fullcourtdefense-cli 1.14.3 → 1.14.4

package/dist/commands/discover.d.ts

@@ -60,6 +60,8 @@ export interface DesktopDiscoveryHost {
     probeMode: 'config' | 'deep';
     /** Windows-only: PowerShell audit coverage (ScriptBlock Logging + Transcription). */
     shellAudit?: ShellAuditReport;
+    /** True when the scan ran on an ephemeral CI runner (GitHub Actions, GitLab, etc.) — not a user machine. */
+    isCi?: boolean;
 }
 export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
 /** Upload-only discover — used after install-mcp-gateway --upload. */

package/dist/commands/discover.js

@@ -93,6 +93,16 @@ function machineFingerprint() {
     const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
     return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
 }
+/** Detect ephemeral CI runners so they are never listed as user machines in the fleet. */
+function isCiEnvironment() {
+    return process.env.GITHUB_ACTIONS === 'true'
+        || process.env.GITLAB_CI === 'true'
+        || process.env.TF_BUILD === 'True' // Azure Pipelines
+        || !!process.env.JENKINS_URL
+        || !!process.env.BUILDKITE
+        || !!process.env.CIRCLECI
+        || process.env.CI === 'true';
+}
 function buildHostMetadata(userEmail, probeMode = 'config') {
     const info = os.userInfo();
     return {
@@ -103,6 +113,7 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
         scannedAt: new Date().toISOString(),
         probeMode,
         shellAudit: (0, windowsAudit_1.getShellAuditReport)(),
+        isCi: isCiEnvironment() || undefined,
     };
 }
 /** Where MCP client configs live — see discoverPaths.ts for the canonical list. */

package/dist/commands/discoverSecrets.js

@@ -100,6 +100,8 @@ const SKIP_DIR_NAMES = new Set([
 const MAX_FILE_BYTES = 256 * 1024;
 const MAX_ENV_FILES = 400;
 const MAX_FINDINGS = 200;
+const INLINE_ALLOW_COMMENT = /\b(?:gitleaks:allow|trufflehog:ignore|pragma:\s*allowlist\s+secret|nosecret|secretlint-disable)\b/i;
+const PLACEHOLDER_WORDS = /(?:example|sample|dummy|fake|placeholder|changeme|change_me|replace_me|your[_-]?key|your[_-]?token|test[_-]?only)/i;
 function redact(value) {
     const trimmed = value.trim();
     if (trimmed.length <= 8)
@@ -109,6 +111,21 @@ function redact(value) {
 function findingId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
+function looksLikePlaceholder(raw, line) {
+    const joined = `${raw} ${line}`;
+    if (PLACEHOLDER_WORDS.test(joined))
+        return true;
+    if (/(?:sk-proj-|sk-|gsk_|xai-|hf_|npm_|ag_org_|shsk_)[x0a]{16,}/i.test(raw))
+        return true;
+    const compact = raw.replace(/[^A-Za-z0-9]/g, '');
+    if (!compact)
+        return false;
+    if (/^(?:x+|0+|1+|a+|z+)$/i.test(compact))
+        return true;
+    if (/^(?:1234567890|abcdef|abc123){2,}$/i.test(compact))
+        return true;
+    return false;
+}
 function scoreFromFindings(findings) {
     let score = 100;
     for (const f of findings) {
@@ -135,6 +152,8 @@ function scanTextLines(filePath, content, category, out, seen) {
         const line = lines[i];
         if (!line.trim() || line.trim().startsWith('#'))
             continue;
+        if (INLINE_ALLOW_COMMENT.test(line))
+            continue;
         // First (most specific) pattern wins per matched string — prevents e.g. an
         // sk-ant- Anthropic key from also being reported as a generic OpenAI sk- key.
         const matchedRaws = [];
@@ -168,6 +187,12 @@ function scanTextLines(filePath, content, category, out, seen) {
                 detail = `Matched ${pattern.provider} pattern in ${path.basename(filePath)} — looks like an intentional placeholder.`;
                 remediation = 'Confirm this is a dummy value. If a real credential was pasted into the example file, rotate it and replace with a placeholder.';
             }
+            else if (looksLikePlaceholder(raw, line)) {
+                severity = 'info';
+                title = `${pattern.title} (placeholder-like value)`;
+                detail = `Matched ${pattern.provider} pattern in ${path.basename(filePath)}, but the value/line contains common placeholder markers.`;
+                remediation = 'Replace placeholders before production. If this is a real credential despite the placeholder wording, rotate it and move it to a secret manager.';
+            }
             else if (isClientExposedWebKey) {
                 severity = 'medium';
                 title = 'Google/Firebase web API key (client-exposed)';

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.3"
+  "version": "1.14.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.3",
+  "version": "1.14.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -20,6 +20,7 @@
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
+    "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },