fullcourtdefense-cli 1.9.0 → 1.10.0

package/dist/commands/installAll.d.ts

@@ -11,6 +11,7 @@ export interface InstallAllArgs extends ProtectAllArgs {
     autoProtect?: string;
     intervalMinutes?: string;
     windowsAudit?: string;
+    shellGuard?: string;
 }
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor

package/dist/commands/installAll.js

@@ -10,6 +10,7 @@ const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
 const restartNotice_1 = require("./restartNotice");
 const windowsAudit_1 = require("./windowsAudit");
+const shellGuard_1 = require("./shellGuard");
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor
  * hooks for built-in Cursor actions, optional self-heal and fleet upload.
@@ -93,6 +94,18 @@ async function installAllCommand(args, config) {
             console.log(`\x1b[33m⚠ Warning: PowerShell audit logging step failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
         }
     }
+    // Interactive PowerShell guard — blocks dangerous commands TYPED in a
+    // terminal (inside or outside the IDE) using the same rule families the IDE
+    // hooks enforce, from the local cache (no admin needed, no network hot path).
+    if (process.platform === 'win32' && args.shellGuard !== 'false') {
+        console.log('\n\x1b[1mInstalling interactive PowerShell shell guard…\x1b[0m');
+        try {
+            await (0, shellGuard_1.installShellGuardCommand)();
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: shell guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
     if (args.autoProtect === 'true') {
         console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
         await (0, autoProtect_1.autoProtectCommand)({

package/dist/commands/shellGuard.d.ts

@@ -0,0 +1,46 @@
+export interface ShellGuardRule {
+    id: string;
+    category: string;
+    /** .NET-compatible regex, matched with IgnoreCase against the typed line. */
+    pattern: string;
+    reason: string;
+    source: 'builtin' | 'custom';
+}
+interface ShellGuardRulesFile {
+    updatedAt: string;
+    mode: 'block' | 'monitor';
+    rules: ShellGuardRule[];
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+export declare function writeShellGuardRules(): ShellGuardRulesFile;
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+export declare function refreshShellGuardRules(): void;
+export interface ShellGuardStatus {
+    supported: boolean;
+    installed: boolean;
+    profiles: Array<{
+        engine: string;
+        profilePath: string;
+        installed: boolean;
+    }>;
+    rulesPresent: boolean;
+    ruleCount?: number;
+    mode?: string;
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+export declare function getShellGuardStatus(): ShellGuardStatus;
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+export declare function isShellGuardInstalled(): boolean;
+export interface InstallShellGuardArgs {
+    /** 'false' to skip writing profile entries (rules + script only). */
+    profiles?: string;
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+export declare function installShellGuardCommand(args?: InstallShellGuardArgs): Promise<void>;
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+export declare function uninstallShellGuardCommand(): Promise<void>;
+export {};

