fullcourtdefense-cli 1.35.9 → 1.36.0

package/dist/commands/deterministicGuard.js

@@ -33,8 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
+exports.REMOTE_CONTROL_COMMAND_RULES = exports.REMOTE_CONTROL_BRIDGES = exports.REMOTE_CONTROL_CATALOG_VERSION = exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.remoteControlBridgePattern = remoteControlBridgePattern;
+exports.remoteControlBridgeInCommand = remoteControlBridgeInCommand;
+exports.classifyRemoteMcpLaunch = classifyRemoteMcpLaunch;
+exports.sanitizeRemoteControlFacts = sanitizeRemoteControlFacts;
+exports.remoteControlFactFor = remoteControlFactFor;
+exports.remoteControlGrantKey = remoteControlGrantKey;
+exports.remoteControlLaunches = remoteControlLaunches;
 exports.setShellAstProvider = setShellAstProvider;
 exports.setShellAstMode = setShellAstMode;
 exports.getShellAstMode = getShellAstMode;
@@ -441,6 +448,12 @@ function isEnabled(itemId, options) {
  * and stale snapshots on the warn-first rollout instead of hard-blocking.
  */
 const DEFAULT_WARN_BUILT_INS = new Set(['env_workspace']);
+/**
+ * Items that ASK by default when the snapshot carries no action for them — a
+ * snapshot built before the item existed (older backend) must not turn a new
+ * ask-first rule into a hard block. An explicit org 'block' still wins.
+ */
+const DEFAULT_ASK_BUILT_INS = new Set(['agent_hooks_switched_off', 'agent_hook_config_removed', 'fcd_uninstalled_by_agent', 'remote_control_bridge']);
 function actionFor(itemId, options) {
     const action = toLocalSafetyRuleAction(options?.itemActions?.[itemId]);
     if (action)
@@ -451,6 +464,8 @@ function actionFor(itemId, options) {
     // keeps the strict "absent item = block" contract below.
     if (options?.snapshotPresent === false)
         return 'warn';
+    if (DEFAULT_ASK_BUILT_INS.has(itemId))
+        return 'ask';
     return DEFAULT_WARN_BUILT_INS.has(itemId) ? 'warn' : 'block';
 }
 function builtIn(itemId, categoryId, category, ruleId, reason, findingEvidence, explanation, options) {
@@ -575,36 +590,36 @@ function containsMetadataEndpoint(value) {
 function containsSensitiveCredentialPath(value) {
     const text = normalizeForPath(value);
     const checks = [
-        { itemId: 'ssh_private_key', label: 'SSH private key', re: /(?:^|\/)\.ssh\/id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[/?#\s'"])/ },
-        { itemId: 'ssh_config', label: 'SSH config', re: /(?:^|\/)\.ssh\/config(?:$|[/?#\s'"])/ },
-        { itemId: 'aws_credentials', label: 'AWS credentials', re: /(?:^|\/)\.aws\/(?:credentials|config)(?:$|[/?#\s'"])/ },
-        { itemId: 'kube_config', label: 'Kubernetes config', re: /(?:^|\/)\.kube\/config(?:$|[/?#\s'"])/ },
-        { itemId: 'docker_auth', label: 'Docker auth config', re: /(?:^|\/)\.docker\/config\.json(?:$|[/?#\s'"])/ },
+        { itemId: 'ssh_private_key', label: 'SSH private key', re: /(?:^|\/)\.ssh\/id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'ssh_config', label: 'SSH config', re: /(?:^|\/)\.ssh\/config(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'aws_credentials', label: 'AWS credentials', re: /(?:^|\/)\.aws\/(?:credentials|config)(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'kube_config', label: 'Kubernetes config', re: /(?:^|\/)\.kube\/config(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'docker_auth', label: 'Docker auth config', re: /(?:^|\/)\.docker\/config\.json(?:$|[/?#\s'"`);|&<>])/ },
         // GitHub CLI stores its OAuth token in hosts.yml — ~/.config/gh/ on Unix,
         // AppData/Roaming/GitHub CLI/ on Windows (normalized+lowercased upstream).
-        { itemId: 'github_cli_token', label: 'GitHub CLI token', re: /(?:^|\/)(?:gh|github cli)\/hosts\.yml(?:$|[/?#\s'"])/ },
-        { itemId: 'git_credentials', label: 'Git plaintext credentials', re: /(?:^|\/)\.git-credentials(?:$|[/?#\s'"])/ },
-        { itemId: 'gcloud_credentials', label: 'gcloud credential store', re: /(?:^|\/)gcloud\/(?:credentials\.db|access_tokens\.db|legacy_credentials)(?:$|[/?#\s'"])/ },
+        { itemId: 'github_cli_token', label: 'GitHub CLI token', re: /(?:^|\/)(?:gh|github cli)\/hosts\.yml(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'git_credentials', label: 'Git plaintext credentials', re: /(?:^|\/)\.git-credentials(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'gcloud_credentials', label: 'gcloud credential store', re: /(?:^|\/)gcloud\/(?:credentials\.db|access_tokens\.db|legacy_credentials)(?:$|[/?#\s'"`);|&<>])/ },
         { itemId: 'azure_tokens', label: 'Azure token cache', re: /(?:^|\/)\.azure\/(?:msal_token_cache|accesstokens\.json)/ },
-        { itemId: 'gnupg_private_keys', label: 'GnuPG private keys', re: /(?:^|\/)\.gnupg\/(?:private-keys-v1\.d|secring\.gpg)(?:$|[/?#\s'"])/ },
-        { itemId: 'pgpass', label: 'PostgreSQL password file', re: /(?:^|\/)(?:\.pgpass|pgpass\.conf)(?:$|[/?#\s'"])/ },
-        { itemId: 'mysql_cnf', label: 'MySQL credentials file', re: /(?:^|\/)\.my\.cnf(?:$|[/?#\s'"])/ },
-        { itemId: 'terraform_credentials', label: 'Terraform credentials', re: /credentials\.tfrc\.json(?:$|[/?#\s'"])/ },
-        { itemId: 'huggingface_token', label: 'Hugging Face token', re: /(?:^|\/)\.?huggingface\/token(?:$|[/?#\s'"])/ },
-        { itemId: 'cargo_credentials', label: 'Cargo registry credentials', re: /(?:^|\/)\.cargo\/credentials(?:\.toml)?(?:$|[/?#\s'"])/ },
-        { itemId: 'gem_credentials', label: 'RubyGems credentials', re: /(?:^|\/)\.gem\/credentials(?:$|[/?#\s'"])/ },
-        { itemId: 'composer_auth', label: 'Composer auth tokens', re: /(?:^|\/)\.composer\/auth\.json(?:$|[/?#\s'"])/ },
-        { itemId: 'npmrc', label: 'npm credentials', re: /(?:^|\/)\.npmrc(?:$|[/?#\s'"])/ },
-        { itemId: 'pypirc', label: 'PyPI credentials', re: /(?:^|\/)\.pypirc(?:$|[/?#\s'"])/ },
-        { itemId: 'netrc', label: 'netrc credentials', re: /(?:^|\/)\.netrc(?:$|[/?#\s'"])/ },
-        { itemId: 'gcp_adc', label: 'GCP ADC credentials', re: /application_default_credentials\.json(?:$|[/?#\s'"])/ },
-        { itemId: 'linux_shadow', label: 'Linux shadow file', re: /(?:^|\/)etc\/(?:shadow|sudoers)(?:$|[/?#\s'"])/ },
-        { itemId: 'powershell_history', label: 'PowerShell history', re: /powershell\/psreadline\/consolehost_history\.txt(?:$|[/?#\s'"])/ },
+        { itemId: 'gnupg_private_keys', label: 'GnuPG private keys', re: /(?:^|\/)\.gnupg\/(?:private-keys-v1\.d|secring\.gpg)(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'pgpass', label: 'PostgreSQL password file', re: /(?:^|\/)(?:\.pgpass|pgpass\.conf)(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'mysql_cnf', label: 'MySQL credentials file', re: /(?:^|\/)\.my\.cnf(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'terraform_credentials', label: 'Terraform credentials', re: /credentials\.tfrc\.json(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'huggingface_token', label: 'Hugging Face token', re: /(?:^|\/)\.?huggingface\/token(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'cargo_credentials', label: 'Cargo registry credentials', re: /(?:^|\/)\.cargo\/credentials(?:\.toml)?(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'gem_credentials', label: 'RubyGems credentials', re: /(?:^|\/)\.gem\/credentials(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'composer_auth', label: 'Composer auth tokens', re: /(?:^|\/)\.composer\/auth\.json(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'npmrc', label: 'npm credentials', re: /(?:^|\/)\.npmrc(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'pypirc', label: 'PyPI credentials', re: /(?:^|\/)\.pypirc(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'netrc', label: 'netrc credentials', re: /(?:^|\/)\.netrc(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'gcp_adc', label: 'GCP ADC credentials', re: /application_default_credentials\.json(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'linux_shadow', label: 'Linux shadow file', re: /(?:^|\/)etc\/(?:shadow|sudoers)(?:$|[/?#\s'"`);|&<>])/ },
+        { itemId: 'powershell_history', label: 'PowerShell history', re: /powershell\/psreadline\/consolehost_history\.txt(?:$|[/?#\s'"`);|&<>])/ },
         // Anchored to real browser-profile paths (Chromium: "User Data/<profile>/Network/Cookies",
         // "<profile>/Login Data"; Firefox: key4.db / logins.json / cookies.sqlite). Bare English
         // words like "cookies" in prose, code, or a "/cookies" web route must NOT match — the
         // unanchored version over-blocked ordinary web-dev work.
-        { itemId: 'browser_credentials', label: 'browser credential store', re: /(?:^|\/)(?:(?:default|profile [0-9]+|network)\/cookies|login data|cookies\.sqlite|key4\.db|logins\.json)(?:$|[/?#\s'"])/ },
+        { itemId: 'browser_credentials', label: 'browser credential store', re: /(?:^|\/)(?:(?:default|profile [0-9]+|network)\/cookies|login data|cookies\.sqlite|key4\.db|logins\.json)(?:$|[/?#\s'"`);|&<>])/ },
     ];
     for (const check of checks) {
         if (check.re.test(text))
@@ -718,6 +733,181 @@ function credentialCommandReason(value, options) {
         return undefined;
     });
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// Remote-control AI bridges: tools that hand THIS machine's terminal / files /
+// MCP tools to an AI running somewhere else (a remote MCP device, a local MCP
+// server re-published on a network port). The catalog is the one place these
+// are named; every surface — IDE hooks, the PowerShell / cmd / bash guards,
+// MCP config discovery, the action-policy engine fact — matches through the
+// patterns generated below. A package matches only in its REMOTE mode, chosen
+// by the argument after the package (`desktop-commander remote`) or by the
+// serving flag (`supergateway --stdio`); the same package in local stdio mode is
+// an ordinary local MCP server.
+//
+// `remote_connector` entries (mcp-remote, supergateway --sse) connect a LOCAL
+// agent to a remote server — they do not give an outside AI this machine, so
+// they are labelled in the MCP inventory and never asked about.
+// ─────────────────────────────────────────────────────────────────────────────
+exports.REMOTE_CONTROL_CATALOG_VERSION = '2026-09-26.1';
+// The first positional argument after the package (flags may precede it).
+const RC_FIRST_POSITIONAL_REMOTE = String.raw `(?:\s+-{1,2}[a-z][\w-]*(?:=[^\s;&|]*)?)*\s+["']?remote["']?(?=[\s;&|)]|$)`;
+const RC_SERVES_STDIO = String.raw `(?=[^;&|\n]*\s--stdio(?:[=\s]|$))`;
+const RC_SERVES_PORT = String.raw `(?=[^;&|\n]*\s--(?:sse-)?(?:port|host)(?:[=\s]|$))`;
+const RC_CONNECTS_URL = String.raw `(?=[^;&|\n]*\s["']?https?://)`;
+exports.REMOTE_CONTROL_BRIDGES = [
+    {
+        id: 'desktop_commander_remote', title: 'Desktop Commander', kind: 'remote_control',
+        packages: ['@wonderwhy-er/desktop-commander'], bins: ['desktop-commander'],
+        mode: 'remote', modePattern: RC_FIRST_POSITIONAL_REMOTE,
+        label: 'Desktop Commander in remote mode',
+        card: "This starts Desktop Commander in remote mode, which lets an AI outside your company control this computer's terminal and files.",
+    },
+    {
+        id: 'supergateway_stdio_serve', title: 'Supergateway', kind: 'remote_control',
+        packages: ['supergateway'], bins: ['supergateway'],
+        mode: 'serve', modePattern: RC_SERVES_STDIO,
+        label: 'Supergateway publishing a local MCP server',
+        card: "This starts Supergateway, which publishes a local MCP server on a network port so an AI outside this computer can use its tools — often this computer's terminal and files.",
+    },
+    {
+        id: 'mcp_proxy_serve', title: 'mcp-proxy', kind: 'remote_control',
+        packages: ['mcp-proxy'], bins: ['mcp-proxy'],
+        mode: 'serve', modePattern: RC_SERVES_PORT,
+        label: 'mcp-proxy publishing a local MCP server',
+        card: "This starts mcp-proxy in server mode, which publishes a local MCP server on a network port so an AI outside this computer can use its tools — often this computer's terminal and files.",
+    },
+    {
+        id: 'mcp_remote_connector', title: 'mcp-remote', kind: 'remote_connector',
+        packages: ['mcp-remote'], bins: ['mcp-remote'],
+        mode: 'connect', modePattern: RC_CONNECTS_URL,
+        label: 'mcp-remote connecting to a remote MCP server',
+        card: 'This connects a local AI client to an MCP server on the internet. It does not give an outside AI control of this computer.',
+    },
+    {
+        id: 'supergateway_connector', title: 'Supergateway', kind: 'remote_connector',
+        packages: ['supergateway'], bins: ['supergateway'],
+        mode: 'connect', modePattern: String.raw `(?![^;&|\n]*\s--stdio(?:[=\s]|$))(?=[^;&|\n]*\s--(?:sse|streamablehttp)(?:[=\s]|$))`,
+        label: 'Supergateway connecting to a remote MCP server',
+        card: 'This connects a local AI client to an MCP server on the internet. It does not give an outside AI control of this computer.',
+    },
+];
+function escapeRegexLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+const RC_EXT = String.raw `(?:\.cmd|\.exe|\.ps1)?`;
+// Statement start, then transparent wrappers (`sudo`, `env X=1`, `cmd /c`, `bash -c "`, `pwsh -Command "`).
+const RC_START = String.raw `(?:^|[;&|(\n])\s*`;
+const RC_WRAPPERS = String.raw `(?:(?:(?:sudo|doas)(?:\s+-[a-z]+)*|env|nohup|time|exec|command|call|start|[a-z_][a-z0-9_]*=[^\s;&|]*|(?:ba|z|da|k)?sh\s+-l?c|cmd(?:\.exe)?\s+/[ck]|(?:powershell|pwsh)(?:\.exe)?(?:\s+-[a-z]+)*?\s+-c(?:ommand)?)\s+["']?)*`;
+const RC_PATH = String.raw `(?:[^\s;&|"']*[\\/])?`;
+const RC_LAUNCHER = String.raw `(?:(?:npx|pnpx|bunx|uvx)${RC_EXT}|npm${RC_EXT}\s+(?:exec|x)|pnpm${RC_EXT}\s+(?:dlx|exec)|yarn${RC_EXT}\s+dlx|bun${RC_EXT}\s+x|uv${RC_EXT}\s+tool\s+run|pipx${RC_EXT}\s+run)`;
+// Launcher options (`-y`, `--package=x`, `-p x`, `--from x`); a value never starts with `-`.
+const RC_LAUNCHER_OPTIONS = String.raw `(?:\s+-{1,2}[a-z][\w-]*(?:=[^\s;&|]*)?(?:\s+[^\s;&|-][^\s;&|]*)?)*?`;
+const RC_TOKEN_END = String.raw `(?=[\s;&|)]|$)`;
+/** The positional pattern for one catalog entry: program at a statement start, package, then its mode. */
+function remoteControlBridgePattern(bridge) {
+    const names = Array.from(new Set([...bridge.packages, ...bridge.bins]))
+        .sort((a, b) => b.length - a.length).map(escapeRegexLiteral).join('|');
+    const bins = bridge.bins.slice().sort((a, b) => b.length - a.length).map(escapeRegexLiteral).join('|');
+    const packageToken = String.raw `["']?(?:${names})(?:@[^\s"';&|)]*|==[^\s"';&|)]*|\[[^\]\s]*\])?["']?${RC_TOKEN_END}`;
+    const binToken = String.raw `(?:${bins})${RC_EXT}${RC_TOKEN_END}`;
+    return `${RC_START}${RC_WRAPPERS}${RC_PATH}(?:${RC_LAUNCHER}${RC_LAUNCHER_OPTIONS}(?:\\s+--)?\\s+${packageToken}|${binToken})${bridge.modePattern}`;
+}
+const REMOTE_CONTROL_BRIDGE_REGEXES = exports.REMOTE_CONTROL_BRIDGES.map(bridge => ({ bridge, re: new RegExp(remoteControlBridgePattern(bridge), 'i') }));
+/** Shared command rules for the terminal guards: one per remote-control entry, same Local Safety item. */
+exports.REMOTE_CONTROL_COMMAND_RULES = exports.REMOTE_CONTROL_BRIDGES
+    .filter(bridge => bridge.kind === 'remote_control')
+    .map(bridge => ({
+    itemId: 'remote_control_bridge',
+    categoryId: 'remote_control',
+    severity: 'critical',
+    reason: bridge.card,
+    pattern: remoteControlBridgePattern(bridge),
+    commands: ['npx', 'pnpx', 'bunx', 'uvx', 'pipx', 'npm', 'pnpm', 'yarn', 'bun', 'uv', ...bridge.bins],
+}));
+const RC_LAUNCHER_NAME = /(?:^|[\s\\/"'(;&|])(npx|pnpx|bunx|uvx|npm\s+(?:exec|x)|pnpm\s+(?:dlx|exec)|yarn\s+dlx|bun\s+x|uv\s+tool\s+run|pipx\s+run)(?=\s)/i;
+function launcherOf(matched) {
+    const hit = RC_LAUNCHER_NAME.exec(matched.replace(/\.(?:cmd|exe|ps1)\b/gi, ''));
+    return hit ? hit[1].toLowerCase().replace(/\s+/g, ' ') : 'direct';
+}
+function matchRemoteBridge(text, kind) {
+    for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+        if (bridge.kind !== kind)
+            continue;
+        const hit = re.exec(text);
+        if (hit)
+            return { bridge, facts: { bridge: bridge.id, mode: bridge.mode, launcher: launcherOf(hit[0]) } };
+    }
+    return undefined;
+}
+/** A shell line that starts a remote-control bridge (any statement, any de-obfuscated variant). */
+function remoteControlBridgeInCommand(command) {
+    if (!command || command.length > 32_000)
+        return undefined;
+    return matchCommand(stripInertDataSegments(command), text => matchRemoteBridge(text, 'remote_control'));
+}
+/**
+ * An MCP server launch (config `command` + `args`) that is a catalogued bridge:
+ * a remote-control bridge first, else a remote connector. Arguments with
+ * spaces are re-quoted so a `--stdio "npx server"` value stays one argument.
+ */
+function classifyRemoteMcpLaunch(command, args = []) {
+    if (!command)
+        return undefined;
+    const line = [command, ...args].map(part => (/\s/.test(part) ? `"${part.replace(/"/g, '')}"` : part)).join(' ');
+    return matchRemoteBridge(line, 'remote_control') || matchRemoteBridge(line, 'remote_connector');
+}
+const RC_LAUNCHERS = new Set(['npx', 'pnpx', 'bunx', 'uvx', 'npm exec', 'npm x', 'pnpm dlx', 'pnpm exec', 'yarn dlx', 'bun x', 'uv tool run', 'pipx run', 'direct']);
+/** Wire-supplied facts constrained to the catalog vocabulary (backend ingest); anything else is dropped. */
+function sanitizeRemoteControlFacts(raw) {
+    if (!raw || typeof raw !== 'object')
+        return undefined;
+    const value = raw;
+    const bridge = exports.REMOTE_CONTROL_BRIDGES.find(entry => entry.id === value.bridge);
+    if (!bridge || value.mode !== bridge.mode || typeof value.launcher !== 'string' || !RC_LAUNCHERS.has(value.launcher))
+        return undefined;
+    return { bridge: bridge.id, mode: bridge.mode, launcher: value.launcher };
+}
+/** The engine fact provider: the catalog id of the remote-control bridge this line starts. */
+function remoteControlFactFor(command) {
+    return remoteControlBridgeInCommand(command)?.bridge.id;
+}
+/** What an "Always allow" on a bridge is bound to: the package and its mode, never the launcher that ran it. */
+function remoteControlGrantKey(bridge) {
+    return `${bridge.packages[0]} ${bridge.mode}`;
+}
+/**
+ * Every distinct remote-control bridge a line starts (as grant keys), plus the
+ * line with each verbatim launch cut out — statement separators kept — so the
+ * caller can still read the OTHER programs on the line. A launch seen only in a
+ * de-obfuscated variant is not cut: the rest is over-counted, never under-counted.
+ */
+function remoteControlLaunches(command) {
+    if (!command || command.length > 32_000)
+        return { bridges: [], rest: command || '' };
+    const seen = new Set();
+    matchCommand(stripInertDataSegments(command), text => {
+        for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+            if (bridge.kind === 'remote_control' && !seen.has(bridge.id) && re.test(text))
+                seen.add(bridge.id);
+        }
+        return undefined;
+    });
+    const bridges = new Set();
+    let rest = command;
+    for (const { bridge, re } of REMOTE_CONTROL_BRIDGE_REGEXES) {
+        if (!seen.has(bridge.id))
+            continue;
+        bridges.add(remoteControlGrantKey(bridge));
+        rest = rest.replace(new RegExp(re.source, 'gi'), hit => `${/^[;&|(\n]/.test(hit) ? hit[0] : ''} `);
+    }
+    return { bridges: [...bridges].sort(), rest };
+}
+function canonicalRemoteLaunch(match) {
+    const direct = match.facts.launcher === 'direct';
+    const program = direct ? match.bridge.bins[0] : `${match.facts.launcher} ${match.bridge.packages[0]}`;
+    const mode = match.bridge.mode === 'remote' ? ' remote' : match.bridge.id === 'supergateway_stdio_serve' ? ' --stdio' : ' --port';
+    return `${program}${mode}`;
+}
 // Container-scoped execution context immediately before an `rm` hit: a
 // docker/podman/nerdctl/kubectl exec|run (incl. `compose exec/run`) earlier in
 // the SAME statement (no ; & | between). Inside that context a bare `rm -rf *`
@@ -817,7 +1007,7 @@ function astDestructiveRm(facts, inContainer = false) {
         for (const target of targets) {
             const t = target.value.trim().replace(/\\/g, '/');
             const lower = t.toLowerCase();
-            if (/^\/+\*?$/.test(t))
+            if (isRootRemovalTarget(t))
                 return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
             if (/^(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/+\*?)?$/.test(lower))
                 return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
@@ -857,6 +1047,11 @@ function destructiveCommandDecision(value) {
         return regexHit;
     if (astHit)
         return astHit;
+    // The AST parsed the literal command only. A hit that exists only in a
+    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) is
+    // outside what it saw, so it cannot clear it.
+    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(value, { literalOnly: true })?.itemId || ''))
+        return regexHit;
     if (regexRm) {
         // The AST cleared the rm-scope hit; other destructive rules still apply.
         return destructiveCommandReason(value, { skipRmScope: true });
@@ -898,8 +1093,60 @@ function cdScopedBeforeBareStar(before) {
     // At least one real path component that is not `.`/`..`.
     return lower.split('/').some(part => part && part !== '.' && part !== '..');
 }
+/**
+ * An absolute removal target that resolves to the filesystem root or every
+ * entry in it: `/`, `//`, `/*`, `/./`, `/tmp/..`, `/var/tmp/../../*`. A named
+ * path under a root (`/tmp/test-crate-cache`) is not root scope.
+ */
+function isRootRemovalTarget(raw) {
+    const target = raw.replace(/^["']|["']$/g, '').replace(/\\/g, '/');
+    if (!target.startsWith('/'))
+        return false;
+    const parts = [];
+    for (const part of target.split('/')) {
+        if (!part || part === '.')
+            continue;
+        if (part === '..')
+            parts.pop();
+        else
+            parts.push(part);
+    }
+    return parts.length === 0 || (parts.length === 1 && parts[0] === '*');
+}
+/** Every operand of a recursive, forced `rm` — not only the first one after the flags. */
+function rmRemovesRoot(lower) {
+    for (const invocation of lower.matchAll(/(?:^|[\s;&|(`])(?:sudo\s+)?rm((?:\s+[^\s;&|)`]+)+)/g)) {
+        const words = invocation[1].trim().split(/\s+/);
+        let recursive = false, force = false, flagsDone = false;
+        const operands = [];
+        for (const word of words) {
+            if (!flagsDone && word === '--') {
+                flagsDone = true;
+                continue;
+            }
+            if (!flagsDone && /^--/.test(word)) {
+                if (word === '--recursive')
+                    recursive = true;
+                if (word === '--force')
+                    force = true;
+                continue;
+            }
+            if (!flagsDone && /^-[a-z]+$/.test(word)) {
+                if (word.includes('r'))
+                    recursive = true;
+                if (word.includes('f'))
+                    force = true;
+                continue;
+            }
+            operands.push(word);
+        }
+        if (recursive && force && operands.some(isRootRemovalTarget))
+            return true;
+    }
+    return false;
+}
 function destructiveCommandReason(value, opts = {}) {
-    return matchCommand(value, (text, lower) => {
+    const check = (text, lower) => {
         if (!opts.skipRmScope) {
             // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
             // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
@@ -913,6 +1160,9 @@ function destructiveCommandReason(value, opts = {}) {
             const splitFlags = /\b(?:sudo\s+)?rm\s+((?:-(?:[a-z]+|-recursive|-force|-no-preserve-root)\s+){2,})["']?\/\*?["']?(?:\s|$|[;&|)])/.exec(lower);
             if (splitFlags && /(?:^|\s)-(?:[a-z]*r|-recursive)/.test(splitFlags[1]) && /(?:^|\s)-(?:[a-z]*f|-force)/.test(splitFlags[1]))
                 return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            // A root operand after another one, or reached by climbing (`rm -rf /tmp/x /`, `rm -rf /tmp/..`).
+            if (rmRemovesRoot(lower))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
             // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
             // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
             if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
@@ -963,7 +1213,11 @@ function destructiveCommandReason(value, opts = {}) {
         if (/\bgit\s+(?:reset\s+--hard|clean\s+-f(?:d|x|dx)?\b)/i.test(text))
             return { itemId: 'git_clean_force', reason: 'destructive git clean/reset' };
         return undefined;
-    });
+    };
+    if (!opts.literalOnly)
+        return matchCommand(value, check);
+    const literal = normalizeForCommand(value);
+    return check(literal, literal.toLowerCase());
 }
 function reverseShellReason(value) {
     return matchCommand(value, (text) => {
@@ -1101,12 +1355,29 @@ const METADATA_SEARCH_PROGRAMS = new Set([
  * Split on unquoted `;` / `&&` / `||` / `|` / newline so a pipe cannot hide a
  * later client (`rg … | curl http://169.254…`) while `rg "a|b"` stays one segment.
  */
+/**
+ * PowerShell escape: inside `"…"` a backtick makes the next character literal
+ * (`` `" `` does not close the string); outside quotes `` `" `` / `` `' `` /
+ * `` `$ `` and a trailing backtick (line continuation) are escapes, not a
+ * POSIX command substitution.
+ */
+function isPowerShellBacktickEscape(text, i, quote) {
+    if (text[i] !== '`' || i + 1 >= text.length)
+        return false;
+    if (quote === '"')
+        return true;
+    return quote === null && /["'$\s]/.test(text[i + 1]);
+}
 function splitUnquotedCommandSegments(command) {
     const out = [];
     let cur = '';
     let quote = null;
     for (let i = 0; i < command.length; i++) {
         const c = command[i];
+        if (isPowerShellBacktickEscape(command, i, quote)) {
+            cur += c + command[++i];
+            continue;
+        }
         if (quote) {
             cur += c;
             if (c === '\\' && i + 1 < command.length) {
@@ -1272,11 +1543,15 @@ function unquotedCode(text) {
     let out = '';
     for (let i = 0; i < text.length; i++) {
         const c = text[i];
+        if (isPowerShellBacktickEscape(text, i, null)) {
+            out += c + text[++i];
+            continue;
+        }
         if (c === "'" || c === '"' || c === '`') {
             const q = c;
             i += 1;
             while (i < text.length) {
-                if (text[i] === '\\') {
+                if (text[i] === '\\' || (q === '"' && text[i] === '`')) {
                     i += 2;
                     continue;
                 }
@@ -1304,7 +1579,7 @@ function stripInertDataSegments(text) {
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
-    out = src.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
+    out = src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
         const body = dq !== undefined ? dq : (sq || '');
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
@@ -1417,7 +1692,58 @@ function credentialAccessCommandText(text) {
         return text;
     statements.push(current);
     // A real shell separator is a boundary of the preceding path, even without spaces.
-    return statements.map(statement => allowMetadata && (isFileMetadataQuery(statement) || isMetadataOnlyStatement(statement)) ? 'fcd_file_metadata' : statement).join('\n');
+    return statements.map(statement => {
+        if (!allowMetadata)
+            return statement;
+        if (isFileMetadataQuery(statement) || isMetadataOnlyStatement(statement))
+            return 'fcd_file_metadata';
+        return withoutWrittenLiterals(statement);
+    }).join('\n');
+}
+/**
+ * access.role of a QUOTED LITERAL, from the programs that receive it. A string
+ * that is only printed or written into a file is data, whatever path it spells:
+ * `'{"file_path":"~/.aws/credentials"}' | Set-Content fixture.json` and
+ * `echo '…/.aws/credentials' > case.txt` open nothing. The producer is a bare
+ * literal (a PowerShell value) or a printer; every consumer is a content
+ * writer or formatter whose pipeline input is TEXT, never a path it opens
+ * (`'~/.aws/credentials' | Get-Content` is a read and stays one). Unquoted
+ * operands — the file written, a `>` target — are never masked, so writing TO a
+ * credential file is still seen. Substitution, grouping, script blocks and
+ * stdin redirection keep the statement as it is.
+ */
+const LITERAL_PRINTERS = new Set(['echo', 'printf', 'write-output', 'write', 'write-host']);
+const LITERAL_CONTENT_SINKS = new Set([
+    'set-content', 'sc', 'add-content', 'ac', 'out-file', 'tee', 'tee-object', 'out-null', 'out-string', 'convertto-json', 'convertfrom-json',
+]);
+const QUOTED_LITERAL_RE = /^(?:"[^"\r\n]*"|'(?:[^'\r\n]|'')*')$/;
+function withoutWrittenLiterals(statement) {
+    if (/\$\(|`/.test(statement) || /[(){}<]/.test(unquotedCode(statement)))
+        return statement;
+    const tokens = statement.trim().match(/"[^"\r\n]*"|'(?:[^'\r\n]|'')*'|[^\s"']+/g) || [];
+    if (!tokens.some(token => QUOTED_LITERAL_RE.test(token)))
+        return statement;
+    const segments = [[]];
+    for (const token of tokens) {
+        if (token === '|')
+            segments.push([]);
+        else
+            segments[segments.length - 1].push(token);
+    }
+    const producer = segments[0];
+    const bareLiteral = producer.length > 0 && producer.every(token => QUOTED_LITERAL_RE.test(token));
+    if (!bareLiteral && !LITERAL_PRINTERS.has(leadingProgram(producer).program))
+        return statement;
+    if (!segments.slice(1).every(segment => LITERAL_CONTENT_SINKS.has(leadingProgram(segment).program)))
+        return statement;
+    // Only the producer's quoted operands are data; `>` targets and sink operands stay.
+    let redirectTarget = false;
+    const masked = producer.map(token => {
+        const isTarget = redirectTarget;
+        redirectTarget = /^[\d*&]?>>?\|?$/.test(token);
+        return !isTarget && QUOTED_LITERAL_RE.test(token) ? "'fcd_written_literal'" : token;
+    });
+    return [masked, ...segments.slice(1)].map(segment => segment.join(' ')).join(' | ');
 }
 /**
  * access.role of a statement, from its LEADING PROGRAM: what does this program
@@ -1548,6 +1874,13 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
         if (finding)
             return finding;
     }
+    const remoteBridge = remoteControlBridgeInCommand(value);
+    if (remoteBridge) {
+        // Evidence is the canonical launch (launcher, package, mode) — never the argument text.
+        const finding = builtIn('remote_control_bridge', 'remote_control', 'remote_control', 'local-remote-control-bridge', remoteBridge.bridge.card, canonicalRemoteLaunch(remoteBridge), remoteBridge.bridge.label, options);
+        if (finding)
+            return { ...finding, remoteControl: remoteBridge.facts };
+    }
     const destructive = destructiveCommandDecision(value);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
@@ -1562,6 +1895,213 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     }
     return undefined;
 }
+// ---- agent guard tamper: the agent switching off the hooks that police it ----
+// Every rule in this file stops working once the agent edits the file that
+// registers the hook. These rules decide on one structural fact: the TARGET is
+// an AI agent's hook/settings file and the action turns hooks off, removes or
+// rewrites that file, or uninstalls FullCourtDefense. Reading those files, or
+// editing them for anything else (permissions, MCP servers, env), never matches.
+/** Agent hook/settings files, matched on the normalized path (lowercase, `/`). */
+const AGENT_HOOK_CONFIG_RE = /(?:^|[/\s'"=:(])(?:\.claude\/settings(?:\.local)?\.json|\.cursor\/hooks\.json|\.codex\/hooks\.json|\.copilot\/settings\.json|\.gemini\/settings\.json|\.codeium\/windsurf\/hooks\.json|\.kiro\/hooks\/[^\s'"/]+\.json|(?:claudecode|claude-code)\/managed-settings(?:\.d\/[^\s'"/]+)?\.json|(?:programdata|etc|application support)\/cursor\/hooks\.json)(?=$|[\s'"`;|&)>,])/;
+/** A value that turns every non-managed hook off (Claude-format settings keys). */
+const HOOKS_OFF_SETTING_RE = /\b(?:disableAllHooks|allowManagedHooksOnly)["']?\s*[:=]\s*(?:true|\$true|1)\b/i;
+const CLAUDE_CONFIG_SET_HOOKS_OFF_RE = /\bconfig\s+set\s+(?:(?:-g|--global)\s+)?(?:disableAllHooks|allowManagedHooksOnly)\s+(?:true|1)\b/i;
+const HOOK_CONFIG_MUTATING_PROGRAMS = new Set([
+    'rm', 'rmdir', 'unlink', 'shred', 'truncate', 'del', 'erase', 'rd', 'remove-item', 'ri',
+    'mv', 'move', 'move-item', 'mi', 'ren', 'rename', 'rename-item', 'rni',
+    'tee', 'tee-object', 'sponge', 'set-content', 'add-content', 'ac', 'clear-content', 'clc', 'out-file',
+]);
+const HOOK_CONFIG_COPY_PROGRAMS = new Set(['cp', 'copy', 'copy-item', 'cpi', 'xcopy', 'robocopy']);
+const HOOK_CONFIG_READ_ONLY_PROGRAMS = new Set([
+    'cat', 'type', 'get-content', 'gc', 'less', 'more', 'head', 'tail', 'jq', 'rg', 'grep', 'egrep', 'fgrep',
+    'findstr', 'select-string', 'sls', 'ls', 'dir', 'get-item', 'gi', 'get-childitem', 'gci', 'stat', 'test-path',
+    'code', 'cursor', 'notepad', 'wc', 'diff', 'fc', 'git', 'echo', 'write-output', 'write-host', 'printf',
+]);
+const INLINE_INTERPRETERS = new Set(['node', 'deno', 'bun', 'python', 'python3', 'py', 'perl', 'ruby', 'pwsh', 'powershell']);
+const INLINE_FILE_MUTATION_RE = /\b(?:writeFileSync|appendFileSync|unlinkSync|rmSync|renameSync|copyFileSync|WriteAllText|WriteAllLines|WriteAllBytes|AppendAllText|os\.remove|os\.unlink|os\.replace|shutil\.move|shutil\.copy(?:file)?)\b|\[(?:system\.)?io\.file\]::(?:delete|move|copy|writealltext|writealllines)|\bopen\([^)]*,\s*['"][wa]/i;
+const FCD_PROGRAMS = new Set(['fullcourtdefense', 'fcd', 'fullcourtdefense-cli']);
+const TAMPER_PATH_KEY_RE = /(?:path|file|filename|target|dest|destination|uri)$/i;
+const DELETE_TOOL_NAMES = new Set(['deletefile', 'delete', 'removefile', 'remove', 'rm', 'unlink']);
+function mentionsAgentHookConfig(text) {
+    return AGENT_HOOK_CONFIG_RE.test(normalizeForPath(text));
+}
+function segmentTokens(segment) {
+    return (segment.match(/(?:[^\s"']+|"(?:[^"`]|`[\s\S])*"|'[^']*')+/g) || []).map(token => token.replace(/^["']|["']$/g, ''));
+}
+function segmentProgram(tokens) {
+    let i = 0;
+    while (i < tokens.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i]) || /^(?:sudo|doas|env|command|builtin|exec|nohup|time|&|\.)$/i.test(tokens[i])))
+        i++;
+    const program = (tokens[i] || '').toLowerCase().replace(/^.*[\\/]/, '').replace(/\.(?:exe|cmd|bat|ps1)$/, '');
+    return { program, rest: tokens.slice(i + 1) };
+}
+/** Targets of unquoted `>` / `>>` redirections (stderr `2>` and `=>` / `->` are not file writes). */
+function redirectTargets(segment) {
+    const out = [];
+    for (const match of segment.matchAll(/(?:^|[^0-9&>=-])>{1,2}\s*(["']?)([^\s"'|;&<>]+)\1/g))
+        out.push(match[2]);
+    return out;
+}
+function isFcdUninstall(program, rest) {
+    let prog = program;
+    let args = rest;
+    if (prog === 'npx' || prog === 'pnpx' || prog === 'bunx') {
+        const operands = args.filter(token => !token.startsWith('-'));
+        prog = (operands[0] || '').toLowerCase().replace(/(?!^)@.*$/, '');
+        args = operands.slice(1);
+    }
+    if (FCD_PROGRAMS.has(prog))
+        return /^uninstall/i.test(args.find(token => !token.startsWith('-')) || '');
+    if (prog === 'npm' || prog === 'pnpm' || prog === 'yarn' || prog === 'bun') {
+        return args.some(token => /^(?:uninstall|remove|rm|r|un|unlink)$/i.test(token))
+            && args.some(token => /^fullcourtdefense-cli(?:@|$)/i.test(token));
+    }
+    if (prog === 'msiexec') {
+        const at = args.findIndex(token => /^[/-](?:x|uninstall)$/i.test(token));
+        return at >= 0 && /fullcourtdefense/i.test(args[at + 1] || '');
+    }
+    if (prog === 'schtasks') {
+        if (!args.some(token => /^[/-](?:delete|disable)$/i.test(token)))
+            return false;
+        const at = args.findIndex(token => /^[/-]tn$/i.test(token));
+        return at >= 0 && isFcdTaskName(args[at + 1] || '');
+    }
+    if (prog === 'unregister-scheduledtask' || prog === 'disable-scheduledtask') {
+        return optionValues(args, /^-taskname$/i, /^-(?:taskpath|cimsession)$/i).some(isFcdTaskName);
+    }
+    if (prog === 'winget')
+        return /^(?:uninstall|remove)$/i.test(args[0] || '') && args.slice(1).some(token => /fullcourtdefense/i.test(token));
+    if (prog === 'taskkill') {
+        const at = args.findIndex(token => /^[/-]im$/i.test(token));
+        return at >= 0 && /^fullcourtdefense/i.test(args[at + 1] || '');
+    }
+    if (prog === 'stop-process' || prog === 'spps' || prog === 'kill' || prog === 'pkill' || prog === 'killall') {
+        return optionValues(args, /^-(?:name|processname)$/i, /^-id$/i).some(name => /^fullcourtdefense/i.test(name));
+    }
+    if (INSTALL_ROOT_REMOVERS.has(prog)) {
+        return args.filter(token => !/^-/.test(token) && !/^\/[a-z]{1,3}$/i.test(token)).some(isFcdInstallRoot);
+    }
+    return false;
+}
+/** Scheduled tasks the installer and CLI register. A name outside the product namespace is not ours. */
+const FCD_TASK_NAMES = [
+    'FullCourtDefense Updater', 'FullCourtDefense Daemon', 'FullCourtDefense Daemon Watchdog',
+    'FullCourtDefense Recovery', 'FullCourtDefense Auto-Protect', 'FullCourtDefenseDesktopDiscover',
+];
+const INSTALL_ROOT_REMOVERS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'rd', 'remove-item', 'ri', 'rimraf', 'mv', 'move', 'move-item', 'mi', 'ren', 'rename-item', 'rni']);
+/** A task name (or wildcard) that selects a FullCourtDefense task — by its product-namespace name, not a substring. */
+function isFcdTaskName(raw) {
+    const name = raw.replace(/^["']|["']$/g, '').replace(/\\$/, '').replace(/^.*\\/, '').trim();
+    if (!name)
+        return false;
+    if (!/[*?]/.test(name))
+        return /^fullcourtdefense/i.test(name);
+    const glob = new RegExp(`^${name.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')}$`, 'i');
+    return FCD_TASK_NAMES.some(task => glob.test(task));
+}
+/** The install root (`Program Files\FullCourtDefense`) or the machine state root (`ProgramData\FullCourtDefense`), or a path inside them. */
+function isFcdInstallRoot(raw) {
+    const path = raw.replace(/^["']|["']$/g, '').replace(/\\/g, '/').toLowerCase();
+    return /(?:^|\/|%|\$(?:env:|\{env:))(?:program ?files(?: ?\(x86\))?|programfiles\(x86\)|programdata|allusersprofile)[%}]?\/fullcourtdefense(?:\/|$)/.test(path);
+}
+/** Values of a named parameter plus positional operands (skipping the values of `skipNamed`). */
+function optionValues(args, named, skipNamed) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const token = args[i];
+        if (named.test(token)) {
+            if (args[i + 1] !== undefined)
+                out.push(...args[i + 1].split(','));
+            i++;
+            continue;
+        }
+        if (skipNamed.test(token)) {
+            i++;
+            continue;
+        }
+        if (/^-/.test(token))
+            continue;
+        out.push(...token.split(','));
+    }
+    return out;
+}
+/**
+ * Shell view: per unquoted segment, the leading program decides. Quoted prose
+ * (commit messages, issue bodies, echo text) is removed before redirections
+ * and off-switch keys are judged, so writing ABOUT the setting never matches.
+ */
+function hookConfigShellChange(command) {
+    for (const rawSegment of splitUnquotedCommandSegments(command)) {
+        const raw = rawSegment.trim();
+        if (!raw)
+            continue;
+        const { program, rest } = segmentProgram(segmentTokens(raw));
+        if (isFcdUninstall(program, rest)) {
+            return { itemId: 'fcd_uninstalled_by_agent', reason: 'agent removing FullCourtDefense from this machine' };
+        }
+        const stripped = stripInertDataSegments(raw);
+        if (program === 'claude' && CLAUDE_CONFIG_SET_HOOKS_OFF_RE.test(stripped)) {
+            return { itemId: 'agent_hooks_switched_off', reason: 'agent turning off AI agent hooks' };
+        }
+        if (!mentionsAgentHookConfig(raw))
+            continue;
+        if (redirectTargets(stripped).some(mentionsAgentHookConfig)) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent overwriting an AI agent hook configuration file' };
+        }
+        if (HOOK_CONFIG_READ_ONLY_PROGRAMS.has(program))
+            continue;
+        const operands = rest.filter(token => !/^-/.test(token) && !/^\/[a-z]{1,3}$/i.test(token));
+        if (HOOK_CONFIG_MUTATING_PROGRAMS.has(program) && operands.some(mentionsAgentHookConfig)) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent removing or rewriting an AI agent hook configuration file' };
+        }
+        if ((program === 'new-item' || program === 'ni') && rest.some(token => /^-force$/i.test(token)) && operands.some(mentionsAgentHookConfig)) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent overwriting an AI agent hook configuration file' };
+        }
+        if ((program === 'sed' || program === 'perl') && rest.some(token => /^-[a-z]*i/i.test(token)) && operands.some(mentionsAgentHookConfig)) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent editing an AI agent hook configuration file in place' };
+        }
+        if (HOOK_CONFIG_COPY_PROGRAMS.has(program) && operands.length >= 2 && mentionsAgentHookConfig(operands[operands.length - 1])) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent replacing an AI agent hook configuration file' };
+        }
+        if (INLINE_FILE_MUTATION_RE.test(INLINE_INTERPRETERS.has(program) ? raw : stripped)) {
+            return { itemId: 'agent_hook_config_removed', reason: 'agent rewriting an AI agent hook configuration file from a script' };
+        }
+        if (HOOKS_OFF_SETTING_RE.test(stripped)) {
+            return { itemId: 'agent_hooks_switched_off', reason: 'agent turning off AI agent hooks' };
+        }
+    }
+    return undefined;
+}
+/** Tool view (file edit / write / delete tools): the target path decides, the content only for the off-switch. */
+function hookConfigToolChange(toolName, candidates) {
+    const target = candidates.find(candidate => {
+        const lastKey = candidate.keyPath.split('.').pop() || '';
+        return TAMPER_PATH_KEY_RE.test(lastKey) && !/[\r\n]/.test(candidate.value) && candidate.value.length < 1024
+            && mentionsAgentHookConfig(candidate.value);
+    });
+    if (!target)
+        return undefined;
+    if (DELETE_TOOL_NAMES.has(toolName.toLowerCase().replace(/[_-]/g, ''))) {
+        return { itemId: 'agent_hook_config_removed', reason: 'agent deleting an AI agent hook configuration file', evidence: target.value };
+    }
+    if (candidates.some(candidate => candidate !== target && HOOKS_OFF_SETTING_RE.test(candidate.value))) {
+        return { itemId: 'agent_hooks_switched_off', reason: 'agent turning off AI agent hooks', evidence: target.value };
+    }
+    return undefined;
+}
+function agentGuardTamperFinding(toolName, candidates, options) {
+    const finding = (hit, value) => builtIn(hit.itemId, 'agent_guard_tamper', 'agent_guard_tamper', 'local-agent-guard-tamper', `Agent action would switch off the protection on this machine: ${hit.reason}.`, value, hit.reason, options);
+    for (const candidate of candidates) {
+        if (!isCommandContext(toolName, candidate))
+            continue;
+        const hit = hookConfigShellChange(candidate.value);
+        const found = hit && finding(hit, candidate.value);
+        if (found)
+            return found;
+    }
+    const hit = hookConfigToolChange(toolName, candidates);
+    return hit ? finding(hit, hit.evidence) : undefined;
+}
 /**
  * A string can only DO something in an actionable context: a shell command, an outbound
  * request, or a path/target argument. File CONTENTS being written or edited are inert —
@@ -1592,6 +2132,19 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
         if (custom)
             return custom;
     }
+    // A tamper finding asks by default; a chained `rm -rf / ; rm ~/.cursor/hooks.json`
+    // must still hit the stricter built-in block, so a non-block tamper finding
+    // yields only to a block.
+    const tamper = agentGuardTamperFinding(toolName, candidates, options);
+    const blocks = (finding) => (finding.action || 'block') === 'block';
+    if (tamper && blocks(tamper))
+        return tamper;
+    const other = scanBuiltInRules(toolName, toolArgs, candidates, outbound, options);
+    if (tamper && !(other && blocks(other)))
+        return tamper;
+    return other;
+}
+function scanBuiltInRules(toolName, toolArgs, candidates, outbound, options) {
     for (const candidate of candidates) {
         const finding = scanTextValue(toolName, candidate.value, options, isCommandContext(toolName, candidate));
         if (!finding)