fullcourtdefense-cli 1.36.2 → 1.36.3

package/dist/actionPolicyEngine.js

@@ -7461,8 +7461,17 @@ var GIT_NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "receive-pack",
   "lfs"
 ]);
+var POWERSHELL_LINE_RE = /\$env:|-ErrorAction\b|\bWrite-(?:Output|Host)\b|\b(?:Get|Set|New|Remove|Start|Stop|Invoke|Select|Where|ForEach|Test|Add|Format|Out|ConvertTo|ConvertFrom|Import|Export|Measure|Sort|Group|Restart|Register|Unregister|Enable|Disable|Copy|Move|Rename|Resolve|Split|Join|Read|Wait|Clear)-[A-Z][A-Za-z]+\b|@\{|@'|@"|\[(?:System\.|Security\.|IO\.|math\])|\$_\.|\$\w+\s*=\s*(?:Get|New|Read)-|\|\s*%\s|\|\s*\?\s/;
+var POWERSHELL_ONLY_SYNTAX_RE = /(?:^|[\s;{(|])\$[A-Za-z_][\w:]*\s*[+-]?=(?!=)|`"|(?:^|[\s;{])(?:if|elseif|foreach|while|switch)\s*\((?!\()|\}\s*(?:else|elseif|catch|finally)\b|\|\s*(?:where|foreach|%|\?)\s*\{/i;
+var POWERSHELL_ESCAPES_ONLY_RE = /^(?:[^`]|`[$"'`0abefnrtuv])*$/;
+function backtickMayExecute(segment) {
+  if (!segment.includes("`")) return false;
+  const code = maskQuotedSpans(segment);
+  const powershell = POWERSHELL_LINE_RE.test(code) || POWERSHELL_ONLY_SYNTAX_RE.test(code);
+  return !(powershell && POWERSHELL_ESCAPES_ONLY_RE.test(segment));
+}
 function segmentMayReachNetwork(segment) {
-  if (/\$\(|`/.test(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
+  if (segment.includes("$(") || backtickMayExecute(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
   return splitShellSegments(segment, true).some((stage) => {
     if (/^\s*(?:\$[\w:]+|[A-Za-z_]\w*)\s*=/.test(stage)) return true;
     const masked = maskQuotedSpans(stage);

package/dist/askHeader.d.ts

@@ -67,6 +67,12 @@ export interface AskHeader {
 }
 /** The client id as the console labels it; undefined for a missing or placeholder id. */
 export declare function agentClientLabel(raw?: string): string | undefined;
+/**
+ * The guard's credential-command patterns (`deterministicGuard` CREDENTIAL_COMMAND_RULES), for
+ * naming a secret the line sends somewhere when ANOTHER rule asked. Copied because this module stays
+ * pure (the guard reads files); test-ask-dialog.js fails when the two differ.
+ */
+export declare const LINE_CREDENTIAL_PATTERNS: Readonly<Record<string, string>>;
 /** Name tokens of a project id → environment. Deterministic, and only a hint: the dialog says "(by name)". */
 export declare function environmentTag(projectId: string): EnvironmentTag | undefined;
 interface ProjectRead {

package/dist/askHeader.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.LINE_CREDENTIAL_PATTERNS = void 0;
 exports.agentClientLabel = agentClientLabel;
 exports.environmentTag = environmentTag;
 exports.projectsInCommand = projectsInCommand;
@@ -17,6 +18,7 @@ exports.buildAskHeader = buildAskHeader;
  * browser extension bundles `approvalPrompt.ts` (and so this module) for the browser.
  */
 const commandNarrative_1 = require("./commandNarrative");
+const shellQuoteMask_1 = require("./shellQuoteMask");
 const MAX_COMMAND = 90;
 /** The console's client names (`frontend/src/lib/activityClient.ts`): the dialog and the console name the same agent. */
 const CLIENT_LABELS = {
@@ -186,6 +188,24 @@ const TOKEN_PRINTER_ACTIONS = [
     { re: /\bgcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+print-identity-token\b/i, action: 'Reads a cloud identity token' },
     { re: /\bgh(?:\.exe)?\s+auth\s+token\b/i, action: 'Reads the GitHub token' },
 ];
+/**
+ * The guard's credential-command patterns (`deterministicGuard` CREDENTIAL_COMMAND_RULES), for
+ * naming a secret the line sends somewhere when ANOTHER rule asked. Copied because this module stays
+ * pure (the guard reads files); test-ask-dialog.js fails when the two differ.
+ */
+exports.LINE_CREDENTIAL_PATTERNS = {
+    gh_auth_token_cmd: String.raw `\bgh\s+auth\s+token\b|\bgh\s+auth\s+status\b(?=[^\n;|&]*(?:--show-token|\s-t\b))`,
+    git_credential_fill: String.raw `\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b`,
+    macos_keychain_dump: String.raw `\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b|\bsecurity\s+dump-keychain\b`,
+    kubectl_config_raw: String.raw `\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b`,
+    aws_export_credentials: String.raw `\baws\s+configure\s+export-credentials\b|\baws\s+configure\s+get\b[^\n;|&]*secret`,
+    gcloud_access_token_cmd: String.raw `\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b`,
+    gcloud_secret_access_cmd: String.raw `\bgcloud\s+secrets\s+versions\s+access\b`,
+    az_access_token_cmd: String.raw `\baz\s+account\s+get-access-token\b`,
+    aws_secret_fetch_cmd: String.raw `\baws\s+secretsmanager\s+get-secret-value\b|\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b`,
+    vault_read_cmd: String.raw `\bvault\s+(?:kv\s+get|read)\b`,
+};
+const LINE_CREDENTIAL = Object.entries(exports.LINE_CREDENTIAL_PATTERNS).map(([item, pattern]) => ({ item, re: new RegExp(pattern, 'i') }));
 const HOW_RANK = ['delete', 'permissions', 'protected', 'change', 'read'];
 /** Name tokens of a project id → environment. Deterministic, and only a hint: the dialog says "(by name)". */
 function environmentTag(projectId) {
@@ -272,22 +292,31 @@ function oneLine(text, max = MAX_COMMAND) {
         tail = tail.slice(tailSpace + 1);
     return `${head.trimEnd()} … ${tail.trimStart()}`;
 }
+/**
+ * The line as the shell reads it (`maskShell`, dialect from the line): quoted
+ * text keeps its length but loses spaces, quotes and `$`, so no flag, URL or
+ * program starts inside a commit message or issue body. Facts come from here.
+ */
+function codeOf(command) {
+    return (0, shellQuoteMask_1.maskShell)(command, (0, shellQuoteMask_1.shellDialectOf)(command)).code;
+}
 /** Literal project ids named on the command: `--project x` / `--project=x` and Google API `projects/<id>` paths. */
 function projectsInCommand(command) {
+    const code = codeOf(command);
     const ids = [];
     let computed = false;
     const add = (raw) => {
         const value = raw.replace(/^["']|["']$/g, '');
-        if (/[$`(){}%<>]/.test(value) || !PROJECT_ID_RE.test(value.toLowerCase())) {
+        if (/[$`(){}%<>_]/.test(value) || !PROJECT_ID_RE.test(value.toLowerCase())) {
             computed = true;
             return;
         }
         if (!ids.includes(value.toLowerCase()))
             ids.push(value.toLowerCase());
     };
-    for (const m of command.matchAll(/(?:^|\s)--project(?:=|\s+)("[^"]*"|'[^']*'|[^\s;|&]+)/g))
+    for (const m of code.matchAll(/(?:^|\s)--project(?:=|\s+)("[^"]*"|'[^']*'|[^\s;|&]+)/g))
         add(m[1]);
-    for (const m of command.matchAll(/https?:\/\/[a-z0-9.-]*googleapis\.com\/[^\s"'`]*?\bprojects\/([^/\s"'`?#]+)/gi))
+    for (const m of code.matchAll(/(?:^|[\s=(,"'])https?:\/\/[a-z0-9.-]*googleapis\.com\/[^\s"'`]*?\bprojects\/([^/\s"'`?#]+)/gi))
         add(m[1]);
     return { ids, computed };
 }
@@ -441,15 +470,22 @@ function buildAskHeader(input) {
     const command = (input.command || '').trim();
     const shell = subject.event ? subject.event === 'shell' : /command$/.test(input.kind || '') || (!input.tool && Boolean(command));
     const noun = nounOf(input.kind, subject.event);
-    const item = ruleItem(subject, input.ruleDetail, input.policy);
+    const askedItem = ruleItem(subject, input.ruleDetail, input.policy);
+    const code = shell ? codeOf(command) : command;
+    const printer = shell ? TOKEN_PRINTER_ACTIONS.find(p => p.re.test(code)) : undefined;
+    // Another rule asked (egress, a cloud policy), but the line reads a credential and sends it to a host:
+    // that is the fact the developer must see (the credential rule itself may only warn, #1837).
+    const lineItem = shell && !(askedItem && CREDENTIAL_ACTIONS[askedItem]) ? LINE_CREDENTIAL.find(c => c.re.test(code))?.item : undefined;
+    const flows = shell && (lineItem || printer) ? (0, commandNarrative_1.capturedValueDestinations)(command, s => LINE_CREDENTIAL.some(c => c.re.test(codeOf(s)))) : [];
+    const viaFlow = Boolean(lineItem && flows.length);
+    const item = viaFlow ? lineItem : askedItem;
     const credentialAction = item ? CREDENTIAL_ACTIONS[item] : undefined;
     const cloud = cloudEntries(subject.cloud);
     const how = cloud.length ? strongestHow(cloud) : undefined;
     const decisiveEntries = how ? cloud.filter(entry => entry.how === how) : [];
     const decisiveTools = unique(decisiveEntries.map(entry => entry.tool));
-    const printer = shell ? TOKEN_PRINTER_ACTIONS.find(p => p.re.test(command)) : undefined;
     // A token read is about the token, even when the line also reaches a target not read yet (`curl` POST).
-    const credential = Boolean(credentialAction || (printer && (!how || how === '?')));
+    const credential = Boolean(credentialAction || (printer && (!how || how === '?' || flows.length > 0)));
     // Where: a credential line names the project its literal Google API URL / --project acts on;
     // otherwise what the cloud entries name (each unknown part stays "unknown"), else a literal
     // project on the command, else the host the action reaches.
@@ -458,7 +494,7 @@ function buildAskHeader(input) {
     const cloudWheres = unique(cloud.map(entryWhere));
     const names = useCloud ? unique(cloud.flatMap(environmentNames)) : literal.ids;
     const host = subject.destinationDomain || (subject.credentialHosts || [])[0]
-        || (shell ? /https?:\/\/([a-z0-9.-]+\.[a-z]{2,})(?=[/:\s"'`]|$)/i.exec(command)?.[1]?.toLowerCase() : undefined);
+        || (shell ? /(?:^|[\s=(,"'])https?:\/\/([a-z0-9.-]+\.[a-z]{2,})(?=[/:\s"'`]|$)/i.exec(code)?.[1]?.toLowerCase() : undefined);
     const tag = names.length ? strongestTag(names) : undefined;
     const hint = addHint(input.alwaysNotOffered, unique(cloud.map(entry => entry.tool)));
     let where;
@@ -481,7 +517,10 @@ function buildAskHeader(input) {
     if (credential) {
         source = 'credential';
         action = credentialAction || printer.action;
-        why = `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)}.`;
+        const sentTo = (subject.credentialHosts && subject.credentialHosts.length ? subject.credentialHosts : flows).slice(0, 3);
+        why = viaFlow && sentTo.length
+            ? `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)} and sends it to ${sentTo.join(', ')}.`
+            : `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)}.`;
     }
     else if (how) {
         source = 'cloud';
@@ -533,7 +572,7 @@ function buildAskHeader(input) {
         why = input.policy ? `Rule "${oneLine(input.policy, 80)}" asks before this ${noun} runs.` : `A policy asks before this ${noun} runs.`;
     }
     const decisive = !shell ? undefined
-        : source === 'credential' ? matchedSegment(command, s => TOKEN_PRINTER_ACTIONS.some(p => p.re.test(s)) || (item ? new RegExp(`\\b${(CREDENTIAL_PROGRAM[item] || '\\S')}`, 'i').test(s) : false))
+        : source === 'credential' ? matchedSegment(command, s => TOKEN_PRINTER_ACTIONS.some(p => p.re.test(codeOf(s))) || (item ? new RegExp(`\\b${(CREDENTIAL_PROGRAM[item] || '\\S')}`, 'i').test(codeOf(s)) : false))
             : source === 'cloud' ? (matchedSegment(command, s => toolSegment(decisiveTools, how).test(s) && !/\bgcloud\s+(?:auth|config)\b/i.test(s))
                 || matchedSegment(command, s => toolSegment(decisiveTools, 'any').test(s)))
                 : undefined;
@@ -545,7 +584,7 @@ function buildAskHeader(input) {
     let always = alwaysRow(input);
     if (credential) {
         const bound = subject.credentialHosts || [];
-        const followed = bound.length ? [] : (0, commandNarrative_1.tokenDestinations)(command);
+        const followed = bound.length ? [] : flows.length ? flows : (0, commandNarrative_1.tokenDestinations)(command);
         const label = (item && TOKEN_RULES.has(item)) || (!credentialAction && printer) ? 'Token sent to' : 'Secret sent to';
         secretSentTo = { label, value: [...bound, ...followed].slice(0, 3).join(', ') || 'unknown' };
         // A destination IS readable, but another step on the line is not: say that, not "could not be read".

