fullcourtdefense-cli 1.37.0 → 1.38.0

package/dist/askDialog.d.ts

@@ -56,6 +56,17 @@ export interface AskEnvelope {
     reason: string;
     /** The client the runtime event records as `agentClient` (cursor, claude-code, …): the dialog names the same agent as the console. */
     agentClient?: string;
+    /**
+     * The asking call's correlation identity (session / run / tool call id): the
+     * dialog's outcome is recorded by this process, outside that call's
+     * evaluation, and must name the same action. Older hook builds omit it.
+     */
+    identity?: {
+        sessionId?: string;
+        runId?: string;
+        instanceId?: string;
+        attemptId?: string;
+    };
 }
 export type AskResolution = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'ide';
 export interface HookVerdict {

package/dist/askDialog.js

@@ -30,6 +30,7 @@ exports.resolveAskWithDialog = resolveAskWithDialog;
  */
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
+const actionIdentity_1 = require("./actionIdentity");
 const hookIo_1 = require("./hookIo");
 const callerEnv_1 = require("./callerEnv");
 /** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
@@ -188,6 +189,14 @@ async function resolveAskWithDialog(verdict, options = {}) {
     if (outcome === 'unavailable')
         return { ...clean, resolution: 'ide' };
     const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
+    // The outcome is the asking call's: its client and identity, not this process's.
+    // No latency / verdict path: the ask itself recorded the hook's wait (one health
+    // sample per call), and the person's answer time is confirmLatencyMs.
+    const outcomeFacts = (askOutcome) => ({
+        askOutcome,
+        ...(envelope.agentClient || options.clientLabel ? { agentClient: envelope.agentClient || options.clientLabel } : {}),
+        ...envelopeIdentity(envelope),
+    });
     if (outcome === 'allow' || outcome === 'allow_always') {
         // Same bookkeeping the post-execution hook would have done for an IDE Allow.
         (0, devConfirm_1.settleDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
@@ -210,6 +219,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
             approvalScope: 'developer',
             approvedBy: 'developer',
             confirmLatencyMs: latencyMs,
+            ...outcomeFacts(granted ? 'allowed_always' : 'allowed'),
         });
         (0, telemetry_1.triggerFlush)(false);
         const agentMsg = granted
@@ -230,6 +240,9 @@ async function resolveAskWithDialog(verdict, options = {}) {
         policyHash: envelope.policyHash,
         approvalScope: 'developer',
         confirmLatencyMs: latencyMs,
+        // No answer is not a rule's block: the action did not run (the IDE gets the
+        // same deny), but nobody decided against it — recorded as an unanswered ask.
+        ...outcomeFacts(timedOut ? 'unanswered' : 'denied'),
     });
     (0, telemetry_1.triggerFlush)(true);
     const userMsg = timedOut
@@ -240,3 +253,16 @@ async function resolveAskWithDialog(verdict, options = {}) {
         : `FullCourtDefense: the developer denied this ${envelope.event} in the confirmation dialog. Do not retry or work around it.`;
     return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, false, userMsg, agentMsg)), exitCode: 0, resolution: outcome };
 }
+/** The asking call's identity from the envelope: well-formed parts only. */
+function envelopeIdentity(envelope) {
+    const raw = envelope.identity;
+    if (!raw || typeof raw !== 'object')
+        return {};
+    const out = {};
+    for (const key of ['sessionId', 'runId', 'instanceId', 'attemptId']) {
+        const value = (0, actionIdentity_1.identityPart)(raw[key]);
+        if (value)
+            out[key] = value;
+    }
+    return out;
+}

package/dist/awakeClock.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Was the MACHINE asleep, or only the daemon's event loop?
+ *
+ * The daemon detects a resume from sleep by a beat that observes far more
+ * wall time than its interval. A long synchronous stretch on its own loop
+ * looks the same: 2026-10-02 06:58, a 201 s protect-all pass ended and two
+ * seconds later the daemon logged "Resume detected: 237s ... suspended",
+ * re-reported in and recorded network_down [x30] from timeouts that ran out
+ * inside the stall — while hook.log showed hooks every few seconds throughout.
+ *
+ * This clock ticks on a worker thread, which keeps running while the main
+ * loop is blocked and stops only when the whole process (the machine) does.
+ * A long main-loop gap with no long gap here was a stall, not a suspend.
+ * One thread, a 1 s timer, no process and no I/O.
+ */
+export declare const AWAKE_TICK_MS = 1000;
+/** A worker gap this short through a long main-loop gap: the machine stayed awake. */
+export declare const AWAKE_GAP_MAX_MS = 10000;
+export interface AwakeClock {
+    /** Longest gap between ticks since the previous call (including the time since the last tick). Undefined once the clock is gone. */
+    takeMaxGapMs(): number | undefined;
+    stop(): void;
+}
+export declare function startAwakeClock(tickMs?: number): AwakeClock | undefined;
+/**
+ * Pure: what a gap of `driftMs` between two beats of the daemon's loop was.
+ * Without the awake clock (it could not start) every long gap stays a suspend,
+ * as before.
+ */
+export declare function classifyClockJump(input: {
+    driftMs: number;
+    jumpMs: number;
+    awakeGapMs?: number;
+}): 'none' | 'stall' | 'suspend';

package/dist/awakeClock.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWAKE_GAP_MAX_MS = exports.AWAKE_TICK_MS = void 0;
+exports.startAwakeClock = startAwakeClock;
+exports.classifyClockJump = classifyClockJump;
+const worker_threads_1 = require("worker_threads");
+/**
+ * Was the MACHINE asleep, or only the daemon's event loop?
+ *
+ * The daemon detects a resume from sleep by a beat that observes far more
+ * wall time than its interval. A long synchronous stretch on its own loop
+ * looks the same: 2026-10-02 06:58, a 201 s protect-all pass ended and two
+ * seconds later the daemon logged "Resume detected: 237s ... suspended",
+ * re-reported in and recorded network_down [x30] from timeouts that ran out
+ * inside the stall — while hook.log showed hooks every few seconds throughout.
+ *
+ * This clock ticks on a worker thread, which keeps running while the main
+ * loop is blocked and stops only when the whole process (the machine) does.
+ * A long main-loop gap with no long gap here was a stall, not a suspend.
+ * One thread, a 1 s timer, no process and no I/O.
+ */
+exports.AWAKE_TICK_MS = 1_000;
+/** A worker gap this short through a long main-loop gap: the machine stayed awake. */
+exports.AWAKE_GAP_MAX_MS = 10_000;
+function startAwakeClock(tickMs = exports.AWAKE_TICK_MS) {
+    try {
+        // [0] last tick (wall ms), [1] longest gap between ticks since the last read.
+        const shared = new Float64Array(new SharedArrayBuffer(16));
+        shared[0] = Date.now();
+        const source = `
+      const { workerData } = require('worker_threads');
+      const clock = new Float64Array(workerData);
+      let last = Date.now();
+      setInterval(() => {
+        const now = Date.now();
+        if (now - last > clock[1]) clock[1] = now - last;
+        last = now;
+        clock[0] = now;
+      }, ${Math.max(100, Math.floor(tickMs))});
+    `;
+        const worker = new worker_threads_1.Worker(source, {
+            eval: true,
+            workerData: shared.buffer,
+            resourceLimits: { maxOldGenerationSizeMb: 16, maxYoungGenerationSizeMb: 4 },
+            stdout: true,
+            stderr: true,
+        });
+        worker.unref();
+        let alive = true;
+        worker.on('error', () => { alive = false; });
+        worker.on('exit', () => { alive = false; });
+        return {
+            takeMaxGapMs() {
+                if (!alive)
+                    return undefined;
+                const gap = Math.max(shared[1], Date.now() - shared[0]);
+                shared[1] = 0;
+                return gap;
+            },
+            stop() {
+                alive = false;
+                void worker.terminate().catch(() => { });
+            },
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Pure: what a gap of `driftMs` between two beats of the daemon's loop was.
+ * Without the awake clock (it could not start) every long gap stays a suspend,
+ * as before.
+ */
+function classifyClockJump(input) {
+    if (input.driftMs < input.jumpMs)
+        return 'none';
+    if (input.awakeGapMs !== undefined && input.awakeGapMs < exports.AWAKE_GAP_MAX_MS)
+        return 'stall';
+    return 'suspend';
+}

package/dist/backupManifest.d.ts

@@ -1,7 +1,20 @@
+/** Distinct recent versions kept per config, besides its oldest (original) copy. */
+export declare const KEEP_RECENT_BACKUPS = 3;
 export declare function backupManifestPath(): string;
 /** Every recorded backup path (absent/corrupt manifest = empty list). */
 export declare function readBackupManifest(): string[];
-/** Record one backup file path. Deduped, capped, never throws. */
+/** Record one backup file path. Deduped, never throws. */
 export declare function recordConfigBackup(backupPath: string): void;
 /** Drop entries whose backup file no longer exists (post-cleanup compaction). */
 export declare function pruneBackupManifest(): void;
+/** This config's safety copies next to it (`<name>.fcd-backup-<ms>`), oldest first. */
+export declare function listConfigBackups(file: string): string[];
+/**
+ * Back `file` up next to itself before FullCourtDefense rewrites it — once per
+ * distinct content: a version already kept (a rewrite that only flips the
+ * runtime path back and forth, a pass that writes the same content) adds no
+ * copy. Afterwards the config keeps its oldest copy (the original, before
+ * FullCourtDefense first changed it) and its KEEP_RECENT newest. Returns the
+ * new copy, or undefined when none was needed (or it failed). Never throws.
+ */
+export declare function createConfigBackup(file: string, now?: number): string | undefined;

