fullcourtdefense-cli 1.9.0 → 1.11.0

package/dist/commands/cmdGuard.d.ts

@@ -0,0 +1,20 @@
+export interface CmdGuardStatus {
+    supported: boolean;
+    installed: boolean;
+    autorunValue?: string;
+    rulesPresent: boolean;
+    ruleCount?: number;
+    mode?: string;
+}
+export declare function isCmdGuardInstalled(): boolean;
+export declare function getCmdGuardStatus(): CmdGuardStatus;
+export interface InstallCmdGuardArgs {
+    /** Reserved for future use. */
+    profiles?: string;
+}
+/** `fullcourtdefense install-cmd-guard` — enable interactive cmd.exe blocking. */
+export declare function installCmdGuardCommand(_args?: InstallCmdGuardArgs): Promise<void>;
+/** `fullcourtdefense uninstall-cmd-guard` */
+export declare function uninstallCmdGuardCommand(): Promise<void>;
+/** Refresh shared rules JSON when cmd guard is installed. */
+export declare function refreshCmdGuardRules(): void;

package/dist/commands/cmdGuard.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCmdGuardInstalled = isCmdGuardInstalled;
+exports.getCmdGuardStatus = getCmdGuardStatus;
+exports.installCmdGuardCommand = installCmdGuardCommand;
+exports.uninstallCmdGuardCommand = uninstallCmdGuardCommand;
+exports.refreshCmdGuardRules = refreshCmdGuardRules;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const shellGuard_1 = require("./shellGuard");
+/**
+ * Interactive cmd.exe guard — blocks dangerous commands TYPED in Command Prompt.
+ *
+ * cmd.exe has no PSReadLine/preexec hook. We use the supported AutoRun registry
+ * value + doskey macros: every new cmd session registers macros for high-risk
+ * command names (del, erase, rd, curl, …) that delegate to a Node checker
+ * sharing the same rules JSON as the PowerShell guard.
+ *
+ * Allowed commands run via `cmd /d /c` so AutoRun is not re-triggered (no loop).
+ * Interactive cmd only — `cmd /c del ...` from scripts bypasses doskey by design.
+ */
+const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
+const GUARD_JS_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-guard.js');
+const AUTORUN_BAT_PATH = path.join(os.homedir(), '.fullcourtdefense-cmd-autorun.bat');
+const CMD_AUTORUN_KEY = 'HKCU\\Software\\Microsoft\\Command Processor';
+const AUTORUN_VALUE = 'AutoRun';
+const AUTORUN_MARKER = 'fullcourtdefense-cmd-autorun.bat';
+/** cmd builtins / exes we intercept via doskey (first token of the typed line). */
+const INTERCEPTED_COMMANDS = [
+    'del', 'erase', 'rd', 'rmdir', 'format',
+    'curl', 'wget', 'powershell', 'pwsh',
+    'terraform', 'kubectl', 'aws', 'gcloud', 'az',
+    'vssadmin', 'certutil', 'bitsadmin', 'reg', 'net', 'sc',
+];
+function regString(key, value) {
+    try {
+        const out = (0, child_process_1.execFileSync)('reg', ['query', key, '/v', value], {
+            encoding: 'utf8', windowsHide: true, timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const match = out.match(new RegExp(`${value}\\s+REG_(?:EXPAND_)?SZ\\s+(.+)`));
+        return match ? match[1].trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function setRegString(key, valueName, data) {
+    (0, child_process_1.execFileSync)('reg', ['add', key, '/v', valueName, '/t', 'REG_SZ', '/d', data, '/f'], {
+        windowsHide: true, timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
+    });
+}
+function batQuote(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+function buildGuardJs(nodePath, cliEntry) {
+    return [
+        `'use strict';`,
+        `const fs=require('fs');const os=require('os');const path=require('path');const{spawnSync}=require('child_process');const crypto=require('crypto');`,
+        `const RULES_PATH=${JSON.stringify(GUARD_RULES_PATH)};`,
+        `const SPOOL_PATH=${JSON.stringify(path.join(os.homedir(), '.fullcourtdefense-spool.jsonl'))};`,
+        `const NODE_PATH=${JSON.stringify(nodePath)};`,
+        `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
+        `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,reason:r.reason,source:r.source,re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='monitor'?'monitor':'block',rules};}catch{return{mode:'block',rules:[]};}}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();for(const r of rules){try{if(r.re.test(n)||r.re.test(line))return r;}catch{}}return null;}`,
+        `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
+        `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
+        `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
+        `const line=args.join(' ');const{mode,rules}=loadRules();const hit=matchLine(line,rules);`,
+        `if(!hit)delegate(args);`,
+        `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: would block - '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'allow');delegate(args);}`,
+        `console.error('[FullCourtDefense] BLOCKED: '+hit.reason+' (rule '+hit.id+')');`,
+        `console.error('This command was not executed. Reported to your security dashboard.');`,
+        `spoolEvent(hit,line,'block');process.exit(1);`,
+        ``,
+    ].join('\n');
+}
+function buildAutorunBat(nodePath) {
+    const guardJs = batQuote(GUARD_JS_PATH);
+    const node = batQuote(nodePath);
+    const doskeyLines = INTERCEPTED_COMMANDS.map(cmd => `doskey ${cmd}=${node} ${guardJs} ${cmd} $*`);
+    return [
+        '@echo off',
+        'REM FullCourtDefense cmd.exe guard (installed by fullcourtdefense-cli).',
+        'REM Disable for one session: set FCD_CMD_GUARD=off',
+        'REM Remove permanently: fullcourtdefense uninstall-cmd-guard',
+        'if defined FCD_CMD_AUTORUN_DONE goto :eof',
+        'set FCD_CMD_AUTORUN_DONE=1',
+        ...doskeyLines,
+        '',
+    ].join('\r\n');
+}
+function readCurrentAutorun() {
+    return regString(CMD_AUTORUN_KEY, AUTORUN_VALUE) || '';
+}
+function mergeAutorunValue(current) {
+    const ours = batQuote(AUTORUN_BAT_PATH);
+    const cleaned = stripAutorunValue(current);
+    if (!cleaned.trim())
+        return ours;
+    if (cleaned.includes(AUTORUN_MARKER))
+        return ours;
+    return `${ours} & ${cleaned}`;
+}
+function stripAutorunValue(current) {
+    const ours = batQuote(AUTORUN_BAT_PATH);
+    let next = current
+        .replace(new RegExp(`${ours.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*&\\s*`, 'gi'), '')
+        .replace(new RegExp(`\\s*&\\s*${ours.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`, 'gi'), '')
+        .replace(ours, '')
+        .replace(/^\s*&\s*|\s*&\s*$/g, '')
+        .trim();
+    return next;
+}
+function isCmdGuardInstalled() {
+    try {
+        if (process.platform !== 'win32')
+            return false;
+        if (!fs.existsSync(GUARD_JS_PATH) || !fs.existsSync(AUTORUN_BAT_PATH))
+            return false;
+        return readCurrentAutorun().includes(AUTORUN_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+function getCmdGuardStatus() {
+    if (process.platform !== 'win32') {
+        return { supported: false, installed: false, rulesPresent: false };
+    }
+    try {
+        let ruleCount;
+        let mode;
+        let rulesPresent = false;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(GUARD_RULES_PATH, 'utf8'));
+            rulesPresent = Array.isArray(parsed?.rules) && parsed.rules.length > 0;
+            ruleCount = Array.isArray(parsed?.rules) ? parsed.rules.length : undefined;
+            mode = typeof parsed?.mode === 'string' ? parsed.mode : undefined;
+        }
+        catch { /* not written yet */ }
+        const autorunValue = readCurrentAutorun();
+        return {
+            supported: true,
+            installed: isCmdGuardInstalled(),
+            autorunValue: autorunValue || undefined,
+            rulesPresent,
+            ruleCount,
+            mode,
+        };
+    }
+    catch {
+        return { supported: true, installed: false, rulesPresent: false };
+    }
+}
+/** `fullcourtdefense install-cmd-guard` — enable interactive cmd.exe blocking. */
+async function installCmdGuardCommand(_args = {}) {
+    if (process.platform !== 'win32') {
+        console.log('The cmd.exe guard currently supports Windows only.');
+        return;
+    }
+    const rules = (0, shellGuard_1.writeShellGuardRules)();
+    const nodePath = process.execPath;
+    const cliEntry = process.argv[1] || '';
+    fs.writeFileSync(GUARD_JS_PATH, buildGuardJs(nodePath, cliEntry), 'utf8');
+    fs.writeFileSync(AUTORUN_BAT_PATH, buildAutorunBat(nodePath), 'utf8');
+    console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
+    const current = readCurrentAutorun();
+    const merged = mergeAutorunValue(current);
+    setRegString(CMD_AUTORUN_KEY, AUTORUN_VALUE, merged);
+    console.log(`\x1b[32m✓ cmd.exe guard installed\x1b[0m \x1b[2m(AutoRun + doskey macros)\x1b[0m`);
+    console.log('\x1b[2mOpen a NEW Command Prompt window (prompt must be C:\\...> not PS C:\\...>). Dangerous commands like del /s /q C:\\ are blocked and reported.\x1b[0m');
+}
+/** `fullcourtdefense uninstall-cmd-guard` */
+async function uninstallCmdGuardCommand() {
+    if (process.platform !== 'win32') {
+        console.log('Nothing to remove on this OS.');
+        return;
+    }
+    const current = readCurrentAutorun();
+    const next = stripAutorunValue(current);
+    if (next) {
+        setRegString(CMD_AUTORUN_KEY, AUTORUN_VALUE, next);
+    }
+    else {
+        try {
+            (0, child_process_1.execFileSync)('reg', ['delete', CMD_AUTORUN_KEY, '/v', AUTORUN_VALUE, '/f'], {
+                windowsHide: true, timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'],
+            });
+        }
+        catch { /* value may already be absent */ }
+    }
+    try {
+        fs.unlinkSync(GUARD_JS_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(AUTORUN_BAT_PATH);
+    }
+    catch { /* not present */ }
+    console.log('cmd.exe guard uninstalled. Open cmd windows keep doskey until closed.');
+}
+/** Refresh shared rules JSON when cmd guard is installed. */
+function refreshCmdGuardRules() {
+    try {
+        if (!isCmdGuardInstalled())
+            return;
+        (0, shellGuard_1.writeShellGuardRules)();
+    }
+    catch { /* best-effort */ }
+}

package/dist/commands/installAll.d.ts

@@ -11,6 +11,8 @@ export interface InstallAllArgs extends ProtectAllArgs {
     autoProtect?: string;
     intervalMinutes?: string;
     windowsAudit?: string;
+    shellGuard?: string;
+    cmdGuard?: string;
 }
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor

package/dist/commands/installAll.js

@@ -10,6 +10,8 @@ const mcpGateway_1 = require("./mcpGateway");
 const autoProtect_1 = require("./autoProtect");
 const restartNotice_1 = require("./restartNotice");
 const windowsAudit_1 = require("./windowsAudit");
+const shellGuard_1 = require("./shellGuard");
+const cmdGuard_1 = require("./cmdGuard");
 /**
  * One-click install: discover/wrap every existing MCP server, install Cursor
  * hooks for built-in Cursor actions, optional self-heal and fleet upload.
@@ -93,6 +95,28 @@ async function installAllCommand(args, config) {
             console.log(`\x1b[33m⚠ Warning: PowerShell audit logging step failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
         }
     }
+    // Interactive PowerShell guard — blocks dangerous commands TYPED in a
+    // terminal (inside or outside the IDE) using the same rule families the IDE
+    // hooks enforce, from the local cache (no admin needed, no network hot path).
+    if (process.platform === 'win32' && args.shellGuard !== 'false') {
+        console.log('\n\x1b[1mInstalling interactive PowerShell shell guard…\x1b[0m');
+        try {
+            await (0, shellGuard_1.installShellGuardCommand)();
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: shell guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
+    // Interactive cmd.exe guard — same rules, doskey + AutoRun hook (no admin).
+    if (process.platform === 'win32' && args.cmdGuard !== 'false') {
+        console.log('\n\x1b[1mInstalling interactive cmd.exe shell guard…\x1b[0m');
+        try {
+            await (0, cmdGuard_1.installCmdGuardCommand)();
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ Warning: cmd guard install failed (${error instanceof Error ? error.message : String(error)}). Installation continues.\x1b[0m`);
+        }
+    }
     if (args.autoProtect === 'true') {
         console.log('\n\x1b[1mScheduling self-healing MCP protection…\x1b[0m');
         await (0, autoProtect_1.autoProtectCommand)({

package/dist/commands/shellGuard.d.ts

@@ -0,0 +1,46 @@
+export interface ShellGuardRule {
+    id: string;
+    category: string;
+    /** .NET-compatible regex, matched with IgnoreCase against the typed line. */
+    pattern: string;
+    reason: string;
+    source: 'builtin' | 'custom';
+}
+interface ShellGuardRulesFile {
+    updatedAt: string;
+    mode: 'block' | 'monitor';
+    rules: ShellGuardRule[];
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+export declare function writeShellGuardRules(): ShellGuardRulesFile;
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+export declare function refreshShellGuardRules(): void;
+export interface ShellGuardStatus {
+    supported: boolean;
+    installed: boolean;
+    profiles: Array<{
+        engine: string;
+        profilePath: string;
+        installed: boolean;
+    }>;
+    rulesPresent: boolean;
+    ruleCount?: number;
+    mode?: string;
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+export declare function getShellGuardStatus(): ShellGuardStatus;
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+export declare function isShellGuardInstalled(): boolean;
+export interface InstallShellGuardArgs {
+    /** 'false' to skip writing profile entries (rules + script only). */
+    profiles?: string;
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+export declare function installShellGuardCommand(args?: InstallShellGuardArgs): Promise<void>;
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+export declare function uninstallShellGuardCommand(): Promise<void>;
+export {};