package/dist/commandNarrative.d.ts

@@ -39,6 +39,11 @@ export declare function splitCommandSteps(command: string): string[];
 export declare function shortCode(value: string, max?: number): string;
 /** Every host a token read on this line is sent to, as the step list names it. Empty when none is readable. */
 export declare function tokenDestinations(command: string): string[];
+/**
+ * Every host a value stored by an assignment is sent to, when the assignment's value is one `reads`
+ * recognizes (a secret read the narrative does not capture), plus what `tokenDestinations` follows.
+ */
+export declare function capturedValueDestinations(command: string, reads: (segment: string) => boolean): string[];
 /** One plain-words line per step, in order. */
 export declare function describeShellCommand(command: string): CommandStep[];
 /** The step lines as the explanation prints them (`- …`). */

package/dist/commandNarrative.js

@@ -18,6 +18,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.splitCommandSteps = splitCommandSteps;
 exports.shortCode = shortCode;
 exports.tokenDestinations = tokenDestinations;
+exports.capturedValueDestinations = capturedValueDestinations;
 exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
 const MAX_STEPS = 14;
@@ -904,6 +905,32 @@ function tokenDestinations(command) {
     } });
     return [...new Set(described.flatMap((step, index) => step.captures ? tokenHosts(described, index, step.captures.variable) : []))].sort();
 }
+/** `$v = …` (PowerShell) or `v=$(…)` / `export v=$(…)` (POSIX): the variable an assignment step stores. */
+function assignedVariable(segment) {
+    return /^\s*\$([\w:]+)\s*=(?!=)/.exec(segment)?.[1] || /^\s*(?:export\s+)?([A-Za-z_]\w*)=\$\(/.exec(segment)?.[1];
+}
+/**
+ * Every host a value stored by an assignment is sent to, when the assignment's value is one `reads`
+ * recognizes (a secret read the narrative does not capture), plus what `tokenDestinations` follows.
+ */
+function capturedValueDestinations(command, reads) {
+    const steps = splitCommandSteps(command);
+    const fns = localFunctions(command);
+    const described = steps.map(segment => { try {
+        return describeOne(segment, undefined, fns);
+    }
+    catch {
+        return { segment, text: '', known: false };
+    } });
+    const hosts = new Set();
+    described.forEach((step, index) => {
+        const variable = step.captures?.variable || (reads(step.segment) ? assignedVariable(step.segment) : undefined);
+        if (variable)
+            for (const host of tokenHosts(described, index, variable))
+                hosts.add(host);
+    });
+    return [...hosts].sort();
+}
 function noteTokenDestinations(steps) {
     return steps.map((step, index) => {
         if (!step.captures)

package/dist/commands/daemon.js

@@ -73,6 +73,7 @@ const discoverPaths_1 = require("./discoverPaths");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const policyRefresh_1 = require("../policyRefresh");
 const telemetry_1 = require("../telemetry");
+const identityRecovery_1 = require("../identityRecovery");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
 const protectionMaintenance_1 = require("../protectionMaintenance");
@@ -1505,6 +1506,7 @@ async function runDaemon(args, config) {
         // flush lock, which drops the daemon marker specifically (hook flushes do
         // not set `daemon: true`), so retrying soon is right in that case too.
         let reported = false;
+        let refusal;
         try {
             let integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
             // Recovery outside our repair pass (for example a manual fix) also clears
@@ -1568,6 +1570,8 @@ async function runDaemon(args, config) {
                     : undefined,
             });
             reported = result !== null;
+            if (!reported)
+                refusal = (0, telemetry_1.getLastFlushFailure)();
             if (result && unreportedCrash)
                 (0, daemonForensics_1.markPostmortemReported)();
             if (result && result.accepted > 0)
@@ -1583,10 +1587,26 @@ async function runDaemon(args, config) {
         await verifyPendingUpgrade();
         // Surface the miss to the caller (poll loop / resume path) so it retries in
         // seconds. Nothing else can tell them: liveness has exactly one writer.
-        if (!reported)
-            throw new Error('heartbeat did not reach the backend — daemon liveness was not recorded');
+        if (!reported) {
+            // 409 MACHINE_NOT_ENROLLED: the id sent is not the one this shield is
+            // enrolled under — ask the backend for it; the retry then lands.
+            await (0, identityRecovery_1.recoverIdentityAfterRefusal)({ failure: refusal, apiUrl: creds.apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey, log })
+                .catch(() => false);
+            throw new Error((0, identityRecovery_1.describeHeartbeatMiss)(refusal));
+        }
     };
     // --- boot ---------------------------------------------------------------
+    // Settle the machine id before anything reports: the only place a pinned
+    // but unconfirmed fallback id may be re-checked against the OS (#1853).
+    try {
+        const id = (0, machineIdentity_1.reconcileMachineIdentity)('heal');
+        log(`Machine id ${(0, machineIdentity_1.shortMachineId)(id.machineId)} (${id.source}${id.confirmed ? ', backend-confirmed' : ''}${id.probed ? `, native read ${id.probeError ? `failed: ${id.probeError}` : 'ok'}` : ''}).`
+            + (id.healed ? ` Healed from stale fallback id ${(0, machineIdentity_1.shortMachineId)(id.healed.from)}.` : '')
+            + (id.conflict ? ` Native id ${(0, machineIdentity_1.shortMachineId)(id.conflict.native)} disagrees with the confirmed id — kept the confirmed one (machine_id_conflict).` : ''));
+    }
+    catch (error) {
+        log(`Machine id reconcile failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
     // Self-heal autostart + watchdog tasks: machines installed by older versions
     // (or where task creation failed once) must converge without a reinstall.
     ensureWindowsAutostartHealthy(log);
@@ -1625,7 +1645,7 @@ async function runDaemon(args, config) {
     // the network is up (captive portal, VPN, resumed in a lift) is routine, and
     // the heartbeat loop below retries within seconds.
     await heartbeat().catch(error => {
-        log(`First heartbeat did not reach the backend (${error?.message || String(error)}) — the heartbeat loop will retry shortly.`);
+        log(`First heartbeat failed: ${error?.message || String(error)}. The heartbeat loop will retry shortly.`);
     });
     // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
     // chat has no hook and never hits an MCP server, so it is the one machine