package/dist/backupManifest.js

@@ -33,10 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEEP_RECENT_BACKUPS = void 0;
 exports.backupManifestPath = backupManifestPath;
 exports.readBackupManifest = readBackupManifest;
 exports.recordConfigBackup = recordConfigBackup;
 exports.pruneBackupManifest = pruneBackupManifest;
+exports.listConfigBackups = listConfigBackups;
+exports.createConfigBackup = createConfigBackup;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -51,11 +54,21 @@ const path = __importStar(require("path"));
  * authoritative list at cleanup time (union-ed with the known-dir scan for
  * backups created by older CLI versions).
  *
+ * Bounded (2026-10: 5,517 copies, 9.8 MB, and a manifest silently cut at its
+ * newest 2,000 entries, so uninstall missed most of them): a config keeps the
+ * copy taken before FullCourtDefense first changed it plus its last
+ * KEEP_RECENT distinct versions (createConfigBackup), and the manifest drops
+ * only entries whose file is gone — never a live one.
+ *
  * Best-effort by design: a manifest write failure must never break a protect
  * operation, and cleanup falls back to the directory scan.
  */
 const MANIFEST_NAME = 'backup-manifest.json';
-const MAX_ENTRIES = 2000;
+/** Size guard for the manifest file itself; reached only after every missing-file entry is dropped. */
+const MAX_ENTRIES = 20_000;
+/** Distinct recent versions kept per config, besides its oldest (original) copy. */
+exports.KEEP_RECENT_BACKUPS = 3;
+const BACKUP_INFIX = '.fcd-backup-';
 function backupManifestPath() {
     return path.join(os.homedir(), '.fullcourtdefense', MANIFEST_NAME);
 }
@@ -70,23 +83,105 @@ function readBackupManifest() {
         return [];
     }
 }
-/** Record one backup file path. Deduped, capped, never throws. */
-function recordConfigBackup(backupPath) {
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Read-modify-write the manifest under a short lock, written atomically
+ * (temp + rename): concurrent protect passes (daemon, CLI, hooks) no longer
+ * drop each other's entries. Bounded wait; never throws.
+ */
+function updateManifest(change) {
+    const file = backupManifestPath();
+    const lock = `${file}.lock`;
+    let held = false;
     try {
-        const existing = readBackupManifest();
-        if (existing.includes(backupPath))
-            return;
-        const entries = [...existing, backupPath].slice(-MAX_ENTRIES);
-        const file = backupManifestPath();
         fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, `${JSON.stringify({ backups: entries }, null, 2)}\n`, 'utf8');
+        // Protect passes only (daemon, housekeeping worker, CLI) — never a hook: a short wait is fine.
+        const deadline = Date.now() + 2_000;
+        for (let attempt = 0; attempt < 1_000 && !held; attempt += 1) {
+            try {
+                fs.writeFileSync(lock, String(process.pid), { flag: 'wx' });
+                held = true;
+            }
+            catch (error) {
+                // EPERM/EACCES: Windows reports a lock file being deleted that way — still contention.
+                const code = error.code;
+                if (code !== 'EEXIST' && code !== 'EPERM' && code !== 'EACCES')
+                    break;
+                try {
+                    if (Date.now() - fs.statSync(lock).mtimeMs > 10_000) {
+                        fs.unlinkSync(lock);
+                        continue;
+                    }
+                }
+                catch { /* released meanwhile */ }
+                if (Date.now() >= deadline)
+                    break;
+                sleepSync(5);
+            }
+        }
+        const before = readBackupManifest();
+        const next = change(before);
+        if (!next)
+            return;
+        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        try {
+            if (next.length === 0) {
+                fs.rmSync(file, { force: true });
+                return;
+            }
+            fs.writeFileSync(tmp, `${JSON.stringify({ backups: next }, null, 2)}\n`, 'utf8');
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    fs.renameSync(tmp, file);
+                    break;
+                }
+                catch (error) {
+                    // Windows: a reader (or a scanner) holding the file open fails the rename for a moment.
+                    const code = error.code;
+                    if (attempt >= 20 || (code !== 'EPERM' && code !== 'EACCES' && code !== 'EBUSY'))
+                        throw error;
+                    sleepSync(10);
+                }
+            }
+        }
+        catch {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* not there */ }
+        }
     }
     catch { /* best effort — cleanup still has the directory scan */ }
+    finally {
+        if (held) {
+            try {
+                fs.unlinkSync(lock);
+            }
+            catch { /* gone */ }
+        }
+    }
+}
+/** Drop entries whose file is gone; only then, if still over the guard, the oldest. */
+function bounded(entries) {
+    if (entries.length <= MAX_ENTRIES)
+        return entries;
+    const live = entries.filter(entry => { try {
+        return fs.existsSync(entry);
+    }
+    catch {
+        return true;
+    } });
+    return live.length <= MAX_ENTRIES ? live : live.slice(-MAX_ENTRIES);
+}
+/** Record one backup file path. Deduped, never throws. */
+function recordConfigBackup(backupPath) {
+    updateManifest(existing => (existing.includes(backupPath) ? undefined : bounded([...existing, backupPath])));
 }
 /** Drop entries whose backup file no longer exists (post-cleanup compaction). */
 function pruneBackupManifest() {
-    try {
-        const existing = readBackupManifest();
+    updateManifest((existing) => {
         const remaining = existing.filter(entry => {
             try {
                 return fs.existsSync(entry);
@@ -95,14 +190,80 @@ function pruneBackupManifest() {
                 return true;
             }
         });
-        if (remaining.length === existing.length)
-            return;
-        const file = backupManifestPath();
-        if (remaining.length === 0) {
-            fs.rmSync(file, { force: true });
-            return;
+        return remaining.length === existing.length ? undefined : remaining;
+    });
+}
+/** This config's safety copies next to it (`<name>.fcd-backup-<ms>`), oldest first. */
+function listConfigBackups(file) {
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file)}${BACKUP_INFIX}`;
+    try {
+        return fs.readdirSync(dir)
+            .filter(name => name.startsWith(prefix) && /^\d+$/.test(name.slice(prefix.length)))
+            .sort((a, b) => Number(a.slice(prefix.length)) - Number(b.slice(prefix.length)))
+            .map(name => path.join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+function sameContent(file, content) {
+    try {
+        return fs.statSync(file).size === content.length && fs.readFileSync(file).equals(content);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Back `file` up next to itself before FullCourtDefense rewrites it — once per
+ * distinct content: a version already kept (a rewrite that only flips the
+ * runtime path back and forth, a pass that writes the same content) adds no
+ * copy. Afterwards the config keeps its oldest copy (the original, before
+ * FullCourtDefense first changed it) and its KEEP_RECENT newest. Returns the
+ * new copy, or undefined when none was needed (or it failed). Never throws.
+ */
+function createConfigBackup(file, now = Date.now()) {
+    try {
+        const content = fs.readFileSync(file);
+        const existing = listConfigBackups(file);
+        if (existing.some(copy => sameContent(copy, content)))
+            return undefined;
+        let stamp = now;
+        let backup = '';
+        for (let attempt = 0; attempt < 5; attempt += 1, stamp += 1) {
+            backup = `${file}${BACKUP_INFIX}${stamp}`;
+            try {
+                fs.copyFileSync(file, backup, fs.constants.COPYFILE_EXCL);
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST' || attempt === 4)
+                    throw error;
+            }
         }
-        fs.writeFileSync(file, `${JSON.stringify({ backups: remaining }, null, 2)}\n`, 'utf8');
+        // Backups can embed live credentials and land in project-local dirs no
+        // scan can enumerate — record each one so uninstall can delete them all.
+        recordConfigBackup(backup);
+        const all = [...existing, backup];
+        const keep = new Set([all[0], ...all.slice(-exports.KEEP_RECENT_BACKUPS)]);
+        const pruned = [];
+        for (const copy of all) {
+            if (keep.has(copy))
+                continue;
+            try {
+                fs.rmSync(copy, { force: true });
+                pruned.push(copy);
+            }
+            catch { /* left for uninstall */ }
+        }
+        if (pruned.length > 0) {
+            const gone = new Set(pruned);
+            updateManifest(entries => entries.filter(entry => !gone.has(entry)));
+        }
+        return backup;
+    }
+    catch {
+        return undefined;
     }
-    catch { /* best effort */ }
 }

package/dist/callerEnv.d.ts

@@ -11,7 +11,7 @@
  *
  * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
  */
-export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "FCD_HOOK_DEBUG", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
+export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "FCD_HOOK_DEBUG", "FCD_MONITOR_HINTS", "FCD_PERF_PROBE", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
 export type CallerEnvSnapshot = Partial<Record<(typeof CALLER_ENV_KEYS)[number], string>>;
 /**
  * Keys a decision reads only for WHETHER they are set (cloudGrantTools: static
@@ -60,6 +60,26 @@ export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
 export declare function applyIdeTimeoutArg(seconds: string | undefined, env?: NodeJS.ProcessEnv): void;
 /** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
 export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
+/**
+ * One truthiness rule for FCD_* switches: `1`, `true`, `yes`, `on` (any case,
+ * surrounding spaces ignored). Unset, empty, `0`, `false`, `off` and anything
+ * else are off. New switches use it; the existing decision switches
+ * (FCD_HUMAN_PRESENT, FCD_EPHEMERAL, ...) keep their exact historical spellings,
+ * because widening them would change a verdict for the same input.
+ */
+export declare function envFlag(value: string | undefined): boolean;
+/**
+ * The test-run markers set on THIS process (names; empty for every install).
+ * scripts/lib/no-real-dialog.js sets FCD_TEST_NO_REAL_DIALOG, the sandboxed
+ * daemon harnesses FCD_TEST_SANDBOX_ROOT, scripts/lib/fake-os-dialog.js
+ * FCD_FAKE_DIALOG_PID. No install, MSI, scheduled task or IDE hook config sets
+ * one. Read from process.env, never from a caller snapshot: the guards they
+ * drive (testRunGuard.ts, devConfirm, notify) protect this process's desktop
+ * and profile.
+ */
+export declare function testRunMarkers(env?: NodeJS.ProcessEnv): string[];
+/** A test run that promised no real OS dialog or notification on this desktop (devConfirm, notify). */
+export declare function noRealUiUnderTest(env?: NodeJS.ProcessEnv): boolean;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**

package/dist/callerEnv.js

@@ -8,6 +8,9 @@ exports.withCallerEnv = withCallerEnv;
 exports.ideHookTimeoutMs = ideHookTimeoutMs;
 exports.applyIdeTimeoutArg = applyIdeTimeoutArg;
 exports.ideWaitCutoff = ideWaitCutoff;
+exports.envFlag = envFlag;
+exports.testRunMarkers = testRunMarkers;
+exports.noRealUiUnderTest = noRealUiUnderTest;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 const async_hooks_1 = require("async_hooks");
@@ -38,6 +41,10 @@ exports.CALLER_ENV_KEYS = [
     'FCD_HOOK_IDE_TIMEOUT_MS', 'FCD_TAINT_APPROVE_ONCE_DISABLED', 'FCD_TAINT_APPROVAL_TIMEOUT_MS',
     // Support diagnostics: per-phase hook.log lines for this caller's verdicts (never a decision fact).
     'FCD_HOOK_DEBUG',
+    // Labs / diagnostics: keep the advisory "[FullCourtDefense shadow] would block" text on monitor verdicts (never a decision fact).
+    'FCD_MONITOR_HINTS',
+    // The perf snapshot's probe hook (telemetry.isPerfProbeRequest): recorded as no action (never a decision fact).
+    'FCD_PERF_PROBE',
     // Which GCP project a gcloud line targets when it names none (cloudGrant.activeGcloudProject).
     'CLOUDSDK_CORE_PROJECT', 'CLOUDSDK_ACTIVE_CONFIG_NAME', 'CLOUDSDK_CONFIG', 'APPDATA',
     // Which aws profile / region and which kube context an aws / kubectl / helm line targets
@@ -143,6 +150,39 @@ function applyIdeTimeoutArg(seconds, env = process.env) {
 function ideWaitCutoff(startedAt, ideTimeoutMs = ideHookTimeoutMs()) {
     return startedAt + ideTimeoutMs - Math.min(exports.IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4);
 }
+/**
+ * One truthiness rule for FCD_* switches: `1`, `true`, `yes`, `on` (any case,
+ * surrounding spaces ignored). Unset, empty, `0`, `false`, `off` and anything
+ * else are off. New switches use it; the existing decision switches
+ * (FCD_HUMAN_PRESENT, FCD_EPHEMERAL, ...) keep their exact historical spellings,
+ * because widening them would change a verdict for the same input.
+ */
+function envFlag(value) {
+    return typeof value === 'string' && /^\s*(1|true|yes|on)\s*$/i.test(value);
+}
+/**
+ * The test-run markers set on THIS process (names; empty for every install).
+ * scripts/lib/no-real-dialog.js sets FCD_TEST_NO_REAL_DIALOG, the sandboxed
+ * daemon harnesses FCD_TEST_SANDBOX_ROOT, scripts/lib/fake-os-dialog.js
+ * FCD_FAKE_DIALOG_PID. No install, MSI, scheduled task or IDE hook config sets
+ * one. Read from process.env, never from a caller snapshot: the guards they
+ * drive (testRunGuard.ts, devConfirm, notify) protect this process's desktop
+ * and profile.
+ */
+function testRunMarkers(env = process.env) {
+    const found = [];
+    if (envFlag(env.FCD_TEST_NO_REAL_DIALOG))
+        found.push('FCD_TEST_NO_REAL_DIALOG');
+    if (env.FCD_TEST_SANDBOX_ROOT)
+        found.push('FCD_TEST_SANDBOX_ROOT');
+    if (env.FCD_FAKE_DIALOG_PID)
+        found.push('FCD_FAKE_DIALOG_PID');
+    return found;
+}
+/** A test run that promised no real OS dialog or notification on this desktop (devConfirm, notify). */
+function noRealUiUnderTest(env = process.env) {
+    return envFlag(env.FCD_TEST_NO_REAL_DIALOG) || !!env.FCD_TEST_SANDBOX_ROOT;
+}
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = callerEnv()) {
     return env.GITHUB_ACTIONS === 'true'

package/dist/commands/cmdGuard.d.ts

@@ -8,6 +8,7 @@
  */
 export declare const INTERCEPTED_COMMANDS: string[];
 export declare function buildGuardJs(nodePath: string, cliEntry: string): string;
+export declare function buildAutorunBat(nodePath: string): string;
 export interface CmdGuardStatus {
     supported: boolean;
     installed: boolean;

package/dist/commands/cmdGuard.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INTERCEPTED_COMMANDS = void 0;
 exports.buildGuardJs = buildGuardJs;
+exports.buildAutorunBat = buildAutorunBat;
 exports.isCmdGuardInstalled = isCmdGuardInstalled;
 exports.getCmdGuardStatus = getCmdGuardStatus;
 exports.installCmdGuardCommand = installCmdGuardCommand;
@@ -180,7 +181,8 @@ function buildGuardJs(nodePath, cliEntry) {
         // delegate. A stack trace or nonzero exit here IS an outage for the shell.
         `const line=args.join(' ');let mode='monitor';let hit=null;try{const r=loadRules();mode=r.mode;hit=matchLine(line,r.rules);}catch{hit=null;}`,
         `if(!hit)delegate(args);`,
-        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
+        `// Monitor is quiet: a would-block / would-ask is recorded ('warn') and the command runs with nothing printed. A warn-only rule is a real warning (below).`,
+        `if(mode==='monitor'&&hit.action!=='warn'){spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='ask'){`,
         `  if(agentTerminal()){`,
@@ -224,6 +226,17 @@ function buildAutorunBat(nodePath) {
         'REM Disable for one session: set FCD_CMD_GUARD=off',
         'REM Remove permanently: fullcourtdefense uninstall-cmd-guard',
         'if defined FCD_CMD_AUTORUN_DONE goto :eof',
+        // A one-shot cmd (`cmd /c ...`: build tools, npm scripts, agents) reads no
+        // typed line, and doskey macros only ever expand typed input — registering
+        // them there was pure overhead (+19-209 ms per start). `/k` (interactive
+        // after its command) keeps the guard. Decided before FCD_CMD_AUTORUN_DONE
+        // is set, so an interactive cmd started from a one-shot one still gets the
+        // guard. Delayed expansion: CMDCMDLINE may hold quotes and & | < > that a
+        // %-expanded test would execute or break on.
+        'setlocal EnableDelayedExpansion',
+        'set "_fcd_cmdline=!CMDCMDLINE!"',
+        'if /i not "!_fcd_cmdline:/c =!"=="!_fcd_cmdline!" if /i "!_fcd_cmdline:/k =!"=="!_fcd_cmdline!" (endlocal & goto :eof)',
+        'endlocal',
         'set FCD_CMD_AUTORUN_DONE=1',
         // FAIL OPEN: if the runtime or checker is gone (uninstall/upgrade left this
         // bat behind), register NO macros — wrapped commands (docker, git, kubectl…)

package/dist/commands/daemon.d.ts

@@ -2,6 +2,8 @@ import { BotGuardConfig } from '../config';
 import { ProtectAllArgs } from './mcpGateway';
 import '../askDialog';
 import { windowsTaskRunsInteractive, windowsTaskRunsVisibly } from '../windowsTaskState';
+/** Pure: is a discovery catch-up sweep due (`last` = the last successful upload, if known)? */
+export declare function discoveryCatchUpDue(last: Date | undefined, nowMs?: number, staleMs?: number): boolean;
 export interface DaemonArgs extends ProtectAllArgs {
     install?: string;
     uninstall?: string;
@@ -47,6 +49,24 @@ export declare function discoverSweepCredentialEnv(credentials?: {
     apiUrl?: string;
 }): Record<string, string>;
 export declare function cliVersion(): string | undefined;
+/** Up to five paths for a log line: " (a, b, c, +2 more)". */
+export declare function namedFiles(files: string[], max?: number): string;
+/**
+ * Take the single-instance lock. A NEWER build supersedes a running older
+ * daemon (e.g. the MSI-bundled copy kept running after an npm update): the old
+ * process is stopped and this one takes over, so the fleet never keeps running
+ * stale enforcement code silently. Same-or-newer versions keep the lock.
+ * `recycledPid` (from detectRecycledPidOwner) marks a pid-file owner that is
+ * NOT our daemon — take over without touching that unrelated process.
+ *
+ * Atomic (2026-09-27: two daemons started 1 ms apart both passed the old
+ * read-then-write lock and ran side by side): a missing pid file is created
+ * exclusively, and an existing one is taken over only under the take-over
+ * lock, after re-reading it there — of two contenders, the second sees the
+ * first's live pid and yields.
+ */
+export declare function acquirePidLock(recycledPid?: number): boolean;
+export declare function releasePidLock(): void;
 export type TaskLogonType = 'S4U' | 'InteractiveToken';
 /** Fully-qualified current user (DOMAIN\\user) for the task principal. */
 export declare function taskUserId(): string;