package/dist/commands/shellGuard.js

@@ -0,0 +1,554 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeShellGuardRules = writeShellGuardRules;
+exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.getShellGuardStatus = getShellGuardStatus;
+exports.isShellGuardInstalled = isShellGuardInstalled;
+exports.installShellGuardCommand = installShellGuardCommand;
+exports.uninstallShellGuardCommand = uninstallShellGuardCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Interactive PowerShell guard — real-time blocking of dangerous commands
+ * TYPED by a human in a terminal (inside or outside the IDE).
+ *
+ * How it works:
+ *   - The CLI writes a ruleset JSON (~/.fullcourtdefense-shell-guard.json):
+ *     the same dangerous-command families the deterministic guard enforces on
+ *     agent tool calls (destructive filesystem, reverse shells, infra destroy,
+ *     credential exfiltration, …) plus the org's custom block patterns from the
+ *     cached local-safety snapshot, plus the Shield mode (block vs monitor).
+ *   - A profile script (~/.fullcourtdefense-shell-guard.ps1) is dot-sourced from
+ *     the user's PowerShell profiles (both Windows PowerShell 5.1 and pwsh 7).
+ *     It compiles the rules ONCE at shell startup and hooks the PSReadLine
+ *     Enter key: every submitted line is checked in-process (sub-millisecond —
+ *     no node/network on the hot path).
+ *   - Match in block mode → the line is cleared and never executes; monitor
+ *     mode → yellow warning, the command still runs. Either way the event is
+ *     appended to the telemetry spool and a detached flush reports it to the
+ *     fleet dashboard.
+ *   - Rules/mode refresh opportunistically on every telemetry flush (offline
+ *     caches only — never blocks a shell).
+ *
+ * Scope honesty: this covers INTERACTIVE PowerShell (PSReadLine hosts, incl.
+ * IDE-integrated terminals). Non-interactive scripts are covered by ScriptBlock
+ * Logging (windowsAudit.ts). Native cmd.exe is covered separately (cmdGuard.ts).
+ */
+const GUARD_RULES_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.json');
+const GUARD_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-shell-guard.ps1');
+const SPOOL_PATH = path.join(os.homedir(), '.fullcourtdefense-spool.jsonl');
+const RUNTIME_CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
+const SNAPSHOT_CACHE_DIR = path.join(os.homedir(), '.fullcourtdefense');
+const MARKER_START = '# >>> fullcourtdefense shell guard >>>';
+const MARKER_END = '# <<< fullcourtdefense shell guard <<<';
+/**
+ * Built-in dangerous-command rules — the shell-relevant subset of
+ * deterministicGuard.ts, expressed as .NET-compatible regexes (PowerShell
+ * compiles them with IgnoreCase). Item ids match the deterministic guard so
+ * dashboard events line up across IDE hooks and terminal blocks.
+ */
+const BUILTIN_RULES = [
+    // Destructive filesystem
+    { id: 'rm_rf_root', category: 'destructive_command', reason: 'recursive force delete of filesystem root', source: 'builtin',
+        pattern: String.raw `\b(?:sudo\s+)?rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?/["']?|\*)(?:\s|$|[;&|])` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Windows drive delete', source: 'builtin',
+        pattern: String.raw `\b(?:del|erase)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\?(?:\s|$|[\\/])` },
+    { id: 'windows_drive_rmdir', category: 'destructive_command', reason: 'recursive Windows drive remove directory', source: 'builtin',
+        pattern: String.raw `\b(?:rd|rmdir)\s+/[a-z]*s[a-z]*\s+/[a-z]*q[a-z]*\s+[a-z]:\\?(?:\s|$|[\\/])` },
+    { id: 'windows_drive_delete', category: 'destructive_command', reason: 'recursive Remove-Item on a drive root', source: 'builtin',
+        pattern: String.raw `\bremove-item\b(?=.*-recurse)(?=.*-force)(?=.*\s[a-z]:[\\/]?(?:\s|$))` },
+    { id: 'format_drive', category: 'destructive_command', reason: 'drive format command', source: 'builtin',
+        pattern: String.raw `(?<![-\w])(?:format(?:\.com)?\s+[a-z]:(?:\s|$)|format-volume\b(?=.*-driveletter))` },
+    { id: 'fork_bomb', category: 'destructive_command', reason: 'fork bomb', source: 'builtin',
+        pattern: String.raw `:\s*\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:` },
+    { id: 'mkfs_device', category: 'destructive_command', reason: 'filesystem format command', source: 'builtin',
+        pattern: String.raw `\bmkfs(?:\.[a-z0-9]+)?\s+/dev/` },
+    { id: 'dd_disk_overwrite', category: 'destructive_command', reason: 'raw disk overwrite command', source: 'builtin',
+        pattern: String.raw `\bdd\b(?=.*\bof=/dev/(?:sd|xvd|hd|nvme|disk))` },
+    { id: 'chmod_root_777', category: 'destructive_command', reason: 'recursive permission change on root', source: 'builtin',
+        pattern: String.raw `\bchmod\s+-r\s+777\s+/(?:\s|$)` },
+    { id: 'vssadmin_delete_shadows', category: 'destructive_command', reason: 'shadow copy deletion (ransomware pattern)', source: 'builtin',
+        pattern: String.raw `\bvssadmin\b(?=.*\bdelete\b)(?=.*\bshadows\b)` },
+    { id: 'defender_disable', category: 'destructive_command', reason: 'disabling Windows Defender real-time protection', source: 'builtin',
+        pattern: String.raw `\bset-mppreference\b(?=.*-disablerealtimemonitoring)(?=.*(?:\$true|\s1\b))` },
+    // Reverse shells / droppers
+    { id: 'bash_dev_tcp', category: 'reverse_shell', reason: 'bash reverse shell', source: 'builtin',
+        pattern: String.raw `\bbash\s+-i\b.*(?:/dev/tcp/)` },
+    { id: 'netcat_exec', category: 'reverse_shell', reason: 'netcat reverse shell', source: 'builtin',
+        pattern: String.raw `\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:/bin/)?(?:sh|bash|cmd(?:\.exe)?|powershell(?:\.exe)?)\b` },
+    { id: 'socat_exec', category: 'reverse_shell', reason: 'socat reverse shell', source: 'builtin',
+        pattern: String.raw `\bsocat\b.*\bexec:(?:/bin/)?(?:sh|bash)\b` },
+    { id: 'curl_pipe_shell', category: 'reverse_shell', reason: 'remote script piped to shell', source: 'builtin',
+        pattern: String.raw `\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b` },
+    { id: 'powershell_download_exec', category: 'reverse_shell', reason: 'download-and-execute (IEX + web download)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:iex\b|invoke-expression\b))(?=.*(?:downloadstring|net\.webclient|invoke-webrequest\b|\biwr\b|invoke-restmethod\b|\birm\b))` },
+    { id: 'python_socket_subprocess', category: 'reverse_shell', reason: 'python reverse shell', source: 'builtin',
+        pattern: String.raw `\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)` },
+    // Cloud metadata / credential exfiltration
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', reason: 'request to cloud metadata endpoint', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
+    { id: 'credential_exfiltration', category: 'secret_exfiltration', reason: 'credential file sent to the network', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
+    // Infra destroy
+    { id: 'terraform_destroy_auto', category: 'infra_destroy', reason: 'terraform destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bterraform\s+destroy\b(?=.*--auto-approve)` },
+    { id: 'pulumi_destroy_yes', category: 'infra_destroy', reason: 'pulumi destroy with auto-approve', source: 'builtin',
+        pattern: String.raw `\bpulumi\s+destroy\b(?=.*(?:--yes|\s-y\b))` },
+    { id: 'kubectl_delete_namespace', category: 'infra_destroy', reason: 'destructive kubectl namespace delete', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+namespace\b` },
+    { id: 'kubectl_delete_all_all', category: 'infra_destroy', reason: 'broad kubectl delete all', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\s+all\b(?=.*--all)` },
+    { id: 'gcloud_project_delete', category: 'infra_destroy', reason: 'GCP project deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
+    { id: 'gcloud_sql_delete', category: 'infra_destroy', reason: 'GCP SQL instance deletion', source: 'builtin',
+        pattern: String.raw `\bgcloud\s+sql\s+instances\s+delete\b` },
+    { id: 'aws_s3_recursive_rm', category: 'infra_destroy', reason: 'recursive S3 deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+s3\s+rm\s+s3://\S+\s+--recursive\b` },
+    { id: 'aws_cloudformation_delete_stack', category: 'infra_destroy', reason: 'CloudFormation stack deletion', source: 'builtin',
+        pattern: String.raw `\baws\s+cloudformation\s+delete-stack\b` },
+    { id: 'aws_iam_admin_policy', category: 'infra_destroy', reason: 'IAM administrator privilege grant', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)` },
+    { id: 'aws_iam_access_key', category: 'infra_destroy', reason: 'IAM access key creation', source: 'builtin',
+        pattern: String.raw `\baws\s+iam\s+create-access-key\b` },
+    { id: 'az_group_delete_yes', category: 'infra_destroy', reason: 'Azure resource group deletion', source: 'builtin',
+        pattern: String.raw `\baz\s+group\s+delete\b(?=.*(?:--yes|\s-y\b))` },
+    // Destructive SQL typed straight into a terminal client
+    { id: 'drop_database', category: 'destructive_sql', reason: 'DROP DATABASE', source: 'builtin',
+        pattern: String.raw `\bdrop\s+database\b` },
+    { id: 'drop_schema', category: 'destructive_sql', reason: 'DROP SCHEMA', source: 'builtin',
+        pattern: String.raw `\bdrop\s+schema\b` },
+];
+function escapeDotNetRegex(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Cached Shield mode from the runtime bundle cache (offline read, never network). */
+function cachedMode() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(RUNTIME_CACHE_PATH, 'utf8'));
+        const entries = Object.values(parsed).filter(e => e && typeof e === 'object');
+        entries.sort((a, b) => (b.fetchedAt || 0) - (a.fetchedAt || 0));
+        const mode = entries[0]?.mode;
+        return mode === 'monitor' || mode === 'shadow' ? 'monitor' : 'block';
+    }
+    catch {
+        return 'block';
+    }
+}
+/**
+ * Built-in rule ids toggled OFF in the dashboard (local-safety snapshot cache).
+ * Rule ids match the deterministic guard's item ids, so one console toggle
+ * disables the rule in IDE hooks AND interactive terminals.
+ */
+function cachedDisabledItemIds() {
+    const disabled = new Set();
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const ids = parsed?.snapshot?.disabledBuiltInItemIds;
+                if (Array.isArray(ids)) {
+                    for (const id of ids) {
+                        if (typeof id === 'string' && id)
+                            disabled.add(id);
+                    }
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    return disabled;
+}
+/** Org custom block patterns from the cached local-safety snapshots (offline read). */
+function cachedCustomRules() {
+    const rules = [];
+    try {
+        for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
+            if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
+                continue;
+            try {
+                const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
+                const blocks = parsed?.snapshot?.customBlocks;
+                if (!Array.isArray(blocks))
+                    continue;
+                for (const block of blocks.slice(0, 100)) {
+                    if (!block || typeof block.pattern !== 'string' || !block.pattern.trim())
+                        continue;
+                    rules.push({
+                        id: String(block.id || block.pattern).slice(0, 120),
+                        category: String(block.categoryId || 'custom'),
+                        // Snapshot custom blocks are substring matches — escape into a literal regex.
+                        pattern: escapeDotNetRegex(block.pattern.trim()),
+                        reason: typeof block.explanation === 'string' && block.explanation ? block.explanation : `matched custom safety pattern "${block.pattern.trim()}"`,
+                        source: 'custom',
+                    });
+                }
+            }
+            catch { /* skip malformed snapshot */ }
+        }
+    }
+    catch { /* no snapshot cache yet */ }
+    // Dedupe by id+pattern.
+    const seen = new Set();
+    return rules.filter(rule => {
+        const key = `${rule.id}|${rule.pattern}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
+function writeShellGuardRules() {
+    const disabled = cachedDisabledItemIds();
+    const data = {
+        updatedAt: new Date().toISOString(),
+        mode: cachedMode(),
+        rules: [...BUILTIN_RULES.filter(rule => !disabled.has(rule.id)), ...cachedCustomRules()],
+    };
+    fs.writeFileSync(GUARD_RULES_PATH, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
+    return data;
+}
+/**
+ * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
+ * console mode flip or new custom rule reaches interactive shells within ~30s.
+ * No-op unless the guard is installed. Never throws.
+ */
+function refreshShellGuardRules() {
+    try {
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return;
+        writeShellGuardRules();
+    }