package/dist/commands/demoActions.js

@@ -176,8 +176,8 @@ exports.DEMO_SCENARIOS = [
         id: 'recursive-delete',
         title: 'Recursive delete of a project folder',
         event: 'shell',
-        payload: { command: 'rm -rf ~/projects/payments' },
-        why: 'Destructive filesystem operations are classified as DELETE and can be governed by policy.',
+        payload: { command: 'rm -rf ~/projects' },
+        why: 'A recursive delete of a top-level home folder is classified as DELETE and can be governed by policy. Nested work paths (`~/projects/payments`) are workspace writes, not DELETE.',
     },
 ];
 function tildify(filePath) {

package/dist/commands/deterministicGuard.d.ts

@@ -204,6 +204,11 @@ export declare function setShellAstMode(mode: ShellAstMode): void;
 export declare function getShellAstMode(): ShellAstMode;
 /** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
 export declare function takeShellAstComparison(): ShellAstComparison | undefined;
+/**
+ * PowerShell line, judged on its CODE only (`unquotedCode`): a cmdlet named
+ * inside a commit message or issue body does not change how the shell reads it.
+ */
+export declare function isPowerShellLine(text: string): boolean;
 /**
  * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
  * space. Detectors that ask "does this EXECUTE" must look here; the raw line

