fullcourtdefense-cli 1.39.0 → 1.39.2

package/dist/commands/cmdGuard.js

@@ -157,7 +157,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `function unblockHint(rule){return 'Rule: "'+rule.reason+'" ('+(rule.source==='custom'?'org custom rule':'built-in Local Safety rule')+', id '+rule.id+'). To remove this block an admin can set it to Ask / Warn only / Off here: '+RULES_URL+'&rule='+encodeURIComponent(rule.id);}`,
         `// "s = remember for this cmd window": keyed by the parent cmd.exe pid (doskey runs us directly under it); dies with the window, capped in time.`,
         `const ASK_MEMORY_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense'))}+'/cmd-ask-'+process.ppid+'.json';`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',fallback:r.fallback===true,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
@@ -182,7 +182,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const line=args.join(' ');let mode='monitor';let hit=null;try{const r=loadRules();mode=r.mode;hit=matchLine(line,r.rules);}catch{hit=null;}`,
         `if(!hit)delegate(args);`,
         `// Monitor is quiet: a would-block / would-ask is recorded ('warn') and the command runs with nothing printed. A warn-only rule is a real warning (below).`,
-        `if(mode==='monitor'&&hit.action!=='warn'){spoolEvent(hit,line,'warn');delegate(args);}`,
+        `if(mode==='monitor'&&(hit.action!=='warn'||hit.fallback)){spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='ask'){`,
         `  if(agentTerminal()){`,

package/dist/commands/daemon.js

@@ -1921,9 +1921,8 @@ async function runDaemon(args, config) {
         // reports every failure by returning null and never throws, so without
         // this flag a heartbeat that never left the machine was indistinguishable
         // from a delivered one — and the loop happily waited a full cadence before
-        // trying again. `null` also covers the case where a hook flusher held the
-        // flush lock, which drops the daemon marker specifically (hook flushes do
-        // not set `daemon: true`), so retrying soon is right in that case too.
+        // trying again. A hook flusher holding the spool lock is not a miss: the
+        // flush op then sends this beat without the spool (housekeepingOps).
         let reported = false;
         let refusal;
         try {
@@ -2071,9 +2070,14 @@ async function runDaemon(args, config) {
     // the `unhandledRejection` handler, which is worse than dying: it holds the
     // pid lock, so the scheduled task declines to start a replacement, and it
     // never polls the bundle, so no remote action can reach it. Booting before
-    // the network is up (captive portal, VPN, resumed in a lift) is routine, and
-    // the heartbeat loop below retries within seconds.
+    // the network is up (captive portal, VPN, resumed in a lift) is routine.
+    // A failed first beat is handed to the heartbeat loop below as a failure, so
+    // its first tick is a retry in seconds. It used to wait a full cadence
+    // (5 min): after the 1.39.1 auto-update the console kept showing the old
+    // version, "auto-update pending" and a stale "Online" time for that window.
+    let firstHeartbeatFailed = false;
     await heartbeat().catch(error => {
+        firstHeartbeatFailed = true;
         log(`First heartbeat failed: ${error?.message || String(error)}. The heartbeat loop will retry shortly.`);
     });
     // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
@@ -2217,6 +2221,7 @@ async function runDaemon(args, config) {
         run: heartbeat,
         intervalMs: () => HEARTBEAT_INTERVAL_MS,
         deadlineMs: HEARTBEAT_DEADLINE_MS,
+        initialFailures: firstHeartbeatFailed ? 1 : 0,
         onStalled: deadlineMs => {
             log(`Heartbeat did not finish within ${Math.round(deadlineMs / 1000)}s — abandoned; spooled events stay on disk for the next tick.`);
             (0, distress_1.reportDistress)('heartbeat', distress_1.DISTRESS.POLL_STALLED, `heartbeat exceeded ${deadlineMs}ms`);

package/dist/commands/demoActions.js

@@ -274,6 +274,9 @@ function runScenario(scenario, opts) {
             // The resident daemon (if any) must not answer for the sandbox: it would
             // evaluate with the REAL home and spool real events.
             FCD_VERDICT_IPC: 'off',
+            // Monitor is quiet to the agent (monitorHint); this replay reports what
+            // a monitor machine WOULD block, so it asks the hook for that text.
+            FCD_MONITOR_HINTS: '1',
             FULLCOURTDEFENSE_DEVELOPER_ID: opts.developerId,
         },
     });
@@ -367,6 +370,38 @@ function renderReport(report) {
     lines.push('');
     return lines.join('\n');
 }
+/**
+ * The last replayed hook starts a detached flush-spool child in the sandbox
+ * home (its cwd, and it holds the spool open). Windows refuses to remove a
+ * folder in use, so wait for that child (bounded), then remove with retries.
+ */
+async function removeSandboxHome(home) {
+    const marker = path.join(home, '.fullcourtdefense-flush.ts');
+    const deadline = Date.now() + 5_000;
+    while (Date.now() < deadline) {
+        let running = false;
+        try {
+            const [, pid, state] = fs.readFileSync(marker, 'utf8').trim().split(':');
+            if (state !== 'done' && state !== 'fail' && Number(pid) > 0) {
+                try {
+                    process.kill(Number(pid), 0);
+                    running = true;
+                }
+                catch (error) {
+                    running = error.code === 'EPERM';
+                }
+            }
+        }
+        catch { /* no marker: no flusher was started */ }
+        if (!running)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    try {
+        fs.rmSync(home, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+    }
+    catch { /* best effort */ }
+}
 async function demoActionsCommand(args, config) {
     const live = args.live === 'true';
     const json = args.json === 'true';
@@ -419,12 +454,8 @@ async function demoActionsCommand(args, config) {
         }
     }
     finally {
-        if (cleanup) {
-            try {
-                fs.rmSync(cleanup, { recursive: true, force: true });
-            }
-            catch { /* best effort */ }
-        }
+        if (cleanup)
+            await removeSandboxHome(cleanup);
     }
     const report = {
         mode: live ? 'live' : 'offline',

package/dist/commands/deterministicGuard.js

@@ -286,6 +286,14 @@ function deobfuscateShellTokens(text) {
     out = out.replace(/\\(?=[A-Za-z0-9])/g, '');
     return out.replace(/\s+/g, ' ').trim();
 }
+/** Only `${IFS}` / `$IFS` and `{brace,words}` undone: quotes and backslashes keep their meaning. */
+function unscrambleShellWords(text) {
+    let out = text.replace(/\$\{IFS[^}]*\}/g, ' ').replace(/\$IFS\b/g, ' ');
+    for (let i = 0; i < 3 && /\{[^{}]*,[^{}]*\}/.test(out); i++) {
+        out = out.replace(/\{([^{}]*,[^{}]*)\}/g, (_m, body) => body.split(',').join(' '));
+    }
+    return out;
+}
 /** bash/zsh ANSI-C quoting: `$'\x72\x6d'` IS `rm`. Decode `\xHH`, `\uHHHH`,
  * octal, and single-char escapes, splicing plain text back into the command. */
 function decodeAnsiCQuoting(text) {
@@ -2025,7 +2033,39 @@ function destructiveCommandReason(value, opts = {}, options, rawValue) {
             return { itemId: 'git_clean_force', reason: 'destructive git clean/reset' };
         return undefined;
     };
-    const windowsDelete = () => (on('windows_drive_delete') ? windowsRecursiveDeleteHit(rawValue === undefined ? value : rawValue) : undefined);
+    const windowsDelete = () => {
+        if (!on('windows_drive_delete'))
+            return undefined;
+        const raw = rawValue === undefined ? value : rawValue;
+        const direct = windowsRecursiveDeleteHit(raw);
+        if (direct)
+            return direct;
+        // Word disguises (${IFS}, {brace,words}, ANSI-C $'\x..'), also inside encoded
+        // payloads, undone WITHOUT dequoting: quoted text stays data and backslashes
+        // stay path separators, so the same target classifier still tells a drive
+        // from a deep project path (1.38 parity: 306/306 disguised drive wipes).
+        const seeds = [raw];
+        let frontier = [raw];
+        for (let depth = 0; depth < 2 && frontier.length > 0; depth++) {
+            const next = [];
+            for (const source of frontier)
+                for (const decoded of decodeEncodedPayloads(source)) {
+                    seeds.push(decoded);
+                    next.push(decoded);
+                }
+            frontier = next;
+        }
+        for (const seed of seeds) {
+            for (const variant of [unscrambleShellWords(seed), decodeAnsiCQuoting(seed), unscrambleShellWords(decodeAnsiCQuoting(seed))]) {
+                if (variant === seed)
+                    continue;
+                const hit = windowsRecursiveDeleteHit(variant);
+                if (hit)
+                    return hit;
+            }
+        }
+        return undefined;
+    };
     if (!opts.literalOnly)
         return matchCommand(value, check) || windowsDelete();
     const literal = normalizeForCommand(value);
@@ -2125,7 +2165,7 @@ function windowsRecursiveDeleteHit(raw) {
     // Cheap gate on the verbs, past carets and quote splitting (`r^d`, `de"l"`); an
     // encoded payload (`powershell -e <b64>`, FromBase64String, `base64 -d`) is
     // decoded below however it is spelled, as commandVariants decodes it.
-    if (!/\b(?:del|erase|rd|rmdir)\b/i.test(raw.replace(/[\^"'`]/g, '')) && !decodeEncodedPayloads(raw).length)
+    if (!/\b(?:del|erase|rd|rmdir)\b/i.test(raw.replace(/[\^"'`]|\\(?=[A-Za-z])/g, '')) && !decodeEncodedPayloads(raw).length)
         return undefined;
     let text = raw;
     const heredocs = heredocView(raw);
@@ -2136,7 +2176,8 @@ function windowsRecursiveDeleteHit(raw) {
     // Quoted text that can reach an interpreter (`… | cmd`, `powershell -c "…"`) is code.
     const feeds = DATA_TO_INTERPRETER.test(unquotedCode(text));
     const assigned = new Map();
-    const dequote = (token) => stripCmdCarets(token.replace(/["']/g, ''));
+    // PowerShell runs an unquoted word with its backtick escapes removed (`d`e`l` is `del`).
+    const dequote = (token) => stripCmdCarets(token.replace(/["']/g, '').replace(/`(.)/g, '$1'));
     const resolve = (operand) => {
         let via;
         let value = dequote(operand);
@@ -2181,7 +2222,10 @@ function windowsRecursiveDeleteHit(raw) {
                     }
                     continue;
                 }
-                if (!WINDOWS_DELETE_VERBS.has(programName(dequote(token))))
+                // A POSIX shell reads `\d\e\l` as `del` (Git Bash, WSL); only the verb is
+                // unescaped this way — a target keeps its backslashes (`C:\dev` is a path).
+                const verb = dequote(token);
+                if (!WINDOWS_DELETE_VERBS.has(programName(verb)) && !WINDOWS_DELETE_VERBS.has(verb.replace(/\\([A-Za-z])/g, '$1').toLowerCase()))
                     continue;
                 let recurse = false, quiet = false;
                 const targets = [];

package/dist/commands/hook.d.ts

@@ -237,6 +237,8 @@ export interface HookIo {
     viaDaemon?: boolean;
     /** Set when this evaluation's verdict is a stop still being settled (approval wait). */
     pendingStop?: string;
+    /** The daemon already gave the hook this event's allow (postExecutionAnswer); this evaluation only records and settles. */
+    answeredFirst?: boolean;
 }
 /**
  * The daemon declines a request whose verdict is a human wait (org approval,
@@ -281,7 +283,23 @@ export declare function evaluateHookRequest(args: HookArgs, stdinRaw: string, co
     stdout: string;
     stderr: string;
     exitCode: number;
+    afterReply?: () => Promise<void>;
 }>;
+/**
+ * The verdict a post-execution event gets from hookCommandInner — byte for
+ * byte what respond(false) writes for it — or undefined for every other
+ * request. Every path such an event takes ends in that plain allow: the
+ * kill-switch branch (the action already ran; a post hook is not a
+ * pre-execution surface), the ignored branch (a passive tool's post event:
+ * it does not precede an action) and the post branch, none with a message.
+ * Covered: Claude-format PostToolUse (any tool), a Cursor generic postToolUse
+ * (any tool), and a Cursor hook whose --event the full hook reads as `post`
+ * (after* / post-*). Read from the names alone, the way normalizeClaudePayload
+ * and canonicalizeCursorPayload route them — never by mapping the tool, which
+ * for a file write reads the file. Parsed exactly as hookCommandInner parses;
+ * a payload it cannot read is not one.
+ */
+export declare function postExecutionAnswer(args: HookArgs, stdinRaw: string): string | undefined;
 /**
  * TOP-LEVEL FAIL-OPEN WRAPPER. An unexpected exception anywhere in the hook
  * must never surface as a stack trace, a nonzero exit, or a blocked command —

package/dist/commands/hook.js

@@ -50,6 +50,7 @@ exports.readBackendError = readBackendError;
 exports.humanWaitDeadline = humanWaitDeadline;
 exports.crashVerdictForProcess = crashVerdictForProcess;
 exports.evaluateHookRequest = evaluateHookRequest;
+exports.postExecutionAnswer = postExecutionAnswer;
 exports.hookCommand = hookCommand;
 exports.installHookCrashHandlers = installHookCrashHandlers;
 const os = __importStar(require("os"));
@@ -1093,18 +1094,34 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
  * analysis) and the confirmation memory is stored. Otherwise the IDE may have approved its
  * own card: the run is recorded as unverified — nobody named as approver — and nothing is
  * remembered, so the next identical action asks again.
+ *
+ * A post hook whose own action has no confirmation pending (nearly every one) settles
+ * nothing, and learns that from one unlocked read off the event loop
+ * (pendingConfirmationKeys): no lock file, no synchronous read — and, with nothing
+ * pending at all, no look at the call (a file write's diff reads the file). In the daemon
+ * (`offThread`) the settle itself runs on a worker thread: its lock wait, read, write and
+ * fsync never hold the verdict loop.
  */
-function settlePostExecution(explicitEvent, payload, opts = {}) {
+async function settlePostExecution(explicitEvent, payload, opts = {}) {
     try {
         const inner = inferPostInnerEvent(explicitEvent, payload);
         if (inner === 'unknown' || inner === 'prompt' || inner === 'post')
             return;
+        const pending = await devConfirm().pendingConfirmationKeys();
+        if (pending && pending.size === 0)
+            return;
         const call = buildToolCall(inner, payload);
         if (!call)
             return;
+        const argsDigest = devConfirm().actionDigest(call.toolArgs);
+        if (pending && !pending.has(devConfirm().pendingKey(inner, call.toolName, argsDigest)))
+            return;
         // A suspended machine never mints session memory: the answer is recorded, nothing is remembered.
         // The answer is inferred from the IDE's own card (our dialog settles in its own process).
-        const settled = devConfirm().settleDeveloperConfirmation(inner, call.toolName, devConfirm().actionDigest(call.toolArgs), new Date(), { noMemory: opts.suspended === true, via: 'ide' });
+        const settleOpts = { noMemory: opts.suspended === true, via: 'ide' };
+        const settled = opts.offThread
+            ? await devConfirm().settleDeveloperConfirmationOffThread(inner, call.toolName, argsDigest, new Date(), settleOpts)
+            : devConfirm().settleDeveloperConfirmation(inner, call.toolName, argsDigest, new Date(), settleOpts);
         if (!settled)
             return;
         (0, hookIo_1.dbg)({ phase: 'dev_confirm_settled', event: inner, tool: call.toolName, confirmLatencyMs: settled.confirmLatencyMs, remember: settled.marker.remember, humanProven: settled.humanProven, ...(opts.suspended ? { suspended: true } : {}) });
@@ -1533,6 +1550,20 @@ function processIo(stdin, stdinErr) {
  * `deferGateReports`: native hooks — see HookIo.deferGateReports.
  */
 async function evaluateHookRequest(args, stdinRaw, config, opts = {}) {
+    // POST-EXECUTION HOOKS ARE ANSWERED FIRST (daemon, a hook waiting on the
+    // pipe). The action already ran and the answer is the same plain allow
+    // whatever the evaluation finds, so the hook gets it now; the evaluation
+    // itself — mode, settling a developer's IDE answer, its records — runs
+    // after the reply (the verdict server's afterReply queue). One slow post
+    // evaluation (a laptop under memory pressure: 8-26s, past Claude Code's
+    // PostToolUse cutoff) used to keep its hook waiting until it fell back to a
+    // cold local copy of the same evaluation.
+    if (opts.viaDaemon && !opts.exitsProcess && verdictIpc().servingWaitingClient()) {
+        const answer = postExecutionAnswer(args, stdinRaw);
+        if (answer !== undefined) {
+            return { stdout: answer, stderr: '', exitCode: 0, afterReply: () => evaluatePostAfterReply(args, stdinRaw, config, answer) };
+        }
+    }
     // Structural shell facts (shadow by default). A missing/slow parser means
     // "no facts" and the regex floor decides alone — never a wait, never fail-open.
     // A one-shot process (`exitsProcess`) starts the parser only where it may
@@ -1543,6 +1574,63 @@ async function evaluateHookRequest(args, stdinRaw, config, opts = {}) {
         isTTY: false, exitsProcess: opts.exitsProcess === true, deferGateReports: opts.exitsProcess === true && opts.deferGateReports === true, viaDaemon: opts.viaDaemon,
     });
 }
+/**
+ * The verdict a post-execution event gets from hookCommandInner — byte for
+ * byte what respond(false) writes for it — or undefined for every other
+ * request. Every path such an event takes ends in that plain allow: the
+ * kill-switch branch (the action already ran; a post hook is not a
+ * pre-execution surface), the ignored branch (a passive tool's post event:
+ * it does not precede an action) and the post branch, none with a message.
+ * Covered: Claude-format PostToolUse (any tool), a Cursor generic postToolUse
+ * (any tool), and a Cursor hook whose --event the full hook reads as `post`
+ * (after* / post-*). Read from the names alone, the way normalizeClaudePayload
+ * and canonicalizeCursorPayload route them — never by mapping the tool, which
+ * for a file write reads the file. Parsed exactly as hookCommandInner parses;
+ * a payload it cannot read is not one.
+ */
+function postExecutionAnswer(args, stdinRaw) {
+    const cleaned = stdinRaw.replace(/^\uFEFF/, '').replace(/^[\s\uFEFF\xA0]+/, '').trim();
+    if (!cleaned)
+        return undefined;
+    let payload;
+    try {
+        payload = JSON.parse(cleaned);
+    }
+    catch {
+        return undefined;
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload))
+        return undefined;
+    const record = payload;
+    const hookEventName = str(record.hook_event_name);
+    // Claude format (PascalCase): PostToolUse is `post` or an ignored passive tool.
+    if (hookEventName && !/^[a-z]/.test(hookEventName))
+        return hookEventName === 'PostToolUse' ? JSON.stringify({}) : undefined;
+    // Cursor generic tool events: postToolUse is `post` or ignored (canonicalizeCursorGenericToolEvent).
+    if (hookEventName === 'postToolUse')
+        return JSON.stringify({ permission: 'allow' });
+    if (hookEventName === 'preToolUse')
+        return undefined;
+    return inferEvent(args.event, record) === 'post' ? JSON.stringify({ permission: 'allow' }) : undefined;
+}
+/**
+ * The full evaluation of a post-execution event the daemon already answered
+ * (postExecutionAnswer): the same code, its verdict discarded. Run by the
+ * verdict server after the reply, never inside the hook's wait.
+ */
+async function evaluatePostAfterReply(args, stdinRaw, config, answered) {
+    try {
+        await (0, shellAstLoader_1.ensureShellAst)();
+        const result = await evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false, viaDaemon: true, answeredFirst: true });
+        // The answer given first must be the one this evaluation reached.
+        if (result.stdout !== answered || result.exitCode !== 0) {
+            (0, hookIo_1.dbg)({ phase: 'post_answer_mismatch', event: args.event, answered, verdict: result.stdout.slice(0, 200), exitCode: result.exitCode });
+        }
+    }
+    catch (err) {
+        (0, hookIo_1.dbg)({ phase: 'post_after_reply_error', event: args.event, error: err instanceof Error ? err.message : String(err) });
+    }
+}
 /**
  * Run the hook against a buffered io and return the verdict instead of writing
  * it. `exitsProcess: true` keeps the standalone hook's delivery contract (spool +
@@ -1562,6 +1650,7 @@ async function evaluateBuffered(args, stdinRaw, stdinErr, config, mode) {
         exitsProcess: mode.exitsProcess,
         deferGateReports: mode.deferGateReports,
         viaDaemon: mode.viaDaemon,
+        ...(mode.answeredFirst ? { answeredFirst: true } : {}),
     };
     try {
         await hookCommandInner(args, config, io);
@@ -2082,7 +2171,8 @@ async function hookCommandInner(args, config, io) {
             const ideMode = idePermissionMode(payload);
             decision = askDialog().attachAskEnvelope(decision, { ...askEnvelope, agentClient: client, ...(identity ? { identity } : {}), ...(ideMode ? { ideMode } : {}) });
         }
-        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision: ask && askEnvelope ? { ...decision, [askDialog().ASK_ENVELOPE_FIELD]: '(envelope)' } : decision });
+        (0, hookIo_1.dbg)({ phase: 'verdict', event, format: hookFormat, blocked, decision: ask && askEnvelope ? { ...decision, [askDialog().ASK_ENVELOPE_FIELD]: '(envelope)' } : decision,
+            ...(io.answeredFirst ? { answeredFirst: true } : {}) });
         if (hookFormat === 'claude' && event === 'prompt' && denied) {
             // Claude Desktop/Code variants do not all honor the structured
             // UserPromptSubmit decision consistently. Exit 2 is the documented hard
@@ -2112,7 +2202,7 @@ async function hookCommandInner(args, config, io) {
             // would keep the agent running. A post-execution hook still closes the ask it
             // answers, but a suspended machine never mints session memory from it.
             if (event === 'post')
-                settlePostExecution(args.event, payload, { suspended: true });
+                await settlePostExecution(args.event, payload, { suspended: true, offThread: io.viaDaemon === true });
             respond(false);
         }
         // Cursor's GENERIC pre-event of an action its dedicated hook also reports
@@ -2152,9 +2242,10 @@ async function hookCommandInner(args, config, io) {
     // Post-execution hooks: the action already ran. The only job is correlation —
     // a matching pending developer confirmation means the IDE prompt we raised let
     // it through (a person's Allow only where the client said its prompt reaches
-    // one). Never enforces, never needs the network.
+    // one). Never enforces, never needs the network. In the daemon the hook got
+    // this allow before the evaluation began (postExecutionAnswer).
     if (event === 'post') {
-        settlePostExecution(args.event, payload);
+        await settlePostExecution(args.event, payload, { offThread: io.viaDaemon === true });
         respond(false);
     }
     // No Shield configured → allow (fail-open by design: a misconfigured machine

package/dist/commands/posixShellGuard.js

@@ -167,7 +167,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const RULES_URL=${JSON.stringify((0, notify_1.shellRulesConsoleUrl)())};`,
         `// Which rule (by id + origin) and where an admin changes it — printed on every block so the developer is never left guessing.`,
         `function unblockHint(rule){return 'Rule: "'+rule.reason+'" ('+(rule.source==='custom'?'org custom rule':'built-in Local Safety rule')+', id '+rule.id+'). To remove this block an admin can set it to Ask / Warn only / Off here: '+RULES_URL+'&rule='+encodeURIComponent(rule.id);}`,
-        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':r.action==='ask'?'ask':'block',fallback:r.fallback===true,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
@@ -187,7 +187,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
         `if(!hit)process.exit(0);`,
         `// Monitor is quiet: a would-block / would-ask is recorded ('warn') and the line runs with nothing printed. A warn-only rule is a real warning (below).`,
-        `if(mode==='monitor'&&hit.action!=='warn'){spoolEvent(hit,line,'warn');process.exit(0);}`,
+        `if(mode==='monitor'&&(hit.action!=='warn'||hit.fallback)){spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');process.exit(0);}`,
         `if(hit.action==='ask'){`,
         `  if(agentTerminal()){`,

package/dist/commands/shellGuard.d.ts

@@ -33,6 +33,12 @@ export interface ShellGuardRule {
      * allow. 'mask' is meaningless for a typed command and degrades to block.
      */
     action?: ShellGuardAction;
+    /**
+     * 'warn' only because no Local Safety snapshot is cached yet (the org's
+     * choice is unknown). A monitor machine records it silently like any
+     * would-block; an enforcing machine still shows the warning.
+     */
+    fallback?: boolean;
 }
 export type ShellGuardAction = 'block' | 'warn' | 'ask';
 /**

package/dist/commands/shellGuard.js

@@ -617,7 +617,9 @@ function effectiveBuiltinRules() {
         .filter(rule => !disabled.has(rule.id))
         .map(rule => {
         const action = itemActions.get(rule.id);
-        return action ? { ...rule, action } : hasSnapshot ? rule : { ...rule, action: 'warn' };
+        // No snapshot yet: the org's choice is unknown, so the rule only warns —
+        // and `fallback` keeps a monitor machine silent about it (silent monitor).
+        return action ? { ...rule, action } : hasSnapshot ? rule : { ...rule, action: 'warn', fallback: true };
     });
 }
 /** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
@@ -779,6 +781,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `          Reason   = [string]$_.reason`,
         `          Source   = [string]$_.source`,
         `          Action   = $(switch ([string]$_.action) { 'warn' { 'warn' } 'ask' { 'ask' } default { 'block' } })`,
+        `          Fallback = ($_.fallback -eq $true)`,
         `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
         `        }`,
         `      } catch { $null }`,
@@ -949,7 +952,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      # BELOW the message so the warning stays in the scrollback permanently.`,
         `      # Monitor is quiet: a would-block / would-ask is recorded ('warn') and the`,
         `      # line runs with nothing printed. A warn-only rule is a real warning (below).`,
-        `      if ($global:FcdGuardMode -eq 'monitor' -and $hit.Action -ne 'warn') {`,
+        `      if ($global:FcdGuardMode -eq 'monitor' -and ($hit.Action -ne 'warn' -or $hit.Fallback)) {`,
         `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'warn'`,
         `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
         `        return`,

package/dist/devConfirm.d.ts

@@ -1,6 +1,7 @@
 import { type AlwaysCovers, type AskSubject, type NativeDialogView } from './approvalPrompt';
 import { type CredentialGrantBinding, type CredentialRuleFacts } from './credentialGrant';
 export { isCiEnvironment, isHumanPresent } from './callerEnv';
+export { CONFIRM_PENDING_TTL_MS, pendingConfirmationKeys, pendingKey, settleDeveloperConfirmation, settleDeveloperConfirmationOffThread, type SettleOptions, type SettledConfirmation, } from './devConfirmLedger';
 export type ConfirmRemember = 'none' | 'session' | '1h';
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
@@ -243,8 +244,6 @@ export interface RuleGrantLimits {
     maxDays?: number | null;
     maxUses?: number | null;
 }
-/** A raised confirmation that received no post-execution signal in time counts as not approved. */
-export declare const CONFIRM_PENDING_TTL_MS: number;
 /** The hook's dialog answer only carries over to the gateway call it was given for. */
 export declare const CONFIRMED_ACTION_TTL_MS: number;
 /** "Always" is long, not forever: a standing grant lapses after 30 days unless renewed by use of the dialog. */
@@ -308,7 +307,6 @@ export declare function localSafetyRuleHash(finding: {
     action?: string;
     explanation?: string;
 }>): string;
-export declare function pendingKey(event: string, toolName: string, argsDigest: string): string;
 /**
  * The tool name as the MCP server sees it. The IDE hook names an MCP call
  * `mcp__<server>__<tool>` (Codex/Claude) or `<server>/<tool>`; the gateway sees `<tool>`.
@@ -333,29 +331,6 @@ export interface RememberScope {
 }
 /** Record that the IDE was asked to confirm this action. Returns the marker (for logging). */
 export declare function raiseDeveloperConfirmation(input: Omit<PendingConfirmation, 'key' | 'raisedAt'>, now?: Date): PendingConfirmation;
-/**
- * The developer's answer to this action arrived: Allow in the FullCourtDefense dialog
- * (askDialog, MCP gateway — the default `via: 'dialog'`), or the post-execution hook
- * after the IDE's own card (`via: 'ide'`). Removes the marker, records memory if the
- * rule asked for it, and returns the settled marker plus how long the answer took (the
- * rubber-stamp signal). Undefined when nothing was pending — the action was simply
- * allowed and this post-hook is noise.
- *
- * `humanProven` (v139 F-13): an IDE card's answer is a person's only when the asking
- * client said its card reaches one (`idePrompt: 'human'`). Otherwise the IDE may have
- * approved its own card (auto-run / bypass modes, or a client that does not say): the
- * marker is closed, nothing is remembered, and the caller records an unverified run.
- */
-export declare function settleDeveloperConfirmation(event: string, toolName: string, argsDigest: string, now?: Date, opts?: {
-    /** Never store the rule's session / 1h memory for this answer (e.g. the machine is suspended). */
-    noMemory?: boolean;
-    /** Where the answer came from: our dialog (default) or the IDE's own card (inferred from the post hook). */
-    via?: 'dialog' | 'ide';
-}): {
-    marker: PendingConfirmation;
-    confirmLatencyMs: number;
-    humanProven: boolean;
-} | undefined;
 /**
  * Whether the IDE's own ask card reaches a person, from the permission mode the client
  * reports with its hook call (Claude Code `permission_mode`; written by the client, never