package/dist/commands/shellGuard.js

@@ -0,0 +1,552 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeShellGuardRules = writeShellGuardRules;
+exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.getShellGuardStatus = getShellGuardStatus;
+exports.isShellGuardInstalled = isShellGuardInstalled;
+exports.installShellGuardCommand = installShellGuardCommand;
+exports.uninstallShellGuardCommand = uninstallShellGuardCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Interactive PowerShell guard — real-time blocking of dangerous commands
+ * TYPED by a human in a terminal (inside or outside the IDE).
+ *
+ * How it works:
+ *   - The CLI writes a ruleset JSON (~/.fullcourtdefense-shell-guard.json):
+ *     the same dangerous-command families the deterministic guard enforces on
+ *     agent tool calls (destructive filesystem, reverse shells, infra destroy,
+ *     credential exfiltration, …) plus the org's custom block patterns from the
+ *     cached local-safety snapshot, plus the Shield mode (block vs monitor).
+ *   - A profile script (~/.fullcourtdefense-shell-guard.ps1) is dot-sourced from
+ *     the user's PowerShell profiles (both Windows PowerShell 5.1 and pwsh 7).
+ *     It compiles the rules ONCE at shell startup and hooks the PSReadLine
+ *     Enter key: every submitted line is checked in-process (sub-millisecond —
+ *     no node/network on the hot path).
+ *   - Match in block mode → the line is cleared and never executes; monitor
+ *     mode → yellow warning, the command still runs. Either way the event is
+ *     appended to the telemetry spool and a detached flush reports it to the
+ *     fleet dashboard.
+ *   - Rules/mode refresh opportunistically on every telemetry flush (offline
+ *     caches only — never blocks a shell).
+ *
+ * Scope honesty: this covers INTERACTIVE PowerShell (PSReadLine hosts, incl.
+ * IDE-integrated terminals). Non-interactive scripts are covered by ScriptBlock
+ * Logging (windowsAudit.ts); native cmd.exe has no enforcement path yet.
+ */
+const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
+const GUARD_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.ps1');
+const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
+const RUNTIME_CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
+const SNAPSHOT_CACHE_DIR = path.join(os.homedir(), '.fullcourtdefense');
+const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
+const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
+/**
+ * Built-in dangerous-command rules — the shell-relevant subset of
+ * deterministicGuard.ts, expressed as .NET-compatible regexes (PowerShell
+ * compiles them with IgnoreCase). Item ids match the deterministic guard so
+ * dashboard events line up across IDE hooks and terminal blocks.
+ */
+const BUILTIN_RULES = [
+    // Destructive filesystem
+    { id: 'rm_rf_root', category: 'destructive_command', reason: 'recursive force delete of filesystem root', source: 'builtin',
+        pattern: String.raw `\b(?:sudo\s+)?rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?/["']?|\*)(?:\s|$|[;&|])` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Windows drive delete', source: 'builtin',
+        pattern: String.raw `\b(?:del|erase)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Remove-Item on a drive root', source: 'builtin',
+        pattern: String.raw `\bremove-item\b(?=.*-recurse)(?=.*-force)(?=.*\s[a-z]:[\\/]?(?:\s|$))` },
+    { id: 'format_drive', category: 'destructive_command', reason: 'drive format command', source: 'builtin',
+        pattern: String.raw `(?<![-\w])(?:format(?:\.com)?\s+[a-z]:(?:\s|$)|format-volume\b(?=.*-driveletter))` },
+    { id: 'fork_bomb', category: 'destructive_command', reason: 'fork bomb', source: 'builtin',
+        pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
+    { id: 'mkfs_device', category: 'destructive_command', reason: 'filesystem format command', source: 'builtin',
+        pattern: String.raw `\bmkfs(?:\.[a-z0-9]+)?\s+/dev/` },
+    { id: 'dd_disk_overwrite', category: 'destructive_command', reason: 'raw disk overwrite command', source: 'builtin',
+        pattern: String.raw `\bdd\b(?=.*\bof=/dev/(?:sd|xvd|hd|nvme|disk))` },
+    { id: 'chmod_root_777', category: 'destructive_command', reason: 'recursive permission change on root', source: 'builtin',
+        pattern: String.raw `\bchmod\s+-r\s+777\s+/(?:\s|$)` },
+    { id: 'vssadmin_delete_shadows', category: 'destructive_command', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bvssadmin\b(?=.*\bdelete\b)(?=.*\bshadows\b)` },
+    { id: 'defender_disable', category: 'destructive_command', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
+        pattern: String.raw `\bset-mppreference\b(?=.*-disablerealtimemonitoring)(?=.*(?:\$true|\s1\b))` },
+    // Reverse shells / droppers
+    { id: 'bash_dev_tcp', category: 'reverse_shell', reason: 'bash reverse shell', source: 'builtin',
+        pattern: String.raw `\bbash\s+-i\b.*(?:/dev/tcp/)` },
+    { id: 'netcat_exec', category: 'reverse_shell', reason: 'netcat reverse shell', source: 'builtin',
+        pattern: String.raw `\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:/bin/)?(?:sh|bash|cmd(?:\.exe)?|powershell(?:\.exe)?)\b` },
+    { id: 'socat_exec', category: 'reverse_shell', reason: 'socat reverse shell', source: 'builtin',
+        pattern: String.raw `\bsocat\b.*\bexec:(?:/bin/)?(?:sh|bash)\b` },
+    { id: 'curl_pipe_shell', category: 'reverse_shell', reason: 'remote script piped to shell', source: 'builtin',
+        pattern: String.raw `\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b` },
+    { id: 'powershell_download_exec', category: 'reverse_shell', reason: 'download-and-execute (IEX + web download)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:iex\b|invoke-expression\b))(?=.*(?:downloadstring|net\.webclient|invoke-webrequest\b|\biwr\b|invoke-restmethod\b|\birm\b))` },
+    { id: 'python_socket_subprocess', category: 'reverse_shell', reason: 'python reverse shell', source: 'builtin',
+        pattern: String.raw `\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)` },
+    // Cloud metadata / credential exfiltration
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', reason: 'request to cloud metadata endpoint', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
+    { id: 'credential_exfiltration', category: 'secret_exfiltration', reason: 'credential file sent to the network', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
+    // Infra destroy
+    { id: 'terraform_destroy_auto', category: 'infra_destroy', reason: 'terraform destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bterraform\s+destroy\b(?=.*--auto-approve)` },
+    { id: 'pulumi_destroy_yes', category: 'infra_destroy', reason: 'pulumi destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bpulumi\s+destroy\b(?=.*(?:--yes|\s-y\b))` },
+    { id: 'kubectl_delete_namespace', category: 'infra_destroy', reason: 'destructive kubectl namespace delete', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+namespace\b` },
+    { id: 'kubectl_delete_all_all', category: 'infra_destroy', reason: 'broad kubectl delete all', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+all\b(?=.*--all)` },
+    { id: 'gcloud_project_delete', category: 'infra_destroy', reason: 'GCP project deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
+    { id: 'gcloud_sql_delete', category: 'infra_destroy', reason: 'GCP SQL instance deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+sql\s+instances\s+delete\b` },
+    { id: 'aws_s3_recursive_rm', category: 'infra_destroy', reason: 'recursive S3 deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+s3\s+rm\s+s3://\S+\s+--recursive\b` },
+    { id: 'aws_cloudformation_delete_stack', category: 'infra_destroy', reason: 'CloudFormation stack deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+cloudformation\s+delete-stack\b` },
+    { id: 'aws_iam_admin_policy', category: 'infra_destroy', reason: 'IAM administrator privilege grant', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)` },
+    { id: 'aws_iam_access_key', category: 'infra_destroy', reason: 'IAM access key creation', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+create-access-key\b` },
+    { id: 'az_group_delete_yes', category: 'infra_destroy', reason: 'Azure resource group deletion', source: 'builtin',
+        pattern: String.raw `\baz\s+group\s+delete\b(?=.*(?:--yes|\s-y\b))` },
+    // Destructive SQL typed straight into a terminal client
+    { id: 'drop_database', category: 'destructive_sql', reason: 'DROP DATABASE', source: 'builtin',
+        pattern: String.raw `\bdrop\s+database\b` },
+    { id: 'drop_schema', category: 'destructive_sql', reason: 'DROP SCHEMA', source: 'builtin',
+        pattern: String.raw `\bdrop\s+schema\b` },
+];
+function escapeDotNetRegex(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Cached Shield mode from the runtime bundle cache (offline read, never network). */
+function cachedMode() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(RUNTIME_CACHE_PATH, 'utf8'));
+        const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
+        entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
+        const mode = entries[0]?.mode;
+        return mode === 'monitor' || mode === 'shadow' ? 'monitor' : 'block';
+    }
+    catch {
+        return 'block';
+    }
+}
+/**
+ * Built-in rule ids toggled OFF in the dashboard (local-safety snapshot cache).
+ * Rule ids match the deterministic guard's item ids, so one console toggle
+ * disables the rule in IDE hooks AND interactive terminals.
+ */
+function cachedDisabledItemIds() {
+    const disabled = new Set();
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const ids = parsed?.snapshot?.disabledBuiltInItemIds;
+                if (Array.isArray(ids)) {
+                    for (const id of ids) {
+                        if (typeof id === 'string' && id)
+                            disabled.add(id);
+                    }
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    return disabled;
+}
+/** Org custom block patterns from the cached local-safety snapshots (offline read). */
+function cachedCustomRules() {
+    const rules = [];
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const blocks = parsed?.snapshot?.customBlocks;
+                if (!Array.isArray(blocks))
+                    continue;
+                for (const block of blocks.slice(0, 100)) {
+                    if (!block || typeof block.pattern !== 'string' || !block.pattern.trim())
+                        continue;
+                    rules.push({
+                        id: String(block.id || block.pattern).slice(0, 120),
+                        category: String(block.categoryId || 'custom'),
+                        // Snapshot custom blocks are substring matches — escape into a literal regex.
+                        pattern: escapeDotNetRegex(block.pattern.trim()),
+                        reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
+                        source: 'custom',
+                    });
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    // Dedupe by id+pattern.
+    const seen = new Set();
+    return rules.filter(rule => {
+        const key = `${rule.id}|${rule.pattern}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+function writeShellGuardRules() {
+    const disabled = cachedDisabledItemIds();
+    const data = {
+        updatedAt: new Date().toISOString(),
+        mode: cachedMode(),
+        rules: [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()],
+    };
+    fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
+    return data;
+}
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+function refreshShellGuardRules() {
+    try {
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return;
+        writeShellGuardRules();
+    }
+    catch { /* best-effort */ }
+}
+function psQuote(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/** The profile guard script. Placeholders are substituted at install time. */
+function buildGuardPs1(nodePath, cliEntry) {
+    const lines = [
+        `# FullCourtDefense interactive shell guard (installed by fullcourtdefense-cli).`,
+        `# Blocks dangerous commands typed in PowerShell using the org's cached rules.`,
+        `# Disable for one session:  $env:FCD_SHELL_GUARD = 'off'`,
+        `# Remove permanently:       fullcourtdefense uninstall-shell-guard`,
+        ``,
+        `$global:FcdRulesPath = ${psQuote(GUARD_RULES_PATH)}`,
+        `$global:FcdSpoolPath = ${psQuote(SPOOL_PATH)}`,
+        `$global:FcdNodePath  = ${psQuote(nodePath)}`,
+        `$global:FcdCliEntry  = ${psQuote(cliEntry)}`,
+        `$global:FcdGuardMode = 'block'`,
+        `$global:FcdGuardRules = @()`,
+        ``,
+        `try {`,
+        `  if (Test-Path $global:FcdRulesPath) {`,
+        `    $fcdRaw = Get-Content -Raw -Path $global:FcdRulesPath | ConvertFrom-Json`,
+        `    if ($fcdRaw.mode -eq 'monitor') { $global:FcdGuardMode = 'monitor' }`,
+        `    $global:FcdGuardRules = @($fcdRaw.rules | ForEach-Object {`,
+        `      try {`,
+        `        [pscustomobject]@{`,
+        `          Id       = [string]$_.id`,
+        `          Category = [string]$_.category`,
+        `          Reason   = [string]$_.reason`,
+        `          Source   = [string]$_.source`,
+        `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
+        `        }`,
+        `      } catch { $null }`,
+        `    } | Where-Object { $null -ne $_ })`,
+        `  }`,
+        `} catch { $global:FcdGuardRules = @() }`,
+        ``,
+        `function global:Test-FcdShellGuard {`,
+        `  param([string]$CommandLine)`,
+        `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
+        `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  foreach ($rule in $global:FcdGuardRules) {`,
+        `    try {`,
+        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) { return $rule }`,
+        `    } catch { }`,
+        `  }`,
+        `  return $null`,
+        `}`,
+        ``,
+        `function global:Write-FcdGuardEvent {`,
+        `  param($Rule, [string]$CommandLine, [string]$Decision)`,
+        `  try {`,
+        `    $evidence = $CommandLine.Trim()`,
+        `    if ($evidence.Length -gt 180) { $evidence = $evidence.Substring(0, 180) + '...' }`,
+        `    $event = [pscustomobject]@{`,
+        `      eventId    = [guid]::NewGuid().ToString()`,
+        `      type       = 'verdict'`,
+        `      decision   = $Decision`,