package/dist/commands/deterministicGuard.js

@@ -46,6 +46,7 @@ exports.setShellAstProvider = setShellAstProvider;
 exports.setShellAstMode = setShellAstMode;
 exports.getShellAstMode = getShellAstMode;
 exports.takeShellAstComparison = takeShellAstComparison;
+exports.isPowerShellLine = isPowerShellLine;
 exports.unquotedCode = unquotedCode;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
@@ -1510,7 +1511,9 @@ function isSensitivePathContext(toolName, candidate) {
 //      (`wsl -e bash -c ""r""m"…`) that per-span reasoning cannot survive.
 //   2. A double-quoted span containing $( … ) or real backtick command
 //      substitution is kept — substitution executes BEFORE the outer command.
-//      A single-char backtick pair (`n, `t) is a PowerShell ESCAPE, not code.
+//      A single-char backtick pair (`n, `t) is a PowerShell ESCAPE, not code;
+//      on a PowerShell line (`isPowerShellLine`) so is every `$ `" `` `n in
+//      a body that uses the backtick only that way. `""` is an escaped quote.
 //   3. Single-token quoted spans (rm -rf "/") are argv, not prose — kept.
 //   4. Quoted spans in a CODE POSITION (interpreter -c/-Command/-e flags, or a
 //      remote executor earlier in the same statement) are kept.
@@ -1571,6 +1574,31 @@ function interpreterFileArguments(text) {
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
+// Same signals as shellDialectOf (shellQuoteMask.ts / shellAst.ts looksLikePowerShell).
+const POWERSHELL_LINE = /\$env:|-ErrorAction\b|\bWrite-(?:Output|Host)\b|\b(?:Get|Set|New|Remove|Start|Stop|Invoke|Select|Where|ForEach|Test|Add|Format|Out|ConvertTo|ConvertFrom|Import|Export|Measure|Sort|Group|Restart|Register|Unregister|Enable|Disable|Copy|Move|Rename|Resolve|Split|Join|Read|Wait|Clear)-[A-Z][A-Za-z]+\b|@\{|@'|@"|\[(?:System\.|Security\.|IO\.|math\])|\$_\.|\$\w+\s*=\s*(?:Get|New|Read)-|\|\s*%\s|\|\s*\?\s/;
+const POWERSHELL_ONLY_SYNTAX = /(?:^|[\s;{(|])\$[A-Za-z_][\w:]*\s*[+-]?=(?!=)|`"|(?:^|[\s;{])(?:if|elseif|foreach|while|switch)\s*\((?!\()|\}\s*(?:else|elseif|catch|finally)\b|\|\s*(?:where|foreach|%|\?)\s*\{/i;
+/**
+ * PowerShell line, judged on its CODE only (`unquotedCode`): a cmdlet named
+ * inside a commit message or issue body does not change how the shell reads it.
+ */
+function isPowerShellLine(text) {
+    const code = unquotedCode(text);
+    return POWERSHELL_LINE.test(code) || POWERSHELL_ONLY_SYNTAX.test(code);
+}
+// Every backtick is a canonical PowerShell escape (`$ `" `' `` `n `t `r `0 …).
+const POWERSHELL_ESCAPES_ONLY = /^(?:[^`]|`[$"'`0abefnrtuv])*$/;
+/**
+ * Does a double-quoted body run code before its command? `$( … )` always does.
+ * A backtick pair is POSIX command substitution, except on a PowerShell line
+ * whose body uses the backtick only as PowerShell's escape character there.
+ */
+function doubleQuotedInterpolates(body, powershell) {
+    if (body.includes('$('))
+        return true;
+    if (!/`[^`]{2,}`/.test(body))
+        return false;
+    return !(powershell && POWERSHELL_ESCAPES_ONLY.test(body));
+}
 const INERT_DATA = ' fcd_inert_data ';
 // Code position immediately before a quoted span: interpreter code flags or a
 // remote/nested executor earlier in the same statement (no ; & | between).
@@ -1596,6 +1624,11 @@ function unquotedCode(text) {
                     i += 2;
                     continue;
                 }
+                // `""` inside "…" is PowerShell's escaped quote; POSIX reads close+reopen, text either way.
+                if (q === '"' && text[i] === '"' && text[i + 1] === '"') {
+                    i += 2;
+                    continue;
+                }
                 if (text[i] === q)
                     break;
                 i += 1;
@@ -1629,12 +1662,12 @@ function replaceDelimited(text, open, close, fn) {
 }
 const LINE_TERMINATOR = new Set(['\n', '\r', '\u2028', '\u2029']);
 /**
- * `src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, fn)` in one
+ * `src.replace(/"((?:[^"\\`]|""|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, fn)` in one
  * pass, same matches and callback arguments (a PowerShell backtick escapes any
- * character inside double quotes). After an unclosed quote the regex retried
- * every later quote of that kind; each one before the dead end is the tail of an
- * escape pair and walks the same path to the same dead end (quadratic on a body
- * of `\"`).
+ * character inside double quotes; `""` is an escaped quote there). After an
+ * unclosed quote the regex retried every later quote of that kind; each one
+ * before the dead end is the tail of an escape pair and walks the same path to
+ * the same dead end (quadratic on a body of `\"`).
  */
 function replaceQuotedSpans(src, fn) {
     const deadUntil = { '"': -1, "'": -1 };
@@ -1651,6 +1684,10 @@ function replaceQuotedSpans(src, fn) {
         let closed = -1;
         while (j < src.length) {
             const c = src[j];
+            if (c === '"' && quote === '"' && src[j + 1] === '"') {
+                j += 2;
+                continue;
+            }
             if (c === quote) {
                 closed = j;
                 break;
@@ -1693,6 +1730,7 @@ function stripInertDataSegments(text) {
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
+    const powershell = isPowerShellLine(src);
     out = replaceQuotedSpans(src, (whole, dq, sq, offset) => {
         const body = dq !== undefined ? dq : (sq || '');
         if (!/\s/.test(body))
@@ -1703,7 +1741,7 @@ function stripInertDataSegments(text) {
             return interpreterCodeSpawnsProcess(before, body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
         if (CODE_CONTEXT_BEFORE.test(before))
             return whole; // code position: executes
-        if (dq !== undefined && INTERPOLATES.test(body))
+        if (dq !== undefined && doubleQuotedInterpolates(body, powershell))
             return whole; // $( )/`cmd` executes first
         return INERT_DATA;
     });

package/dist/commands/doctor.js

@@ -165,6 +165,7 @@ async function healthCheck(apiUrl, config) {
     }
     console.log('');
     const identity = getMachineIdentity();
+    console.log(`machine id: ${identity.machineId.slice(0, 8)} (source: ${identity.idSource || 'unknown'}${identity.idConfirmed ? ', backend-confirmed' : ', not yet confirmed by the backend'})`);
     const report = await runDeepSelfTest({
         creds,
         developerName: identity.developerName,

package/dist/commands/login.js

@@ -20,6 +20,9 @@ async function loginCommand(args, config) {
         throw new Error('A fleet enrollment token is required. Pass --token <token> or set FCD_ENROLL_TOKEN.\n'
             + 'An org admin issues one from the AI Fleet console (Settings → Fleet enrollment token).');
     }
+    // Enrollment binds the fleet record to this id for good: an unconfirmed
+    // fallback pin gets one native re-check first, throttle or not.
+    (0, machineIdentity_1.reconcileMachineIdentity)('force');
     const identity = (0, machineIdentity_1.getMachineIdentity)();
     const shieldName = (0, machineIdentity_1.suggestedShieldName)(identity);
     const nickname = (args.nickname || process.env.FCD_MACHINE_NICKNAME || '').trim().slice(0, 80) || undefined;
@@ -51,6 +54,7 @@ async function loginCommand(args, config) {
         throw new Error(data.error || `Enrollment failed (HTTP ${resp.status})`);
     }
     const result = data.data;
+    (0, machineIdentity_1.confirmMachineIdentity)(identity.machineId, 'enrollment');
     // Clear any leftover runtime cache (previous enrollment, failed/partial
     // install) so a stale enforcing bundle can never keep blocking on a freshly
     // enrolled machine. The next hook/gateway call fetches the real bundle.

package/dist/identityRecovery.d.ts

@@ -0,0 +1,50 @@
+import type { FlushFailure } from './telemetry';
+/**
+ * Server-assisted identity recovery (#1853).
+ *
+ * When events:batch answers 409 MACHINE_NOT_ENROLLED, the id this machine
+ * sends is not the one its shield is enrolled under (a stale fallback id
+ * after a blocked native read). The daemon asks the backend which machine its
+ * per-machine shield is bound to. The backend answers only for EXACTLY one
+ * live machine record bound to this shield, in the shield's organization,
+ * with this hostname, and only to a caller holding the shield key — it never
+ * lets the caller choose an id. The answer is pinned as `recovered`.
+ */
+export declare const MACHINE_NOT_ENROLLED = "MACHINE_NOT_ENROLLED";
+/** Daemon log wording for a heartbeat that did not land: refused by the backend vs never reached it. */
+export declare function describeHeartbeatMiss(failure: FlushFailure | undefined): string;
+export type RecoveryResult = {
+    ok: true;
+    machineId: string;
+} | {
+    ok: false;
+    status?: number;
+    code?: string;
+    error: string;
+};
+/** POST /api/cli/machines/identity-recovery. Requires the shield key; never throws. */
+export declare function requestIdentityRecovery(input: {
+    apiUrl: string;
+    shieldId: string;
+    shieldKey?: string;
+    hostname: string;
+    offeredIds: string[];
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<RecoveryResult>;
+/**
+ * Daemon hook: after a refused heartbeat, recover the enrolled id when the
+ * refusal is MACHINE_NOT_ENROLLED. At most once per 15 min per process.
+ * Returns true when the machine now uses a different (recovered) id.
+ */
+export declare function recoverIdentityAfterRefusal(input: {
+    failure: FlushFailure | undefined;
+    apiUrl: string;
+    shieldId?: string;
+    shieldKey?: string;
+    log: (line: string) => void;
+    now?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<boolean>;
+/** Test seam: forget the recovery throttle. */
+export declare function resetIdentityRecoveryThrottle(): void;

package/dist/identityRecovery.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_NOT_ENROLLED = void 0;
+exports.describeHeartbeatMiss = describeHeartbeatMiss;
+exports.requestIdentityRecovery = requestIdentityRecovery;
+exports.recoverIdentityAfterRefusal = recoverIdentityAfterRefusal;
+exports.resetIdentityRecoveryThrottle = resetIdentityRecoveryThrottle;
+const machineIdentity_1 = require("./machineIdentity");
+/**
+ * Server-assisted identity recovery (#1853).
+ *
+ * When events:batch answers 409 MACHINE_NOT_ENROLLED, the id this machine
+ * sends is not the one its shield is enrolled under (a stale fallback id
+ * after a blocked native read). The daemon asks the backend which machine its
+ * per-machine shield is bound to. The backend answers only for EXACTLY one
+ * live machine record bound to this shield, in the shield's organization,
+ * with this hostname, and only to a caller holding the shield key — it never
+ * lets the caller choose an id. The answer is pinned as `recovered`.
+ */
+exports.MACHINE_NOT_ENROLLED = 'MACHINE_NOT_ENROLLED';
+const RECOVERY_RETRY_MS = 15 * 60_000;
+let lastAttemptAt = 0;
+/** Daemon log wording for a heartbeat that did not land: refused by the backend vs never reached it. */
+function describeHeartbeatMiss(failure) {
+    if (failure?.kind === 'http' && failure.status) {
+        const what = failure.code === exports.MACHINE_NOT_ENROLLED
+            ? 'machine not enrolled under this id'
+            : failure.code || failure.error || 'request refused';
+        return `backend refused the heartbeat (HTTP ${failure.status}: ${what}) — daemon liveness was not recorded`;
+    }
+    if (failure?.kind === 'locked')
+        return 'heartbeat skipped: another flusher held the spool lock — daemon liveness was not recorded';
+    const detail = failure?.error ? ` (${failure.error})` : '';
+    return `heartbeat did not reach the backend${detail} — daemon liveness was not recorded`;
+}
+/** POST /api/cli/machines/identity-recovery. Requires the shield key; never throws. */
+async function requestIdentityRecovery(input) {
+    if (!input.shieldKey)
+        return { ok: false, error: 'no shield key on this machine — recovery needs it' };
+    try {
+        const resp = await (input.fetchImpl || fetch)(`${input.apiUrl}/api/cli/machines/identity-recovery`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-shield-key': input.shieldKey },
+            body: JSON.stringify({ shieldId: input.shieldId, hostname: input.hostname, offeredIds: input.offeredIds }),
+            signal: AbortSignal.timeout(input.timeoutMs ?? 8000),
+        });
+        const body = await resp.json().catch(() => ({}));
+        const machineId = typeof body.data?.machineId === 'string' ? body.data.machineId.toLowerCase() : '';
+        if (resp.ok && body.success && /^[0-9a-f]{16,64}$/.test(machineId))
+            return { ok: true, machineId };
+        return { ok: false, status: resp.status, code: body.code, error: body.error || `HTTP ${resp.status}` };
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/**
+ * Daemon hook: after a refused heartbeat, recover the enrolled id when the
+ * refusal is MACHINE_NOT_ENROLLED. At most once per 15 min per process.
+ * Returns true when the machine now uses a different (recovered) id.
+ */
+async function recoverIdentityAfterRefusal(input) {
+    if (input.failure?.code !== exports.MACHINE_NOT_ENROLLED || !input.shieldId)
+        return false;
+    if ((process.env.FCD_MACHINE_ID || '').trim())
+        return false;
+    const now = input.now ?? Date.now();
+    if (now - lastAttemptAt < RECOVERY_RETRY_MS)
+        return false;
+    lastAttemptAt = now;
+    const identity = (0, machineIdentity_1.getMachineIdentity)();
+    const pin = (0, machineIdentity_1.readPinnedIdentity)();
+    const offeredIds = [...new Set([identity.machineId, pin?.machineId].filter((id) => !!id).map(machineIdentity_1.shortMachineId))];
+    const result = await requestIdentityRecovery({
+        apiUrl: input.apiUrl,
+        shieldId: input.shieldId,
+        shieldKey: input.shieldKey,
+        hostname: identity.hostname,
+        offeredIds,
+        fetchImpl: input.fetchImpl,
+    });
+    if (!result.ok) {
+        input.log(`Identity recovery: the backend did not name an enrolled machine for this shield (${result.code || result.error}) — this machine keeps id ${(0, machineIdentity_1.shortMachineId)(identity.machineId)}; re-enroll with \`fullcourtdefense onboard --token <token>\` if it persists.`);
+        return false;
+    }
+    if (result.machineId === identity.machineId)
+        return false;
+    const outcome = (0, machineIdentity_1.confirmMachineIdentity)(result.machineId, 'recovered');
+    if (outcome === 'conflict') {
+        input.log(`Identity recovery: the backend names ${(0, machineIdentity_1.shortMachineId)(result.machineId)} but this machine holds a confirmed id ${(0, machineIdentity_1.shortMachineId)(identity.machineId)} — kept; reported as machine_id_conflict.`);
+        return false;
+    }
+    input.log(`Identity recovery: this machine was sending id ${(0, machineIdentity_1.shortMachineId)(identity.machineId)}; its shield is enrolled as ${(0, machineIdentity_1.shortMachineId)(result.machineId)} — pinned (${outcome}).`);
+    return (0, machineIdentity_1.getMachineIdentity)().machineId === result.machineId;
+}
+/** Test seam: forget the recovery throttle. */
+function resetIdentityRecoveryThrottle() {
+    lastAttemptAt = 0;
+}