 @@ function describeOne(segmentIn) {
         case 'exit':
         case 'return': return step('Ends the script');
         case 'gcloud': {
-            const text = describeGcloud(rest);
+            const text = describeGcloud(rest, captured);
             return text ? step(`${text}${redirectNote}`) : step(`Runs \`gcloud\``, false);
         }
         case 'gsutil': {
@@ -475,7 +492,7 @@ function describeOne(segmentIn) {
             if (/\b(?:create|edit|merge|close|delete|comment)\b/.test(sub))
                 return step(`Changes GitHub ${sub.split(' ')[0]} (${sub.split(' ')[1]})`);
             if (/^auth token\b/.test(sub))
-                return step('Prints the GitHub token');
+                return step(captured ? `Stores the GitHub token in variable ${captured}` : 'Prints the GitHub token');
             return step(`Runs \`gh ${sub}\``, false);
         }
         case 'npm':
@@ -691,17 +708,59 @@ function resolveStorageVariables(steps) {
         return { ...step, text };
     });
 }
+/**
+ * A token stored in a variable, then used later on the line: name the host(s)
+ * that receive it and whether each is the token's issuer. Hosts are literal
+ * URLs in the using step, or a variable assigned a literal URL earlier.
+ */
+function noteTokenDestinations(steps) {
+    const urlVars = new Map();
+    for (const step of steps) {
+        const assign = /^\$?([\w:]+)\s*=\s*["']?https?:\/\/([^/\s"'`$]+)/i.exec(step.segment);
+        if (assign)
+            urlVars.set(assign[1].toLowerCase(), assign[2].toLowerCase());
+    }
+    return steps.map((step, index) => {
+        if (!step.captures)
+            return step;
+        const { variable, issuer } = step.captures;
+        const ref = new RegExp(`\\$\\{?${variable.replace(/[^\w:]/g, '')}\\}?(?![\\w])`, 'i');
+        const hosts = new Set();
+        for (const later of steps.slice(index + 1)) {
+            if (!ref.test(later.segment))
+                continue;
+            for (const m of later.segment.matchAll(/https?:\/\/([^/\s"'`<>]+)/gi))
+                if (!/[$({]/.test(m[1]))
+                    hosts.add(m[1].toLowerCase().replace(/:\d+$/, ''));
+            for (const m of later.segment.matchAll(/\$\{?([\w:]+)\}?/g)) {
+                const host = urlVars.get(m[1].toLowerCase());
+                if (host)
+                    hosts.add(host);
+            }
+        }
+        if (!hosts.size)
+            return step;
+        const described = [...hosts].sort().map(host => {
+            if (!issuer)
+                return host;
+            const own = issuer.domains.some(d => host === d || host.endsWith(`.${d}`));
+            return own ? `${host} (${issuer.name}, the token's issuer)` : `${host}, which is not ${issuer.name}`;
+        });
+        return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
+    });
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
     const steps = splitCommandSteps(command);
-    const out = resolveStorageVariables(steps.slice(0, MAX_STEPS).map(segment => {
+    const described = steps.map(segment => {
         try {
             return describeOne(segment);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };
         }
-    }));
+    });
+    const out = resolveStorageVariables(noteTokenDestinations(described).slice(0, MAX_STEPS));
     if (steps.length > MAX_STEPS)
         out.push({ segment: '', text: `… and ${steps.length - MAX_STEPS} more step${steps.length - MAX_STEPS === 1 ? '' : 's'}`, known: false });
     return out;