+    catch { /* best-effort */ }
+}
+function psQuote(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+/** The profile guard script. Placeholders are substituted at install time. */
+function buildGuardPs1(nodePath, cliEntry) {
+    const lines = [
+        `# FullCourtDefense interactive shell guard (installed by fullcourtdefense-cli).`,
+        `# Blocks dangerous commands typed in PowerShell using the org's cached rules.`,
+        `# Disable for one session:  $env:FCD_SHELL_GUARD = 'off'`,
+        `# Remove permanently:       fullcourtdefense uninstall-shell-guard`,
+        ``,
+        `$global:FcdRulesPath = ${psQuote(GUARD_RULES_PATH)}`,
+        `$global:FcdSpoolPath = ${psQuote(SPOOL_PATH)}`,
+        `$global:FcdNodePath  = ${psQuote(nodePath)}`,
+        `$global:FcdCliEntry  = ${psQuote(cliEntry)}`,
+        `$global:FcdGuardMode = 'block'`,
+        `$global:FcdGuardRules = @()`,
+        ``,
+        `try {`,
+        `  if (Test-Path $global:FcdRulesPath) {`,
+        `    $fcdRaw = Get-Content -Raw -Path $global:FcdRulesPath | ConvertFrom-Json`,
+        `    if ($fcdRaw.mode -eq 'monitor') { $global:FcdGuardMode = 'monitor' }`,
+        `    $global:FcdGuardRules = @($fcdRaw.rules | ForEach-Object {`,
+        `      try {`,
+        `        [pscustomobject]@{`,
+        `          Id       = [string]$_.id`,
+        `          Category = [string]$_.category`,
+        `          Reason   = [string]$_.reason`,
+        `          Source   = [string]$_.source`,
+        `          Regex    = [regex]::new([string]$_.pattern, 'IgnoreCase')`,
+        `        }`,
+        `      } catch { $null }`,
+        `    } | Where-Object { $null -ne $_ })`,
+        `  }`,
+        `} catch { $global:FcdGuardRules = @() }`,
+        ``,
+        `function global:Test-FcdShellGuard {`,
+        `  param([string]$CommandLine)`,
+        `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
+        `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  foreach ($rule in $global:FcdGuardRules) {`,
+        `    try {`,
+        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) { return $rule }`,
+        `    } catch { }`,
+        `  }`,
+        `  return $null`,
+        `}`,
+        ``,
+        `function global:Write-FcdGuardEvent {`,
+        `  param($Rule, [string]$CommandLine, [string]$Decision)`,
+        `  try {`,
+        `    $evidence = $CommandLine.Trim()`,
+        `    if ($evidence.Length -gt 180) { $evidence = $evidence.Substring(0, 180) + '...' }`,
+        `    $event = [pscustomobject]@{`,
+        `      eventId    = [guid]::NewGuid().ToString()`,
+        `      type       = 'verdict'`,
+        `      decision   = $Decision`,
+        `      toolName   = 'powershell_terminal'`,
+        `      operation  = 'shell_command'`,
+        `      reason     = ('Shell guard: ' + $Rule.Reason)`,
+        `      ruleId     = $Rule.Id`,
+        `      category   = $Rule.Category`,
+        `      source     = $Rule.Source`,
+        `      evidence   = $evidence`,
+        `      occurredAt = (Get-Date).ToUniversalTime().ToString('o')`,
+        `    }`,
+        `    # BOM-free UTF8 append — PS5's Add-Content -Encoding utf8 writes a BOM that breaks JSONL parsing.`,
+        `    [System.IO.File]::AppendAllText($global:FcdSpoolPath, (($event | ConvertTo-Json -Compress) + "\`n"), (New-Object System.Text.UTF8Encoding($false)))`,
+        `    if ((Test-Path $global:FcdNodePath) -and (Test-Path $global:FcdCliEntry)) {`,
+        `      Start-Process -FilePath $global:FcdNodePath -ArgumentList @($global:FcdCliEntry, 'flush-spool', '--heartbeat', 'true') -WindowStyle Hidden -ErrorAction SilentlyContinue | Out-Null`,
+        `    }`,
+        `  } catch { }`,
+        `}`,
+        ``,
+        `# Hook the Enter key only in interactive PSReadLine hosts (consoles, IDE terminals).`,
+        `# try/catch: in non-interactive hosts PSReadLine can be present but uninitialized.`,
+        `try {`,
+        `if ($env:FCD_SHELL_GUARD -ne 'off' -and (Get-Command Set-PSReadLineKeyHandler -ErrorAction SilentlyContinue)) {`,
+        `  Set-PSReadLineKeyHandler -Key Enter -BriefDescription 'FCDShellGuard' -Description 'FullCourtDefense dangerous-command guard' -ScriptBlock {`,
+        `    param($key, $arg)`,
+        `    $line = $null`,
+        `    $cursor = $null`,
+        `    try { [Microsoft.PowerShell.PSConsoleReadLine]::GetBufferState([ref]$line, [ref]$cursor) } catch { }`,
+        `    $hit = $null`,
+        `    if ($line -and $env:FCD_SHELL_GUARD -ne 'off') {`,
+        `      try { $hit = Test-FcdShellGuard -CommandLine $line } catch { $hit = $null }`,
+        `    }`,
+        `    if ($null -ne $hit) {`,
+        `      if ($global:FcdGuardMode -eq 'monitor') {`,
+        `        Write-Host ''`,
+        `        Write-Host ('[FullCourtDefense] monitor: would block - ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'allow'`,
+        `        [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `        return`,
+        `      }`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::RevertLine()`,
+        `      Write-Host ''`,
+        `      Write-Host ('[FullCourtDefense] BLOCKED: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
+        `      Write-Host 'This command was not executed. Reported to your security dashboard.' -ForegroundColor DarkGray`,
+        `      Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block'`,
+        `      [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `      return`,
+        `    }`,
+        `    [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,
+        `  }`,
+        `}`,
+        `} catch { }`,
+        ``,
+    ];
+    return lines.join('\r\n');
+}
+/** Resolve each PowerShell engine's CurrentUserAllHosts profile path. */
+function resolveProfilePaths() {
+    const out = [];
+    for (const engine of ['powershell.exe', 'pwsh.exe']) {
+        try {
+            const result = (0, child_process_1.spawnSync)(engine, ['-NoProfile', '-NonInteractive', '-Command', 'Write-Output $PROFILE.CurrentUserAllHosts'], {
+                encoding: 'utf8', windowsHide: true, timeout: 15000,
+            });
+            const profilePath = (result.stdout || '').trim().split(/\r?\n/).pop()?.trim();
+            if (result.status === 0 && profilePath && /\.ps1$/i.test(profilePath)) {
+                out.push({ engine: engine.replace(/\.exe$/i, ''), profilePath });
+            }
+        }
+        catch { /* engine not installed */ }
+    }
+    // Dedupe (both engines can share a profile only if paths match — normally they differ).
+    const seen = new Set();
+    return out.filter(entry => {
+        const key = entry.profilePath.toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function profileSnippet() {
+    return [
+        MARKER_START,
+        `# Loads the FullCourtDefense dangerous-command guard for interactive sessions.`,
+        `if (Test-Path ${psQuote(GUARD_PS1_PATH)}) { . ${psQuote(GUARD_PS1_PATH)} }`,
+        MARKER_END,
+    ].join('\r\n');
+}
+function addSnippetToProfile(profilePath) {
+    fs.mkdirSync(path.dirname(profilePath), { recursive: true });
+    let content = '';
+    try {
+        content = fs.readFileSync(profilePath, 'utf8');
+    }
+    catch { /* new profile */ }
+    if (content.includes(MARKER_START))
+        return 'already';
+    const sep = content && !content.endsWith('\n') ? '\r\n\r\n' : content ? '\r\n' : '';
+    fs.writeFileSync(profilePath, content + sep + profileSnippet() + '\r\n', 'utf8');
+    return 'installed';
+}
+function removeSnippetFromProfile(profilePath) {
+    try {
+        const content = fs.readFileSync(profilePath, 'utf8');
+        const start = content.indexOf(MARKER_START);
+        const end = content.indexOf(MARKER_END);
+        if (start === -1 || end === -1)
+            return false;
+        const cleaned = (content.slice(0, start) + content.slice(end + MARKER_END.length)).replace(/(\r?\n){3,}/g, '\r\n\r\n');
+        fs.writeFileSync(profilePath, cleaned, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Probe whether the profile guard is installed. Read-only, never throws. */
+function getShellGuardStatus() {
+    if (process.platform !== 'win32') {
+        return { supported: false, installed: false, profiles: [], rulesPresent: false };
+    }
+    try {
+        const profiles = resolveProfilePaths().map(entry => {
+            let installed = false;
+            try {
+                installed = fs.readFileSync(entry.profilePath, 'utf8').includes(MARKER_START);
+            }
+            catch { /* no profile */ }
+            return { ...entry, installed };
+        });
+        let ruleCount;
+        let mode;
+        let rulesPresent = false;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(GUARD_RULES_PATH, 'utf8'));
+            rulesPresent = Array.isArray(parsed?.rules) && parsed.rules.length > 0;
+            ruleCount = Array.isArray(parsed?.rules) ? parsed.rules.length : undefined;
+            mode = typeof parsed?.mode === 'string' ? parsed.mode : undefined;
+        }
+        catch { /* not written yet */ }
+        return {
+            supported: true,
+            installed: profiles.some(p => p.installed) && fs.existsSync(GUARD_PS1_PATH),
+            profiles,
+            rulesPresent,
+            ruleCount,
+            mode,
+        };
+    }
+    catch {
+        return { supported: true, installed: false, profiles: [], rulesPresent: false };
+    }
+}
+/** Lightweight boolean for the telemetry heartbeat / discovery report. */
+function isShellGuardInstalled() {
+    try {
+        if (process.platform !== 'win32')
+            return false;
+        if (!fs.existsSync(GUARD_PS1_PATH))
+            return false;
+        // Cheap check: at least one known profile contains the marker. Avoid
+        // spawning PowerShell on the heartbeat path — check well-known locations.
+        const candidates = [
+            path.join(os.homedir(), 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'Documents', 'PowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'WindowsPowerShell', 'profile.ps1'),
+            path.join(os.homedir(), 'OneDrive', 'Documents', 'PowerShell', 'profile.ps1'),
+        ];
+        for (const candidate of candidates) {
+            try {
+                if (fs.readFileSync(candidate, 'utf8').includes(MARKER_START))
+                    return true;
+            }
+            catch { /* keep looking */ }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
+async function installShellGuardCommand(args = {}) {
+    if (process.platform !== 'win32') {
+        console.log('The interactive shell guard currently supports Windows PowerShell. macOS/Linux (bash/zsh preexec) is planned.');
+        return;
+    }
+    const rules = writeShellGuardRules();
+    const nodePath = process.execPath;
+    const cliEntry = process.argv[1] || '';
+    fs.writeFileSync(GUARD_PS1_PATH, buildGuardPs1(nodePath, cliEntry), 'utf8');
+    console.log(`Guard rules written: ${rules.rules.length} rule(s), mode "${rules.mode}".`);
+    if (args.profiles === 'false') {
+        console.log('Skipped profile wiring (--profiles false): guard script + rules written only.');
+        return;
+    }
+    const profiles = resolveProfilePaths();
+    if (profiles.length === 0) {
+        console.log('\x1b[33m⚠ Could not resolve any PowerShell profile path — guard script written but not wired into a profile.\x1b[0m');
+        return;
+    }
+    for (const profile of profiles) {
+        try {
+            const outcome = addSnippetToProfile(profile.profilePath);
+            console.log(outcome === 'installed'
+                ? `\x1b[32m✓ ${profile.engine}: guard added to profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`
+                : `\x1b[32m✓ ${profile.engine}: guard already in profile\x1b[0m \x1b[2m(${profile.profilePath})\x1b[0m`);
+        }
+        catch (error) {
+            console.log(`\x1b[33m⚠ ${profile.engine}: could not update profile (${error instanceof Error ? error.message : String(error)})\x1b[0m`);
+        }
+    }
+    console.log('\x1b[2mTakes effect in NEW PowerShell windows. Dangerous typed commands are blocked (or warned in monitor mode) and reported to the fleet dashboard.\x1b[0m');
+}
+/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
+async function uninstallShellGuardCommand() {
+    if (process.platform !== 'win32') {
+        console.log('Nothing to remove on this OS.');
+        return;
+    }
+    let removed = 0;
+    for (const profile of resolveProfilePaths()) {
+        if (removeSnippetFromProfile(profile.profilePath)) {
+            removed++;
+            console.log(`Removed guard from ${profile.engine} profile (${profile.profilePath}).`);
+        }
+    }
+    try {
+        fs.unlinkSync(GUARD_PS1_PATH);
+    }
+    catch { /* not present */ }
+    try {
+        fs.unlinkSync(GUARD_RULES_PATH);
+    }
+    catch { /* not present */ }
+    console.log(removed > 0 ? 'Shell guard uninstalled. Open shells keep the guard until closed.' : 'Shell guard was not installed in any profile.');
+}

package/dist/commands/windowsAudit.d.ts

@@ -12,6 +12,8 @@ export interface ShellAuditReport {
     scriptBlockLogging: boolean;
     transcription: boolean;
     transcriptionPath?: string;
+    /** Interactive PowerShell profile guard installed (real-time blocking of typed commands). */
+    profileGuard?: boolean;
     checkedAt: string;
 }
 /** Probe current audit coverage. Read-only, no elevation needed, never throws. */

package/dist/commands/windowsAudit.js

@@ -41,6 +41,7 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const shellGuard_1 = require("./shellGuard");
 /**
  * Windows PowerShell audit coverage — ScriptBlock Logging + Transcription.
  *
@@ -119,6 +120,7 @@ function getShellAuditReport() {
             scriptBlockLogging: status.scriptBlockLogging,
             transcription: status.transcription,
             transcriptionPath: status.transcriptionPath,
+            profileGuard: (0, shellGuard_1.isShellGuardInstalled)(),
             checkedAt: status.checkedAt,
         };
     }

package/dist/index.js

@@ -51,6 +51,8 @@ const mcpGateway_1 = require("./commands/mcpGateway");
 const installAll_1 = require("./commands/installAll");
 const autoProtect_1 = require("./commands/autoProtect");
 const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
+const cmdGuard_1 = require("./commands/cmdGuard");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 function readCliVersion() {
@@ -126,6 +128,11 @@ function printHelp() {
     install     Alias for install-all.
     windows-audit  Show Windows PowerShell audit coverage (ScriptBlock Logging +
                 Transcription). Use --enable to turn it on (one admin prompt).
+    install-shell-guard    Block dangerous commands typed in PowerShell terminals
+                (real-time, offline rule cache). uninstall-shell-guard removes it;
+                shell-guard-status shows coverage.
+    install-cmd-guard      Block dangerous commands typed in cmd.exe (Command Prompt).
+                uninstall-cmd-guard removes it; cmd-guard-status shows coverage.
     scan        Runs the scan. Use --local for inside-organization scans.
     discover    Finds MCP servers, local secrets, agent rules/skills, and machine
                 blast radius on this laptop. Use --surface all --upload for AI Fleet.
@@ -596,6 +603,8 @@ async function main() {
                 autoProtect: flags['auto-protect'],
                 intervalMinutes: flags['interval-minutes'],
                 windowsAudit: flags['windows-audit'],
+                shellGuard: flags['shell-guard'],
+                cmdGuard: flags['cmd-guard'],
             };
             await (0, installAll_1.installAllCommand)(args, config);
             break;
@@ -605,6 +614,51 @@ async function main() {
             await (0, windowsAudit_1.windowsAuditCommand)(args);
             break;
         }
+        case 'install-shell-guard': {
+            await (0, shellGuard_1.installShellGuardCommand)({ profiles: flags.profiles });
+            break;
+        }
+        case 'uninstall-shell-guard': {
+            await (0, shellGuard_1.uninstallShellGuardCommand)();
+            break;
+        }
+        case 'shell-guard-status': {
+            const status = (0, shellGuard_1.getShellGuardStatus)();
+            if (!status.supported) {
+                console.log('Shell guard supports Windows PowerShell (bash/zsh planned).');
+                break;
+            }
+            console.log(`\nInteractive PowerShell shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+            for (const profile of status.profiles) {
+                console.log(`  ${profile.engine}: ${profile.installed ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m'} \x1b[2m${profile.profilePath}\x1b[0m`);
+            }
+            if (status.rulesPresent)
+                console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+            console.log('');
+            break;
+        }
+        case 'install-cmd-guard': {
+            await (0, cmdGuard_1.installCmdGuardCommand)();
+            break;
+        }
+        case 'uninstall-cmd-guard': {
+            await (0, cmdGuard_1.uninstallCmdGuardCommand)();
+            break;
+        }
+        case 'cmd-guard-status': {
+            const status = (0, cmdGuard_1.getCmdGuardStatus)();
+            if (!status.supported) {
+                console.log('cmd guard supports Windows Command Prompt only.');
+                break;
+            }
+            console.log(`\nInteractive cmd.exe shell guard: ${status.installed ? '\x1b[32minstalled\x1b[0m' : '\x1b[31mnot installed\x1b[0m'}`);
+            if (status.autorunValue)
+                console.log(`  AutoRun: \x1b[2m${status.autorunValue}\x1b[0m`);
+            if (status.rulesPresent)
+                console.log(`  Rules: ${status.ruleCount} (mode: ${status.mode || 'block'})`);
+            console.log('');
+            break;
+        }
         case 'install-mcp-gateway': {
             await (0, mcpGateway_1.installMcpGatewayCommand)(buildInstallArgs(), config);
             break;

package/dist/telemetry.js

@@ -43,6 +43,8 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
 const windowsAudit_1 = require("./commands/windowsAudit");
+const shellGuard_1 = require("./commands/shellGuard");
+const cmdGuard_1 = require("./commands/cmdGuard");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -109,6 +111,10 @@ function rewriteSpool(remaining) {
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */
 async function flushSpool(input) {
+    // Piggyback on the flush cycle to re-sync terminal guard rule caches (mode flips
+    // + new custom rules reach open shells within ~30s).
+    (0, shellGuard_1.refreshShellGuardRules)();
+    (0, cmdGuard_1.refreshCmdGuardRules)();
     const all = readSpool();
     const batch = all.slice(0, MAX_BATCH);
     const overflow = all.slice(MAX_BATCH);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.9.0"
+  "version": "1.11.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -17,6 +17,8 @@
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
+    "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
+    "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },