fullcourtdefense-cli 1.8.0 → 1.10.0

package/dist/commands/discover.d.ts

@@ -1,4 +1,5 @@
 import { BotGuardConfig } from '../config';
+import { type ShellAuditReport } from './windowsAudit';
 export type DiscoverSurface = 'mcp' | 'secrets' | 'agent-files' | 'posture';
 export interface DiscoverArgs {
     type?: string;
@@ -57,6 +58,8 @@ export interface DesktopDiscoveryHost {
     user: string;
     scannedAt: string;
     probeMode: 'config' | 'deep';
+    /** Windows-only: PowerShell audit coverage (ScriptBlock Logging + Transcription). */
+    shellAudit?: ShellAuditReport;
 }
 export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
 /** Upload-only discover — used after install-mcp-gateway --upload. */

package/dist/commands/discover.js

@@ -47,6 +47,7 @@ const knownMcpServers_1 = require("./knownMcpServers");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
 const discoverBlastRadius_1 = require("./discoverBlastRadius");
 const discoverSecrets_1 = require("./discoverSecrets");
+const windowsAudit_1 = require("./windowsAudit");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 function parseSurfaces(args) {
     const raw = (args.surface || args.type || 'mcp').toLowerCase().trim();
@@ -101,6 +102,7 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
         user: userEmail || info.username,
         scannedAt: new Date().toISOString(),
         probeMode,
+        shellAudit: (0, windowsAudit_1.getShellAuditReport)(),
     };
 }
 /** Where MCP client configs live — see discoverPaths.ts for the canonical list. */

package/dist/commands/installAll.d.ts

@@ -10,6 +10,8 @@ export interface InstallAllArgs extends ProtectAllArgs {
     scheduleHour?: string;
     autoProtect?: string;
     intervalMinutes?: string;
+    windowsAudit?: string;
+    shellGuard?: string;
 }
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor

package/dist/commands/installAll.js

@@ -9,6 +9,8 @@ const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
 const restartNotice_1 = require("./restartNotice");
+const windowsAudit_1 = require("./windowsAudit");
+const shellGuard_1 = require("./shellGuard");
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor
  * hooks for built-in Cursor actions, optional self-heal and fleet upload.
@@ -65,6 +67,45 @@ async function installAllCommand(args, config) {
             console.log(`Claude-format hooks skipped: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    // Windows-wide command auditing — PowerShell ScriptBlock Logging + Transcription.
+    // Covers commands typed in ANY PowerShell (inside or outside the IDE), not just
+    // agent-driven actions. Requires ONE admin (UAC) approval; failure is a warning,
+    // never an install blocker — missing coverage shows on the fleet dashboard.
+    if (process.platform === 'win32' && args.windowsAudit !== 'false') {
+        console.log('\n\x1b[1mEnabling Windows PowerShell audit logging (ScriptBlock Logging + Transcription)…\x1b[0m');
+        try {
+            const current = (0, windowsAudit_1.getWindowsAuditStatus)();
+            if (current.scriptBlockLogging && current.transcription) {
+                console.log('\x1b[32m✓ Already enabled — every PowerShell command on this machine is logged.\x1b[0m');
+            }
+            else {
+                console.log('\x1b[2mWindows will show an admin approval prompt (UAC). Approve it to enable machine-wide command auditing.\x1b[0m');
+                const result = (0, windowsAudit_1.enableWindowsAudit)();
+                if (result.ok) {
+                    console.log(`\x1b[32m✓ ${result.message}\x1b[0m`);
+                }
+                else {
+                    console.log(`\x1b[33m⚠ Warning: ${result.message}\x1b[0m`);
+                    console.log('\x1b[33m  Installation continues — this machine will show as "audit logging missing" in the fleet dashboard.\x1b[0m');
+                }
+            }
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: PowerShell audit logging step failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
+    // Interactive PowerShell guard — blocks dangerous commands TYPED in a
+    // terminal (inside or outside the IDE) using the same rule families the IDE
+    // hooks enforce, from the local cache (no admin needed, no network hot path).
+    if (process.platform === 'win32' && args.shellGuard !== 'false') {
+        console.log('\n\x1b[1mInstalling interactive PowerShell shell guard…\x1b[0m');
+        try {
+            await (0, shellGuard_1.installShellGuardCommand)();
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: shell guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
     if (args.autoProtect === 'true') {
         console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
         await (0, autoProtect_1.autoProtectCommand)({

package/dist/commands/shellGuard.d.ts

@@ -0,0 +1,46 @@
+export interface ShellGuardRule {
+    id: string;
+    category: string;
+    /** .NET-compatible regex, matched with IgnoreCase against the typed line. */
+    pattern: string;
+    reason: string;
+    source: 'builtin' | 'custom';
+}
+interface ShellGuardRulesFile {
+    updatedAt: string;
+    mode: 'block' | 'monitor';
+    rules: ShellGuardRule[];
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+export declare function writeShellGuardRules(): ShellGuardRulesFile;
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+export declare function refreshShellGuardRules(): void;
+export interface ShellGuardStatus {
+    supported: boolean;
+    installed: boolean;
+    profiles: Array<{
+        engine: string;
+        profilePath: string;
+        installed: boolean;
+    }>;
+    rulesPresent: boolean;
+    ruleCount?: number;
+    mode?: string;
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+export declare function getShellGuardStatus(): ShellGuardStatus;
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+export declare function isShellGuardInstalled(): boolean;
+export interface InstallShellGuardArgs {
+    /** 'false' to skip writing profile entries (rules + script only). */
+    profiles?: string;
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+export declare function installShellGuardCommand(args?: InstallShellGuardArgs): Promise<void>;
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+export declare function uninstallShellGuardCommand(): Promise<void>;
+export {};

package/dist/commands/shellGuard.js

@@ -0,0 +1,552 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeShellGuardRules = writeShellGuardRules;
+exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.getShellGuardStatus = getShellGuardStatus;
+exports.isShellGuardInstalled = isShellGuardInstalled;
+exports.installShellGuardCommand = installShellGuardCommand;
+exports.uninstallShellGuardCommand = uninstallShellGuardCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Interactive PowerShell guard — real-time blocking of dangerous commands
+ * TYPED by a human in a terminal (inside or outside the IDE).
+ *
+ * How it works:
+ *   - The CLI writes a ruleset JSON (~/.fullcourtdefense-shell-guard.json):
+ *     the same dangerous-command families the deterministic guard enforces on
+ *     agent tool calls (destructive filesystem, reverse shells, infra destroy,
+ *     credential exfiltration, …) plus the org's custom block patterns from the
+ *     cached local-safety snapshot, plus the Shield mode (block vs monitor).
+ *   - A profile script (~/.fullcourtdefense-shell-guard.ps1) is dot-sourced from
+ *     the user's PowerShell profiles (both Windows PowerShell 5.1 and pwsh 7).
+ *     It compiles the rules ONCE at shell startup and hooks the PSReadLine
+ *     Enter key: every submitted line is checked in-process (sub-millisecond —
+ *     no node/network on the hot path).
+ *   - Match in block mode → the line is cleared and never executes; monitor
+ *     mode → yellow warning, the command still runs. Either way the event is
+ *     appended to the telemetry spool and a detached flush reports it to the
+ *     fleet dashboard.
+ *   - Rules/mode refresh opportunistically on every telemetry flush (offline
+ *     caches only — never blocks a shell).
+ *
+ * Scope honesty: this covers INTERACTIVE PowerShell (PSReadLine hosts, incl.
+ * IDE-integrated terminals). Non-interactive scripts are covered by ScriptBlock
+ * Logging (windowsAudit.ts); native cmd.exe has no enforcement path yet.
+ */
+const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
+const GUARD_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.ps1');
+const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
+const RUNTIME_CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
+const SNAPSHOT_CACHE_DIR = path.join(os.homedir(), '.fullcourtdefense');
+const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
+const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
+/**
+ * Built-in dangerous-command rules — the shell-relevant subset of
+ * deterministicGuard.ts, expressed as .NET-compatible regexes (PowerShell
+ * compiles them with IgnoreCase). Item ids match the deterministic guard so
+ * dashboard events line up across IDE hooks and terminal blocks.
+ */
+const BUILTIN_RULES = [
+    // Destructive filesystem
+    { id: 'rm_rf_root', category: 'destructive_command', reason: 'recursive force delete of filesystem root', source: 'builtin',
+        pattern: String.raw `\b(?:sudo\s+)?rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?/["']?|\*)(?:\s|$|[;&|])` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Windows drive delete', source: 'builtin',
+        pattern: String.raw `\b(?:del|erase)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Remove-Item on a drive root', source: 'builtin',
+        pattern: String.raw `\bremove-item\b(?=.*-recurse)(?=.*-force)(?=.*\s[a-z]:[\\/]?(?:\s|$))` },
+    { id: 'format_drive', category: 'destructive_command', reason: 'drive format command', source: 'builtin',
+        pattern: String.raw `(?<![-\w])(?:format(?:\.com)?\s+[a-z]:(?:\s|$)|format-volume\b(?=.*-driveletter))` },
+    { id: 'fork_bomb', category: 'destructive_command', reason: 'fork bomb', source: 'builtin',
+        pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
+    { id: 'mkfs_device', category: 'destructive_command', reason: 'filesystem format command', source: 'builtin',
+        pattern: String.raw `\bmkfs(?:\.[a-z0-9]+)?\s+/dev/` },
+    { id: 'dd_disk_overwrite', category: 'destructive_command', reason: 'raw disk overwrite command', source: 'builtin',
+        pattern: String.raw `\bdd\b(?=.*\bof=/dev/(?:sd|xvd|hd|nvme|disk))` },
+    { id: 'chmod_root_777', category: 'destructive_command', reason: 'recursive permission change on root', source: 'builtin',
+        pattern: String.raw `\bchmod\s+-r\s+777\s+/(?:\s|$)` },
+    { id: 'vssadmin_delete_shadows', category: 'destructive_command', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bvssadmin\b(?=.*\bdelete\b)(?=.*\bshadows\b)` },
+    { id: 'defender_disable', category: 'destructive_command', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
+        pattern: String.raw `\bset-mppreference\b(?=.*-disablerealtimemonitoring)(?=.*(?:\$true|\s1\b))` },
+    // Reverse shells / droppers
+    { id: 'bash_dev_tcp', category: 'reverse_shell', reason: 'bash reverse shell', source: 'builtin',
+        pattern: String.raw `\bbash\s+-i\b.*(?:/dev/tcp/)` },
+    { id: 'netcat_exec', category: 'reverse_shell', reason: 'netcat reverse shell', source: 'builtin',
+        pattern: String.raw `\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:/bin/)?(?:sh|bash|cmd(?:\.exe)?|powershell(?:\.exe)?)\b` },
+    { id: 'socat_exec', category: 'reverse_shell', reason: 'socat reverse shell', source: 'builtin',
+        pattern: String.raw `\bsocat\b.*\bexec:(?:/bin/)?(?:sh|bash)\b` },
+    { id: 'curl_pipe_shell', category: 'reverse_shell', reason: 'remote script piped to shell', source: 'builtin',
+        pattern: String.raw `\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b` },
+    { id: 'powershell_download_exec', category: 'reverse_shell', reason: 'download-and-execute (IEX + web download)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:iex\b|invoke-expression\b))(?=.*(?:downloadstring|net\.webclient|invoke-webrequest\b|\biwr\b|invoke-restmethod\b|\birm\b))` },
+    { id: 'python_socket_subprocess', category: 'reverse_shell', reason: 'python reverse shell', source: 'builtin',
+        pattern: String.raw `\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)` },
+    // Cloud metadata / credential exfiltration
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', reason: 'request to cloud metadata endpoint', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
+    { id: 'credential_exfiltration', category: 'secret_exfiltration', reason: 'credential file sent to the network', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
+    // Infra destroy
+    { id: 'terraform_destroy_auto', category: 'infra_destroy', reason: 'terraform destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bterraform\s+destroy\b(?=.*--auto-approve)` },
+    { id: 'pulumi_destroy_yes', category: 'infra_destroy', reason: 'pulumi destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bpulumi\s+destroy\b(?=.*(?:--yes|\s-y\b))` },
+    { id: 'kubectl_delete_namespace', category: 'infra_destroy', reason: 'destructive kubectl namespace delete', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+namespace\b` },
+    { id: 'kubectl_delete_all_all', category: 'infra_destroy', reason: 'broad kubectl delete all', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+all\b(?=.*--all)` },
+    { id: 'gcloud_project_delete', category: 'infra_destroy', reason: 'GCP project deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
+    { id: 'gcloud_sql_delete', category: 'infra_destroy', reason: 'GCP SQL instance deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+sql\s+instances\s+delete\b` },
+    { id: 'aws_s3_recursive_rm', category: 'infra_destroy', reason: 'recursive S3 deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+s3\s+rm\s+s3://\S+\s+--recursive\b` },
+    { id: 'aws_cloudformation_delete_stack', category: 'infra_destroy', reason: 'CloudFormation stack deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+cloudformation\s+delete-stack\b` },
+    { id: 'aws_iam_admin_policy', category: 'infra_destroy', reason: 'IAM administrator privilege grant', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)` },
+    { id: 'aws_iam_access_key', category: 'infra_destroy', reason: 'IAM access key creation', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+create-access-key\b` },
+    { id: 'az_group_delete_yes', category: 'infra_destroy', reason: 'Azure resource group deletion', source: 'builtin',
+        pattern: String.raw `\baz\s+group\s+delete\b(?=.*(?:--yes|\s-y\b))` },
+    // Destructive SQL typed straight into a terminal client
+    { id: 'drop_database', category: 'destructive_sql', reason: 'DROP DATABASE', source: 'builtin',
+        pattern: String.raw `\bdrop\s+database\b` },
+    { id: 'drop_schema', category: 'destructive_sql', reason: 'DROP SCHEMA', source: 'builtin',
+        pattern: String.raw `\bdrop\s+schema\b` },
+];
+function escapeDotNetRegex(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Cached Shield mode from the runtime bundle cache (offline read, never network). */
+function cachedMode() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(RUNTIME_CACHE_PATH, 'utf8'));
+        const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
+        entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
+        const mode = entries[0]?.mode;
+        return mode === 'monitor' || mode === 'shadow' ? 'monitor' : 'block';
+    }
+    catch {
+        return 'block';
+    }
+}
+/**
+ * Built-in rule ids toggled OFF in the dashboard (local-safety snapshot cache).
+ * Rule ids match the deterministic guard's item ids, so one console toggle
+ * disables the rule in IDE hooks AND interactive terminals.
+ */
+function cachedDisabledItemIds() {
+    const disabled = new Set();
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const ids = parsed?.snapshot?.disabledBuiltInItemIds;
+                if (Array.isArray(ids)) {
+                    for (const id of ids) {
+                        if (typeof id === 'string' && id)
+                            disabled.add(id);
+                    }
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    return disabled;
+}
+/** Org custom block patterns from the cached local-safety snapshots (offline read). */
+function cachedCustomRules() {
+    const rules = [];
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const blocks = parsed?.snapshot?.customBlocks;
+                if (!Array.isArray(blocks))
+                    continue;
+                for (const block of blocks.slice(0, 100)) {
+                    if (!block || typeof block.pattern !== 'string' || !block.pattern.trim())
+                        continue;
+                    rules.push({
+                        id: String(block.id || block.pattern).slice(0, 120),
+                        category: String(block.categoryId || 'custom'),
+                        // Snapshot custom blocks are substring matches — escape into a literal regex.
+                        pattern: escapeDotNetRegex(block.pattern.trim()),
+                        reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
+                        source: 'custom',
+                    });
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    // Dedupe by id+pattern.
+    const seen = new Set();
+    return rules.filter(rule => {
+        const key = `${rule.id}|${rule.pattern}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+function writeShellGuardRules() {
+    const disabled = cachedDisabledItemIds();
+    const data = {
+        updatedAt: new Date().toISOString(),
+        mode: cachedMode(),
+        rules: [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()],
+    };
+    fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
+    return data;
+}
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+function refreshShellGuardRules() {
+    try {
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return;
+        writeShellGuardRules();
+    }
+    catch { /* best-effort */ }
+}
+function psQuote(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/** The profile guard script. Placeholders are substituted at install time. */
+function buildGuardPs1(nodePath, cliEntry) {
+    const lines = [
+        `# FullCourtDefense interactive shell guard (installed by fullcourtdefense-cli).`,
+        `# Blocks dangerous commands typed in PowerShell using the org's cached rules.`,
+        `# Disable for one session:  $env:FCD_SHELL_GUARD = 'off'`,
+        `# Remove permanently:       fullcourtdefense uninstall-shell-guard`,
+        ``,
+        `$global:FcdRulesPath = ${psQuote(GUARD_RULES_PATH)}`,
+        `$global:FcdSpoolPath = ${psQuote(SPOOL_PATH)}`,
+        `$global:FcdNodePath  = ${psQuote(nodePath)}`,
+        `$global:FcdCliEntry  = ${psQuote(cliEntry)}`,
+        `$global:FcdGuardMode = 'block'`,
+        `$global:FcdGuardRules = @()`,
+        ``,
+        `try {`,
+        `  if (Test-Path $global:FcdRulesPath) {`,
+        `    $fcdRaw = Get-Content -Raw -Path $global:FcdRulesPath | ConvertFrom-Json`,
+        `    if ($fcdRaw.mode -eq 'monitor') { $global:FcdGuardMode = 'monitor' }`,
+        `    $global:FcdGuardRules = @($fcdRaw.rules | ForEach-Object {`,
+        `      try {`,
+        `        [pscustomobject]@{`,
+        `          Id       = [string]$_.id`,
+        `          Category = [string]$_.category`,
+        `          Reason   = [string]$_.reason`,
+        `          Source   = [string]$_.source`,
+        `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
+        `        }`,
+        `      } catch { $null }`,
+        `    } | Where-Object { $null -ne $_ })`,
+        `  }`,
+        `} catch { $global:FcdGuardRules = @() }`,
+        ``,
+        `function global:Test-FcdShellGuard {`,
+        `  param([string]$CommandLine)`,
+        `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
+        `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  foreach ($rule in $global:FcdGuardRules) {`,
+        `    try {`,
+        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) { return $rule }`,
+        `    } catch { }`,
+        `  }`,
+        `  return $null`,
+        `}`,
+        ``,
+        `function global:Write-FcdGuardEvent {`,
+        `  param($Rule, [string]$CommandLine, [string]$Decision)`,
+        `  try {`,
+        `    $evidence = $CommandLine.Trim()`,
+        `    if ($evidence.Length -gt 180) { $evidence = $evidence.Substring(0, 180) + '...' }`,
+        `    $event = [pscustomobject]@{`,
+        `      eventId    = [guid]::NewGuid().ToString()`,
+        `      type       = 'verdict'`,
+        `      decision   = $Decision`,
+        `      toolName   = 'powershell_terminal'`,
+        `      operation  = 'shell_command'`,
+        `      reason     = ('Shell guard: ' + $Rule.Reason)`,
+        `      ruleId     = $Rule.Id`,
+        `      category   = $Rule.Category`,
+        `      source     = $Rule.Source`,
+        `      evidence   = $evidence`,
+        `      occurredAt = (Get-Date).ToUniversalTime().ToString('o')`,
+        `    }`,
+        `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,
+        `    [System.IO.File]::AppendAllText($global:FcdSpoolPath, (($event | ConvertTo-Json -Compress) + "\`n"), (New-Object System.Text.UTF8Encoding($false)))`,
+        `    if ((Test-Path $global:FcdNodePath) -and (Test-Path $global:FcdCliEntry)) {`,
+        `      Start-Process -FilePath $global:FcdNodePath -ArgumentList @($global:FcdCliEntry, 'flush-spool', '--heartbeat', 'true') -WindowStyle Hidden -ErrorAction SilentlyContinue | Out-Null`,
+        `    }`,
+        `  } catch { }`,
+        `}`,
+        ``,
+        `# Hook the Enter key only in interactive PSReadLine hosts (consoles, IDE terminals).`,
+        `# try/catch: in non-interactive hosts PSReadLine can be present but uninitialized.`,
+        `try {`,
+        `if ($env:FCD_SHELL_GUARD -ne 'off' -and (Get-Command Set-PSReadLineKeyHandler -ErrorAction SilentlyContinue)) {`,
+        `  Set-PSReadLineKeyHandler -Key Enter -BriefDescription 'FCDShellGuard' -Description 'FullCourtDefense dangerous-command guard' -ScriptBlock {`,
+        `    param($key, $arg)`,
+        `    $line = $null`,
+        `    $cursor = $null`,
+        `    try { [Microsoft.PowerShell.PSConsoleReadLine]::GetBufferState([ref]$line, [ref]$cursor) } catch { }`,
+        `    $hit = $null`,
+        `    if ($line -and $env:FCD_SHELL_GUARD -ne 'off') {`,
+        `      try { $hit = Test-FcdShellGuard -CommandLine $line } catch { $hit = $null }`,
+        `    }`,
+        `    if ($null -ne $hit) {`,
+        `      if ($global:FcdGuardMode -eq 'monitor') {`,
+        `        Write-Host ''`,
+        `        Write-Host ('[FullCourtDefense] monitor: would block - ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow'`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `        return`,
+        `      }`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
+        `      Write-Host ''`,
+        `      Write-Host ('[FullCourtDefense] BLOCKED: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
+        `      Write-Host 'This command was not executed. Reported to your security dashboard.' -ForegroundColor DarkGray`,
+        `      Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block'`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `      return`,
+        `    }`,
+        `    [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `  }`,
+        `}`,
+        `} catch { }`,
+        ``,
+    ];
+    return lines.join('\r\n');
+}
+/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
+function resolveProfilePaths() {
+    const out = [];
+    for (const engine of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
+                encoding: 'utf8', windowsHide: true, timeout: 15000,
+            });
+            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
+            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
+                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
+            }
+        }
+        catch { /* engine not installed */ }
+    }
+    // Dedupe (both engines can share a profile only if paths match — normally they differ).
+    const seen = new Set();
+    return out.filter(entry => {
+        const key = entry.profilePath.toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function profileSnippet() {
+    return [
+        MARKER_START,
+        `# Loads the FullCourtDefense dangerous-command guard for interactive sessions.`,
+        `if (Test-Path ${psQuote(GUARD_PS1_PATH)}) { . ${psQuote(GUARD_PS1_PATH)} }`,
+        MARKER_END,
+    ].join('\r\n');
+}
+function addSnippetToProfile(profilePath) {
+    fs.mkdirSync(path.dirname(profilePath), { recursive: true });
+    let content = '';
+    try {
+        content = fs.readFileSync(profilePath, 'utf8');
+    }
+    catch { /* new profile */ }
+    if (content.includes(MARKER_START))
+        return 'already';
+    const sep = content && !content.endsWith('\n') ? '\r\n\r\n' : content ? '\r\n' : '';
+    fs.writeFileSync(profilePath, content + sep + profileSnippet() + '\r\n', 'utf8');
+    return 'installed';
+}
+function removeSnippetFromProfile(profilePath) {
+    try {
+        const content = fs.readFileSync(profilePath, 'utf8');
+        const start = content.indexOf(MARKER_START);
+        const end = content.indexOf(MARKER_END);
+        if (start === -1 || end === -1)
+            return false;
+        const cleaned = (content.slice(0, start) + content.slice(end + MARKER_END.length)).replace(/(\r?\n){3,}/g, '\r\n\r\n');
+        fs.writeFileSync(profilePath, cleaned, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+function getShellGuardStatus() {
+    if (process.platform !== 'win32') {
+        return { supported: false, installed: false, profiles: [], rulesPresent: false };
+    }
+    try {
+        const profiles = resolveProfilePaths().map(entry => {
+            let installed = false;
+            try {
+                installed = fs.readFileSync(entry.profilePath, 'utf8').includes(MARKER_START);
+            }
+            catch { /* no profile */ }
+            return { ...entry, installed };
+        });
+        let ruleCount;
+        let mode;
+        let rulesPresent = false;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(GUARD_RULES_PATH, 'utf8'));
+            rulesPresent = Array.isArray(parsed?.rules) && parsed.rules.length > 0;
+            ruleCount = Array.isArray(parsed?.rules) ? parsed.rules.length : undefined;
+            mode = typeof parsed?.mode === 'string' ? parsed.mode : undefined;
+        }
+        catch { /* not written yet */ }
+        return {
+            supported: true,
+            installed: profiles.some(p => p.installed) && fs.existsSync(GUARD_PS1_PATH),
+            profiles,
+            rulesPresent,
+            ruleCount,
+            mode,
+        };
+    }
+    catch {
+        return { supported: true, installed: false, profiles: [], rulesPresent: false };
+    }
+}
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+function isShellGuardInstalled() {
+    try {
+        if (process.platform !== 'win32')
+            return false;
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return false;
+        // Cheap check: at least one known profile contains the marker. Avoid
+        // spawning PowerShell on the heartbeat path — check well-known locations.
+        const candidates = [
+            path.join(os.homedir(), 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'Documents', 'PowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'PowerShell', 'profile.ps1'),
+        ];
+        for (const candidate of candidates) {
+            try {
+                if (fs.readFileSync(candidate, 'utf8').includes(MARKER_START))
+                    return true;
+            }
+            catch { /* keep looking */ }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+async function installShellGuardCommand(args = {}) {
+    if (process.platform !== 'win32') {
+        console.log('The interactive shell guard currently supports Windows PowerShell. macOS/Linux (bash/zsh preexec) is planned.');
+        return;
+    }
+    const rules = writeShellGuardRules();
+    const nodePath = process.execPath;
+    const cliEntry = process.argv[1] || '';
+    fs.writeFileSync(GUARD_PS1_PATH, buildGuardPs1(nodePath, cliEntry), 'utf8');
+    console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
+    if (args.profiles === 'false') {
+        console.log('Skipped profile wiring (--profiles false): guard script + rules written only.');
+        return;
+    }
+    const profiles = resolveProfilePaths();
+    if (profiles.length === 0) {
+        console.log('\x1b[33m⚠ Could not resolve any PowerShell profile path — guard script written but not wired into a profile.\x1b[0m');
+        return;
+    }
+    for (const profile of profiles) {
+        try {
+            const outcome = addSnippetToProfile(profile.profilePath);
+            console.log(outcome === 'installed'
+                ? `\x1b[32m✓ ${profile.engine}: guard added to profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`
+                : `\x1b[32m✓ ${profile.engine}: guard already in profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`);
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ ${profile.engine}: could not update profile (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
+        }
+    }
+    console.log('\x1b[2mTakes effect in NEW PowerShell windows. Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+}
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+async function uninstallShellGuardCommand() {
+    if (process.platform !== 'win32') {
+        console.log('Nothing to remove on this OS.');
+        return;
+    }
+    let removed = 0;
+    for (const profile of resolveProfilePaths()) {
+        if (removeSnippetFromProfile(profile.profilePath)) {
+            removed++;
+            console.log(`Removed guard from ${profile.engine} profile (${profile.profilePath}).`);
+        }
+    }
+    try {
+        fs.unlinkSync(GUARD_PS1_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(GUARD_RULES_PATH);
+    }
+    catch { /* not present */ }
+    console.log(removed > 0 ? 'Shell guard uninstalled. Open shells keep the guard until closed.' : 'Shell guard was not installed in any profile.');
+}

package/dist/commands/windowsAudit.d.ts

@@ -0,0 +1,49 @@
+export interface WindowsAuditStatus {
+    /** False on non-Windows platforms (audit logging is a Windows feature). */
+    supported: boolean;
+    scriptBlockLogging: boolean;
+    transcription: boolean;
+    transcriptionPath?: string;
+    checkedAt: string;
+}
+/** Shape reported to the backend (discovery host payload + heartbeat). */
+export interface ShellAuditReport {
+    platform: string;
+    scriptBlockLogging: boolean;
+    transcription: boolean;
+    transcriptionPath?: string;
+    /** Interactive PowerShell profile guard installed (real-time blocking of typed commands). */
+    profileGuard?: boolean;
+    checkedAt: string;
+}
+/** Probe current audit coverage. Read-only, no elevation needed, never throws. */
+export declare function getWindowsAuditStatus(): WindowsAuditStatus;
+/**
+ * Compact status for the discovery host payload and telemetry heartbeat.
+ * Returns undefined on non-Windows so the field is simply omitted.
+ * Never throws — telemetry/discovery must not break on a probe failure.
+ */
+export declare function getShellAuditReport(): ShellAuditReport | undefined;
+export interface EnableWindowsAuditResult {
+    ok: boolean;
+    status: WindowsAuditStatus;
+    /** Human-readable outcome, printable as-is. */
+    message: string;
+    /** True when the user saw (and answered) a UAC elevation prompt. */
+    promptShown: boolean;
+}
+/**
+ * Enable ScriptBlock Logging + Transcription via ONE UAC elevation prompt.
+ * Skips silently when already fully enabled. Never throws; on any failure
+ * (UAC declined, no admin, GPO conflict) returns ok=false with a warning
+ * message — callers must treat that as non-blocking.
+ */
+export declare function enableWindowsAudit(): EnableWindowsAuditResult;
+export interface WindowsAuditArgs {
+    enable?: string;
+}
+/**
+ * `fullcourtdefense windows-audit` — show (default) or enable (--enable)
+ * Windows PowerShell audit coverage on this machine.
+ */
+export declare function windowsAuditCommand(args: WindowsAuditArgs): Promise<void>;

package/dist/commands/windowsAudit.js

@@ -0,0 +1,247 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWindowsAuditStatus = getWindowsAuditStatus;
+exports.getShellAuditReport = getShellAuditReport;
+exports.enableWindowsAudit = enableWindowsAudit;
+exports.windowsAuditCommand = windowsAuditCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const shellGuard_1 = require("./shellGuard");
+/**
+ * Windows PowerShell audit coverage — ScriptBlock Logging + Transcription.
+ *
+ * Both are built-in Windows engine features (no agent, no driver): once the
+ * HKLM policy keys are set, PowerShell itself records every script block it
+ * executes (event 4104 — including decoded/obfuscated code, scripts run as
+ * files, and PowerShell spawned by other processes) and writes full session
+ * transcripts. That closes the biggest endpoint blind spot: dangerous commands
+ * that never pass through an IDE hook or interactive prompt.
+ *
+ * The keys live under HKLM\SOFTWARE\Policies so writing them requires
+ * elevation — `enableWindowsAudit()` triggers ONE UAC prompt via
+ * `Start-Process -Verb RunAs`. Reading them needs no elevation, so coverage
+ * status is probed freely by `install-all`, `discover --upload`, and every
+ * telemetry heartbeat (which is how the fleet dashboard knows which machines
+ * are covered).
+ *
+ * Fail-open by design: enable failures (UAC declined, no admin rights,
+ * GPO-managed) NEVER block an install — they surface as a warning locally and
+ * as missing coverage in the Devices & MCP fleet view.
+ */
+const SBL_KEY = 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging';
+const TRANSCRIPTION_KEY = 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription';
+/** Read a REG_DWORD value; returns undefined when the key/value is absent. */
+function regDword(key, value) {
+    try {
+        const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
+            encoding: 'utf8', windowsHide: true, timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const match = out.match(new RegExp(`${value}\\s+REG_DWORD\\s+0x([0-9a-fA-F]+)`));
+        return match ? parseInt(match[1], 16) : undefined;
+    }
+    catch {
+        return undefined; // key or value missing → not enabled
+    }
+}
+/** Read a REG_SZ value; returns undefined when the key/value is absent. */
+function regString(key, value) {
+    try {
+        const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
+            encoding: 'utf8', windowsHide: true, timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const match = out.match(new RegExp(`${value}\\s+REG_(?:EXPAND_)?SZ\\s+(.+)`));
+        return match ? match[1].trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Probe current audit coverage. Read-only, no elevation needed, never throws. */
+function getWindowsAuditStatus() {
+    const checkedAt = new Date().toISOString();
+    if (process.platform !== 'win32') {
+        return { supported: false, scriptBlockLogging: false, transcription: false, checkedAt };
+    }
+    return {
+        supported: true,
+        scriptBlockLogging: regDword(SBL_KEY, 'EnableScriptBlockLogging') === 1,
+        transcription: regDword(TRANSCRIPTION_KEY, 'EnableTranscripting') === 1,
+        transcriptionPath: regString(TRANSCRIPTION_KEY, 'OutputDirectory'),
+        checkedAt,
+    };
+}
+/**
+ * Compact status for the discovery host payload and telemetry heartbeat.
+ * Returns undefined on non-Windows so the field is simply omitted.
+ * Never throws — telemetry/discovery must not break on a probe failure.
+ */
+function getShellAuditReport() {
+    try {
+        if (process.platform !== 'win32')
+            return undefined;
+        const status = getWindowsAuditStatus();
+        return {
+            platform: 'win32',
+            scriptBlockLogging: status.scriptBlockLogging,
+            transcription: status.transcription,
+            transcriptionPath: status.transcriptionPath,
+            profileGuard: (0, shellGuard_1.isShellGuardInstalled)(),
+            checkedAt: status.checkedAt,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function defaultTranscriptDir() {
+    const programData = process.env.ProgramData || 'C:\\ProgramData';
+    return path.join(programData, 'FullCourtDefense', 'Transcripts');
+}
+/** The elevated payload: sets both policy keys + creates the transcript dir. */
+function buildEnableScript(transcriptDir) {
+    return [
+        `$ErrorActionPreference = 'Stop'`,
+        `$sbl = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging'`,
+        `New-Item -Path $sbl -Force | Out-Null`,
+        `New-ItemProperty -Path $sbl -Name EnableScriptBlockLogging -Value 1 -PropertyType DWord -Force | Out-Null`,
+        `$tr = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription'`,
+        `New-Item -Path $tr -Force | Out-Null`,
+        `New-ItemProperty -Path $tr -Name EnableTranscripting -Value 1 -PropertyType DWord -Force | Out-Null`,
+        `New-ItemProperty -Path $tr -Name EnableInvocationHeader -Value 1 -PropertyType DWord -Force | Out-Null`,
+        `$dir = '${transcriptDir.replace(/'/g, "''")}'`,
+        `New-Item -ItemType Directory -Path $dir -Force | Out-Null`,
+        `New-ItemProperty -Path $tr -Name OutputDirectory -Value $dir -PropertyType String -Force | Out-Null`,
+    ].join('\r\n') + '\r\n';
+}
+/**
+ * Enable ScriptBlock Logging + Transcription via ONE UAC elevation prompt.
+ * Skips silently when already fully enabled. Never throws; on any failure
+ * (UAC declined, no admin, GPO conflict) returns ok=false with a warning
+ * message — callers must treat that as non-blocking.
+ */
+function enableWindowsAudit() {
+    const before = getWindowsAuditStatus();
+    if (!before.supported) {
+        return { ok: false, status: before, promptShown: false, message: 'PowerShell audit logging is a Windows feature — skipped on this OS.' };
+    }
+    if (before.scriptBlockLogging && before.transcription) {
+        return { ok: true, status: before, promptShown: false, message: 'PowerShell audit logging already enabled (ScriptBlock Logging + Transcription).' };
+    }
+    const transcriptDir = before.transcriptionPath || defaultTranscriptDir();
+    const scriptPath = path.join(os.tmpdir(), `fcd-enable-audit-${process.pid}.ps1`);
+    const elevatePath = path.join(os.tmpdir(), `fcd-elevate-audit-${process.pid}.ps1`);
+    let promptShown = false;
+    try {
+        fs.writeFileSync(scriptPath, buildEnableScript(transcriptDir), 'utf8');
+        // Outer (unelevated) launcher script asks Windows to run the payload
+        // elevated. Using -File for BOTH scripts avoids inline -Command quoting
+        // pitfalls (paths with spaces, nested quotes). -Wait blocks until the
+        // elevated child finishes so the recheck below is accurate; if the user
+        // clicks "No" on UAC, Start-Process throws and the launcher exits 1.
+        const quotedPayload = `"${scriptPath}"`.replace(/'/g, "''");
+        fs.writeFileSync(elevatePath, [
+            `$ErrorActionPreference = 'Stop'`,
+            `try {`,
+            `  $p = Start-Process -FilePath 'powershell.exe' -Verb RunAs -Wait -PassThru -WindowStyle Hidden -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-File','${quotedPayload}')`,
+            `  exit $p.ExitCode`,
+            `} catch {`,
+            `  exit 1`,
+            `}`,
+        ].join('\r\n') + '\r\n', 'utf8');
+        promptShown = true;
+        const result = (0, child_process_1.spawnSync)('powershell.exe', [
+            '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', elevatePath,
+        ], { encoding: 'utf8', windowsHide: true, timeout: 120000 });
+        const after = getWindowsAuditStatus();
+        if (after.scriptBlockLogging && after.transcription) {
+            return {
+                ok: true, status: after, promptShown,
+                message: `PowerShell audit logging enabled — ScriptBlock Logging + Transcription (transcripts: ${after.transcriptionPath || transcriptDir}).`,
+            };
+        }
+        const declined = result.status !== 0;
+        return {
+            ok: false, status: after, promptShown,
+            message: declined
+                ? 'PowerShell audit logging NOT enabled — the admin prompt was declined or elevation failed. Re-run `fullcourtdefense install-all` (or `fullcourtdefense windows-audit --enable`) and approve the prompt, or ask IT to enable it via GPO/Intune.'
+                : 'PowerShell audit logging could not be verified after the elevated write — the keys may be managed by Group Policy. Ask IT to enable ScriptBlock Logging + Transcription via GPO/Intune.',
+        };
+    }
+    catch (error) {
+        return {
+            ok: false, status: getWindowsAuditStatus(), promptShown,
+            message: `PowerShell audit logging NOT enabled (${error instanceof Error ? error.message : String(error)}). Re-run elevated or ask IT to enable via GPO/Intune.`,
+        };
+    }
+    finally {
+        try {
+            fs.unlinkSync(scriptPath);
+        }
+        catch { /* best effort */ }
+        try {
+            fs.unlinkSync(elevatePath);
+        }
+        catch { /* best effort */ }
+    }
+}
+/**
+ * `fullcourtdefense windows-audit` — show (default) or enable (--enable)
+ * Windows PowerShell audit coverage on this machine.
+ */
+async function windowsAuditCommand(args) {
+    if (process.platform !== 'win32') {
+        console.log('PowerShell audit logging is a Windows feature — nothing to do on this OS.');
+        return;
+    }
+    if (args.enable === 'true') {
+        console.log('Enabling PowerShell audit logging (ScriptBlock Logging + Transcription)…');
+        console.log('\x1b[2mWindows will show an admin approval prompt (UAC). Approve it to enable machine-wide command auditing.\x1b[0m');
+        const result = enableWindowsAudit();
+        console.log(result.ok ? `\x1b[32m✓ ${result.message}\x1b[0m` : `\x1b[33m⚠ ${result.message}\x1b[0m`);
+        return;
+    }
+    const status = getWindowsAuditStatus();
+    const mark = (on) => (on ? '\x1b[32m✓ enabled\x1b[0m' : '\x1b[31m✗ disabled\x1b[0m');
+    console.log('\n\x1b[1mWindows PowerShell audit coverage\x1b[0m');
+    console.log(`  ScriptBlock Logging (event 4104):  ${mark(status.scriptBlockLogging)}`);
+    console.log(`  Transcription (session recording): ${mark(status.transcription)}${status.transcriptionPath ? ` \x1b[2m→ ${status.transcriptionPath}\x1b[0m` : ''}`);
+    if (!status.scriptBlockLogging || !status.transcription) {
+        console.log('\n  Enable with: \x1b[1mfullcourtdefense windows-audit --enable\x1b[0m (requires one admin approval)');
+    }
+    console.log('');
+}

package/dist/index.js

@@ -50,6 +50,8 @@ const installClaudeHook_1 = require("./commands/installClaudeHook");
 const mcpGateway_1 = require("./commands/mcpGateway");
 const installAll_1 = require("./commands/installAll");
 const autoProtect_1 = require("./commands/autoProtect");
+const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -123,6 +125,11 @@ function printHelp() {
                 install available runtime hooks for built-in actions. No folder path
                 or --mcp-command needed. Use --hooks false to skip runtime hooks.
     install     Alias for install-all.
+    windows-audit  Show Windows PowerShell audit coverage (ScriptBlock Logging +
+                Transcription). Use --enable to turn it on (one admin prompt).
+    install-shell-guard    Block dangerous commands typed in PowerShell terminals
+                (real-time, offline rule cache). uninstall-shell-guard removes it;
+                shell-guard-status shows coverage.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
@@ -592,10 +599,39 @@ async function main() {
                 discover: flags.discover,
                 autoProtect: flags['auto-protect'],
                 intervalMinutes: flags['interval-minutes'],
+                windowsAudit: flags['windows-audit'],
             };
             await (0, installAll_1.installAllCommand)(args, config);
             break;
         }
+        case 'windows-audit': {
+            const args = { enable: flags.enable };
+            await (0, windowsAudit_1.windowsAuditCommand)(args);
+            break;
+        }
+        case 'install-shell-guard': {
+            await (0, shellGuard_1.installShellGuardCommand)({ profiles: flags.profiles });
+            break;
+        }
+        case 'uninstall-shell-guard': {
+            await (0, shellGuard_1.uninstallShellGuardCommand)();
+            break;
+        }
+        case 'shell-guard-status': {
+            const status = (0, shellGuard_1.getShellGuardStatus)();
+            if (!status.supported) {
+                console.log('Shell guard supports Windows PowerShell (bash/zsh planned).');
+                break;
+            }
+            console.log(`\nInteractive PowerShell shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+            for (const profile of status.profiles) {
+                console.log(`  ${profile.engine}: ${profile.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${profile.profilePath}\x1b[0m`);
+            }
+            if (status.rulesPresent)
+                console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+            console.log('');
+            break;
+        }
         case 'install-mcp-gateway': {
             await (0, mcpGateway_1.installMcpGatewayCommand)(buildInstallArgs(), config);
             break;

package/dist/telemetry.js

@@ -42,6 +42,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
+const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -108,6 +110,9 @@ function rewriteSpool(remaining) {
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */
 async function flushSpool(input) {
+    // Piggyback on the flush cycle to re-sync the interactive shell guard's rule
+    // cache (mode flips + new custom rules reach open-terminal machines in ~30s).
+    (0, shellGuard_1.refreshShellGuardRules)();
     const all = readSpool();
     const batch = all.slice(0, MAX_BATCH);
     const overflow = all.slice(MAX_BATCH);
@@ -125,7 +130,16 @@ async function flushSpool(input) {
                 shieldId: input.shieldId,
                 machineId: identity.machineId,
                 heartbeat: input.heartbeat
-                    ? { agentVersion: input.agentVersion, integrityOk: input.integrityOk, coverage: 'hooks' }
+                    ? {
+                        agentVersion: input.agentVersion,
+                        integrityOk: input.integrityOk,
+                        coverage: 'hooks',
+                        hostname: identity.hostname,
+                        // Windows-only: current PowerShell audit coverage (ScriptBlock
+                        // Logging + Transcription). Keeps the fleet dashboard's coverage
+                        // fresh on every ping — undefined (omitted) on other platforms.
+                        shellAudit: (0, windowsAudit_1.getShellAuditReport)(),
+                    }
                     : undefined,
                 events: batch,
             }),

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.8.0"
+  "version": "1.10.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -16,6 +16,9 @@
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
+    "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
+    "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
+    "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },
   "keywords": [