package/dist/commands/agentCi.js

@@ -216,6 +216,8 @@ function agentFileRemediation(tags) {
         fixes.push('remove inline secret/password/token references and use a managed secret store');
     if (tags.includes('jailbreak_hint'))
         fixes.push('remove jailbreak/bypass instructions and add hierarchy language that system and security policies win');
+    if (tags.includes('hooks_disabled'))
+        fixes.push('remove "disableAllHooks": true (or a managed "allowManagedHooksOnly": true) so Claude Code runs the Full Court Defense hook again');
     if (tags.includes('no_runtime_hook'))
         fixes.push('install the Full Court Defense hook/gateway so risky tool calls are checked before execution');
     if (fixes.length === 0)
@@ -266,7 +268,7 @@ function evaluateAgentGate(args) {
     }
     for (const file of agentFiles.filter(item => item.riskTags.length > 0)) {
         findings.push(finding({
-            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') ? 'high' : 'medium',
+            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') || file.riskTags.includes('hooks_disabled') ? 'high' : 'medium',
             category: 'agent-file',
             title: `Risky agent instruction: ${file.title}`,
             detail: `${file.filePath} contains agent risk tags: ${file.riskTags.join(', ')}.`,

package/dist/commands/cmdGuard.js

@@ -106,6 +106,8 @@ const FIXED_INTERCEPTED_COMMANDS = [
 const CMD_HIGH_FREQUENCY_COMMANDS = new Set([
     'docker', 'git', 'kubectl', 'aws', 'gcloud', 'az', 'terraform', 'pulumi', 'wsl',
     'curl', 'wget', 'taskkill', 'robocopy', 'xcopy', 'psql', 'mysql', 'mongo', 'mongosh', 'sqlcmd',
+    // Package managers: `npm exec` / `pnpm dlx` bridges are covered in PowerShell and the IDE; cmd keeps `npx`.
+    'npm', 'pnpm', 'yarn', 'bun', 'uv',
 ]);
 /**
  * Anchors of the SHARED command rules (deterministicGuard ↔ shellGuard) that

package/dist/commands/daemon.js

@@ -466,7 +466,26 @@ function hookConfigFiles() {
 // ---------------------------------------------------------------------------
 // The resident loop
 // ---------------------------------------------------------------------------
+/**
+ * A daemon started while the updater replaces the install (logon trigger, a
+ * pre-fix watchdog, a manual start) would put the old build — and its own
+ * update kick — into the middle of msiexec. Wait for the run instead. Bounded
+ * by the lock's max age; stage 2 relaunches the daemon when it finishes.
+ */
+async function waitForActiveUpdaterRun() {
+    let run = (0, selfUpdate_1.readActiveUpdaterRun)();
+    if (!run)
+        return;
+    log(`An updater run is installing${run.targetVersion ? ` ${run.targetVersion}` : ''} (${run.stage || 'running'}, since ${run.startedAt || 'unknown'}) — daemon start waits for it to finish.`);
+    const deadline = Date.now() + (0, selfUpdate_1.updaterLockMaxAgeMs)();
+    while (run && Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, 5_000));
+        run = (0, selfUpdate_1.readActiveUpdaterRun)();
+    }
+    log('Updater run finished — continuing daemon start.');
+}
 async function runDaemon(args, config) {
+    await waitForActiveUpdaterRun();
     if (!acquirePidLock(await detectRecycledPidOwner())) {
         console.log(`${COLOR.yellow}Another FullCourtDefense daemon is already running (pid file: ${pidFile()}).${COLOR.reset}`);
         return;
@@ -518,7 +537,11 @@ async function runDaemon(args, config) {
         log(`Shield key UNAVAILABLE${ph && !ph.spawnOk ? ' — powershell.exe could not start (EDR/policy block?), so the DPAPI-protected key cannot be decrypted' : ''}. Telemetry/control-plane sync disabled; retrying periodically.`);
     }
     // Crash forensics: was the previous daemon killed without a clean shutdown?
+    const previousMarker = (0, daemonForensics_1.readAliveMarker)();
     const postmortem = (0, daemonForensics_1.recordDaemonStart)({ version: cliVersion(), isPidAlive });
+    if (previousMarker?.cleanExit?.reason === 'stopped-for-update' && previousMarker.pid !== process.pid) {
+        log(`Previous daemon (v${previousMarker.version || '?'}) was stopped for update by the updater (${previousMarker.cleanExit.at}) — expected, not a crash.`);
+    }
     if (postmortem) {
         const current = cliVersion();
         if (postmortem.version && current && postmortem.version !== current) {
@@ -526,6 +549,16 @@ async function runDaemon(args, config) {
             // of an OLDER version is the upgrade itself, not something to alarm on.
             log(`Previous daemon (v${postmortem.version}) was replaced by this upgrade to v${current} — the updater's forced stop is expected, not a crash. Post-mortem recorded for the timeline.`);
         }
+        else if (postmortem.cause === 'machine_restart') {
+            log(`Previous daemon (v${postmortem.version || '?'}) stopped when the machine restarted (booted ${postmortem.machineBootedAt || 'after its last heartbeat'}; last alive ${postmortem.lastAliveAt || 'unknown'}). Expected, not a crash. Post-mortem recorded for the timeline.`);
+        }
+        else if ((0, selfUpdate_1.deathDuringUpdaterRun)(postmortem.lastAliveAt, (0, selfUpdate_1.readActiveUpdaterRun)() || (0, selfUpdate_1.readLastUpdaterResult)())) {
+            // Same version, but an updater run was replacing the install when it
+            // died (an update that failed, or a run whose marker stamp was lost):
+            // stopped for update — never an EDR/AV kill in the console.
+            (0, daemonForensics_1.markPostmortemReported)();
+            log(`Previous daemon (v${postmortem.version || '?'}) stopped for update — an updater run was replacing the install when it died (last alive ${postmortem.lastAliveAt || 'unknown'}). Not a crash; not reported as one.`);
+        }
         else {
             log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
         }
@@ -1064,13 +1097,23 @@ async function runDaemon(args, config) {
             return;
         }
         const startedAt = marker.startedAt ? Date.parse(marker.startedAt) : NaN;
-        if (!Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
+        // The install is still running: its own outcome settles this, not a timer.
+        if ((0, selfUpdate_1.readActiveUpdaterRun)())
+            return;
+        // The updater recorded a failed run for this target after the kick —
+        // report its reason now instead of waiting out the stale timer.
+        const lastRun = (0, selfUpdate_1.readLastUpdaterResult)();
+        const runFailed = lastRun?.outcome === 'failed' && lastRun.targetVersion === marker.target
+            && Number.isFinite(startedAt) && Date.parse(lastRun.finishedAt || '') >= startedAt;
+        if (runFailed || !Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
             try {
                 fs.unlinkSync(pendingUpgradeFile());
             }
             catch { /* ignore */ }
             await reportMachineAction(marker.actionId, 'failed', {
-                error: `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
+                error: runFailed
+                    ? `The updater could not install ${marker.target}: ${lastRun?.error || 'unknown error'} The machine stays on ${current || 'unknown'}; see %ProgramData%\\FullCourtDefense\\updater.log.`
+                    : `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
             }, marker.signatureProof);
             log(`Upgrade verification failed: still on ${current || 'unknown'}, target was ${marker.target} (action ${marker.actionId}).`);
             await uploadLogTail();
@@ -1097,7 +1140,7 @@ async function runDaemon(args, config) {
         // whose enrolled fingerprint drifted can set FCD_MACHINE_ACTION_ANY_MACHINE_OK=1
         // locally while they re-enroll.
         const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
-        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId });
+        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId, apiUrl: creds.apiUrl });
         if (!verdict.ok) {
             log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
             await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` }, action.signature?.signature);
@@ -1505,6 +1548,8 @@ async function runDaemon(args, config) {
                         lastAliveAt: unreportedCrash.lastAliveAt,
                         detectedAt: unreportedCrash.detectedAt,
                         detectedBy: unreportedCrash.detectedBy,
+                        cause: unreportedCrash.cause,
+                        machineBootedAt: unreportedCrash.machineBootedAt,
                     }
                     : undefined,
             });

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,5 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'remote_control' | 'honeypot' | 'agent_guard_tamper';
 /**
  * Per-rule enforcement action (org-configured, shipped in the Local Safety
  * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and
@@ -34,6 +34,8 @@ export interface DeterministicFinding {
      * findings — the seam 'mask' uses to redact tool responses. Never spooled.
      */
     matchedSecret?: string;
+    /** Catalog facts for remote_control findings (bridge id, mode, launcher) — no argument text. */
+    remoteControl?: RemoteControlFacts;
 }
 export interface LocalSafetyCustomBlock {
     id: string;
@@ -90,7 +92,7 @@ export declare const DEFAULT_DISABLED_BUILT_INS: ReadonlySet<string>;
 export interface SharedCommandRule {
     itemId: string;
     /** Catalog category id (local-safety-catalog.ts). */
-    categoryId: 'credential_commands';
+    categoryId: 'credential_commands' | 'remote_control';
     severity: 'critical' | 'high' | 'medium' | 'low';
     pattern: string;
     reason: string;
@@ -106,6 +108,64 @@ export interface SharedCommandRule {
  * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+export declare const REMOTE_CONTROL_CATALOG_VERSION = "2026-09-26.1";
+export interface RemoteControlFacts {
+    /** Catalog entry id. */
+    bridge: string;
+    /** Catalog mode label: 'remote' | 'serve' | 'connect'. */
+    mode: string;
+    /** How it was started: 'npx', 'npm exec', 'pnpm dlx', …, or 'direct' for an installed binary. */
+    launcher: string;
+}
+export interface RemoteControlBridge {
+    id: string;
+    title: string;
+    kind: 'remote_control' | 'remote_connector';
+    /** Registry package names (npm / PyPI), as typed after a launcher. */
+    packages: string[];
+    /** Executable names when installed globally or run from node_modules/.bin. */
+    bins: string[];
+    mode: 'remote' | 'serve' | 'connect';
+    /** Regex source applied right after the package token (JS + .NET, IgnoreCase). */
+    modePattern: string;
+    /** Short label for the console and evidence. */
+    label: string;
+    /** Decision Card sentence — what starting it means, in plain words. */
+    card: string;
+}
+export declare const REMOTE_CONTROL_BRIDGES: readonly RemoteControlBridge[];
+/** The positional pattern for one catalog entry: program at a statement start, package, then its mode. */
+export declare function remoteControlBridgePattern(bridge: RemoteControlBridge): string;
+/** Shared command rules for the terminal guards: one per remote-control entry, same Local Safety item. */
+export declare const REMOTE_CONTROL_COMMAND_RULES: readonly SharedCommandRule[];
+export interface RemoteControlMatch {
+    bridge: RemoteControlBridge;
+    facts: RemoteControlFacts;
+}
+/** A shell line that starts a remote-control bridge (any statement, any de-obfuscated variant). */
+export declare function remoteControlBridgeInCommand(command: string): RemoteControlMatch | undefined;
+/**
+ * An MCP server launch (config `command` + `args`) that is a catalogued bridge:
+ * a remote-control bridge first, else a remote connector. Arguments with
+ * spaces are re-quoted so a `--stdio "npx server"` value stays one argument.
+ */
+export declare function classifyRemoteMcpLaunch(command: string | undefined, args?: readonly string[]): RemoteControlMatch | undefined;
+/** Wire-supplied facts constrained to the catalog vocabulary (backend ingest); anything else is dropped. */
+export declare function sanitizeRemoteControlFacts(raw: unknown): RemoteControlFacts | undefined;
+/** The engine fact provider: the catalog id of the remote-control bridge this line starts. */
+export declare function remoteControlFactFor(command: string): string | undefined;
+/** What an "Always allow" on a bridge is bound to: the package and its mode, never the launcher that ran it. */
+export declare function remoteControlGrantKey(bridge: RemoteControlBridge): string;
+/**
+ * Every distinct remote-control bridge a line starts (as grant keys), plus the
+ * line with each verbatim launch cut out — statement separators kept — so the
+ * caller can still read the OTHER programs on the line. A launch seen only in a
+ * de-obfuscated variant is not cut: the rest is over-counted, never under-counted.
+ */
+export declare function remoteControlLaunches(command: string): {
+    bridges: string[];
+    rest: string;
+};
 export type ShellAstMode = 'off' | 'shadow' | 'primary';
 /** Structural subset of shellAst.ts ShellFacts that the guard reads. */
 export interface ShellAstFactsLike {