+        `      toolName   = 'powershell_terminal'`,
+        `      operation  = 'shell_command'`,
+        `      reason     = ('Shell guard: ' + $Rule.Reason)`,
+        `      ruleId     = $Rule.Id`,
+        `      category   = $Rule.Category`,
+        `      source     = $Rule.Source`,
+        `      evidence   = $evidence`,
+        `      occurredAt = (Get-Date).ToUniversalTime().ToString('o')`,
+        `    }`,
+        `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,
+        `    [System.IO.File]::AppendAllText($global:FcdSpoolPath, (($event | ConvertTo-Json -Compress) + "\`n"), (New-Object System.Text.UTF8Encoding($false)))`,
+        `    if ((Test-Path $global:FcdNodePath) -and (Test-Path $global:FcdCliEntry)) {`,
+        `      Start-Process -FilePath $global:FcdNodePath -ArgumentList @($global:FcdCliEntry, 'flush-spool', '--heartbeat', 'true') -WindowStyle Hidden -ErrorAction SilentlyContinue | Out-Null`,
+        `    }`,
+        `  } catch { }`,
+        `}`,
+        ``,
+        `# Hook the Enter key only in interactive PSReadLine hosts (consoles, IDE terminals).`,
+        `# try/catch: in non-interactive hosts PSReadLine can be present but uninitialized.`,
+        `try {`,
+        `if ($env:FCD_SHELL_GUARD -ne 'off' -and (Get-Command Set-PSReadLineKeyHandler -ErrorAction SilentlyContinue)) {`,
+        `  Set-PSReadLineKeyHandler -Key Enter -BriefDescription 'FCDShellGuard' -Description 'FullCourtDefense dangerous-command guard' -ScriptBlock {`,
+        `    param($key, $arg)`,
+        `    $line = $null`,
+        `    $cursor = $null`,
+        `    try { [Microsoft.PowerShell.PSConsoleReadLine]::GetBufferState([ref]$line, [ref]$cursor) } catch { }`,
+        `    $hit = $null`,
+        `    if ($line -and $env:FCD_SHELL_GUARD -ne 'off') {`,
+        `      try { $hit = Test-FcdShellGuard -CommandLine $line } catch { $hit = $null }`,
+        `    }`,
+        `    if ($null -ne $hit) {`,
+        `      if ($global:FcdGuardMode -eq 'monitor') {`,
+        `        Write-Host ''`,
+        `        Write-Host ('[FullCourtDefense] monitor: would block - ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow'`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `        return`,
+        `      }`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
+        `      Write-Host ''`,
+        `      Write-Host ('[FullCourtDefense] BLOCKED: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
+        `      Write-Host 'This command was not executed. Reported to your security dashboard.' -ForegroundColor DarkGray`,
+        `      Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block'`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `      return`,
+        `    }`,
+        `    [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `  }`,
+        `}`,
+        `} catch { }`,
+        ``,
+    ];
+    return lines.join('\r\n');
+}
+/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
+function resolveProfilePaths() {
+    const out = [];
+    for (const engine of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
+                encoding: 'utf8', windowsHide: true, timeout: 15000,
+            });
+            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
+            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
+                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
+            }
+        }
+        catch { /* engine not installed */ }
+    }
+    // Dedupe (both engines can share a profile only if paths match — normally they differ).
+    const seen = new Set();
+    return out.filter(entry => {
+        const key = entry.profilePath.toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function profileSnippet() {
+    return [
+        MARKER_START,
+        `# Loads the FullCourtDefense dangerous-command guard for interactive sessions.`,
+        `if (Test-Path ${psQuote(GUARD_PS1_PATH)}) { . ${psQuote(GUARD_PS1_PATH)} }`,
+        MARKER_END,
+    ].join('\r\n');
+}
+function addSnippetToProfile(profilePath) {
+    fs.mkdirSync(path.dirname(profilePath), { recursive: true });
+    let content = '';
+    try {
+        content = fs.readFileSync(profilePath, 'utf8');
+    }
+    catch { /* new profile */ }
+    if (content.includes(MARKER_START))
+        return 'already';
+    const sep = content && !content.endsWith('\n') ? '\r\n\r\n' : content ? '\r\n' : '';
+    fs.writeFileSync(profilePath, content + sep + profileSnippet() + '\r\n', 'utf8');
+    return 'installed';
+}
+function removeSnippetFromProfile(profilePath) {
+    try {
+        const content = fs.readFileSync(profilePath, 'utf8');
+        const start = content.indexOf(MARKER_START);
+        const end = content.indexOf(MARKER_END);
+        if (start === -1 || end === -1)
+            return false;
+        const cleaned = (content.slice(0, start) + content.slice(end + MARKER_END.length)).replace(/(\r?\n){3,}/g, '\r\n\r\n');
+        fs.writeFileSync(profilePath, cleaned, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+function getShellGuardStatus() {
+    if (process.platform !== 'win32') {
+        return { supported: false, installed: false, profiles: [], rulesPresent: false };
+    }
+    try {
+        const profiles = resolveProfilePaths().map(entry => {
+            let installed = false;
+            try {
+                installed = fs.readFileSync(entry.profilePath, 'utf8').includes(MARKER_START);
+            }
+            catch { /* no profile */ }
+            return { ...entry, installed };
+        });
+        let ruleCount;
+        let mode;
+        let rulesPresent = false;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(GUARD_RULES_PATH, 'utf8'));
+            rulesPresent = Array.isArray(parsed?.rules) && parsed.rules.length > 0;
+            ruleCount = Array.isArray(parsed?.rules) ? parsed.rules.length : undefined;
+            mode = typeof parsed?.mode === 'string' ? parsed.mode : undefined;
+        }
+        catch { /* not written yet */ }
+        return {
+            supported: true,
+            installed: profiles.some(p => p.installed) && fs.existsSync(GUARD_PS1_PATH),
+            profiles,
+            rulesPresent,
+            ruleCount,
+            mode,
+        };
+    }
+    catch {
+        return { supported: true, installed: false, profiles: [], rulesPresent: false };
+    }
+}
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+function isShellGuardInstalled() {
+    try {
+        if (process.platform !== 'win32')
+            return false;
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return false;
+        // Cheap check: at least one known profile contains the marker. Avoid
+        // spawning PowerShell on the heartbeat path — check well-known locations.
+        const candidates = [
+            path.join(os.homedir(), 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'Documents', 'PowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'PowerShell', 'profile.ps1'),
+        ];
+        for (const candidate of candidates) {
+            try {
+                if (fs.readFileSync(candidate, 'utf8').includes(MARKER_START))
+                    return true;
+            }
+            catch { /* keep looking */ }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+async function installShellGuardCommand(args = {}) {
+    if (process.platform !== 'win32') {
+        console.log('The interactive shell guard currently supports Windows PowerShell. macOS/Linux (bash/zsh preexec) is planned.');
+        return;
+    }
+    const rules = writeShellGuardRules();
+    const nodePath = process.execPath;
+    const cliEntry = process.argv[1] || '';
+    fs.writeFileSync(GUARD_PS1_PATH, buildGuardPs1(nodePath, cliEntry), 'utf8');
+    console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
+    if (args.profiles === 'false') {
+        console.log('Skipped profile wiring (--profiles false): guard script + rules written only.');
+        return;
+    }
+    const profiles = resolveProfilePaths();
+    if (profiles.length === 0) {
+        console.log('\x1b[33m⚠ Could not resolve any PowerShell profile path — guard script written but not wired into a profile.\x1b[0m');
+        return;
+    }
+    for (const profile of profiles) {
+        try {
+            const outcome = addSnippetToProfile(profile.profilePath);
+            console.log(outcome === 'installed'
+                ? `\x1b[32m✓ ${profile.engine}: guard added to profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`
+                : `\x1b[32m✓ ${profile.engine}: guard already in profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`);
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ ${profile.engine}: could not update profile (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
+        }
+    }
+    console.log('\x1b[2mTakes effect in NEW PowerShell windows. Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+}
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+async function uninstallShellGuardCommand() {
+    if (process.platform !== 'win32') {
+        console.log('Nothing to remove on this OS.');
+        return;
+    }
+    let removed = 0;
+    for (const profile of resolveProfilePaths()) {
+        if (removeSnippetFromProfile(profile.profilePath)) {
+            removed++;
+            console.log(`Removed guard from ${profile.engine} profile (${profile.profilePath}).`);
+        }
+    }
+    try {
+        fs.unlinkSync(GUARD_PS1_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(GUARD_RULES_PATH);
+    }
+    catch { /* not present */ }
+    console.log(removed > 0 ? 'Shell guard uninstalled. Open shells keep the guard until closed.' : 'Shell guard was not installed in any profile.');
+}

package/dist/commands/windowsAudit.d.ts

@@ -12,6 +12,8 @@ export interface ShellAuditReport {
     scriptBlockLogging: boolean;
     transcription: boolean;
     transcriptionPath?: string;
+    /** Interactive PowerShell profile guard installed (real-time blocking of typed commands). */
+    profileGuard?: boolean;
     checkedAt: string;
 }
 /** Probe current audit coverage. Read-only, no elevation needed, never throws. */

package/dist/commands/windowsAudit.js

@@ -41,6 +41,7 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const shellGuard_1 = require("./shellGuard");
 /**
  * Windows PowerShell audit coverage — ScriptBlock Logging + Transcription.
  *
@@ -119,6 +120,7 @@ function getShellAuditReport() {
             scriptBlockLogging: status.scriptBlockLogging,
             transcription: status.transcription,
             transcriptionPath: status.transcriptionPath,
+            profileGuard: (0, shellGuard_1.isShellGuardInstalled)(),
             checkedAt: status.checkedAt,
         };
     }

package/dist/index.js

@@ -51,6 +51,7 @@ const mcpGateway_1 = require("./commands/mcpGateway");
 const installAll_1 = require("./commands/installAll");
 const autoProtect_1 = require("./commands/autoProtect");
 const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -126,6 +127,9 @@ function printHelp() {
     install     Alias for install-all.
     windows-audit  Show Windows PowerShell audit coverage (ScriptBlock Logging +
                 Transcription). Use --enable to turn it on (one admin prompt).
+    install-shell-guard    Block dangerous commands typed in PowerShell terminals
+                (real-time, offline rule cache). uninstall-shell-guard removes it;
+                shell-guard-status shows coverage.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
@@ -605,6 +609,29 @@ async function main() {
             await (0, windowsAudit_1.windowsAuditCommand)(args);
             break;
         }
+        case 'install-shell-guard': {
+            await (0, shellGuard_1.installShellGuardCommand)({ profiles: flags.profiles });
+            break;
+        }
+        case 'uninstall-shell-guard': {
+            await (0, shellGuard_1.uninstallShellGuardCommand)();
+            break;
+        }
+        case 'shell-guard-status': {
+            const status = (0, shellGuard_1.getShellGuardStatus)();
+            if (!status.supported) {
+                console.log('Shell guard supports Windows PowerShell (bash/zsh planned).');
+                break;
+            }
+            console.log(`\nInteractive PowerShell shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+            for (const profile of status.profiles) {
+                console.log(`  ${profile.engine}: ${profile.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${profile.profilePath}\x1b[0m`);
+            }
+            if (status.rulesPresent)
+                console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+            console.log('');
+            break;
+        }
         case 'install-mcp-gateway': {
             await (0, mcpGateway_1.installMcpGatewayCommand)(buildInstallArgs(), config);
             break;

package/dist/telemetry.js

@@ -43,6 +43,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
 const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -109,6 +110,9 @@ function rewriteSpool(remaining) {
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */
 async function flushSpool(input) {
+    // Piggyback on the flush cycle to re-sync the interactive shell guard's rule
+    // cache (mode flips + new custom rules reach open-terminal machines in ~30s).
+    (0, shellGuard_1.refreshShellGuardRules)();
     const all = readSpool();
     const batch = all.slice(0, MAX_BATCH);
     const overflow = all.slice(MAX_BATCH);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.9.0"
+  "version": "1.10.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -17,6 +17,7 @@
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
+    "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },