fullcourtdefense-cli 1.14.3 → 1.14.5

package/dist/commands/discover.d.ts

@@ -60,6 +60,8 @@ export interface DesktopDiscoveryHost {
     probeMode: 'config' | 'deep';
     /** Windows-only: PowerShell audit coverage (ScriptBlock Logging + Transcription). */
     shellAudit?: ShellAuditReport;
+    /** True when the scan ran on an ephemeral CI runner (GitHub Actions, GitLab, etc.) — not a user machine. */
+    isCi?: boolean;
 }
 export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
 /** Upload-only discover — used after install-mcp-gateway --upload. */

package/dist/commands/discover.js

@@ -93,6 +93,16 @@ function machineFingerprint() {
     const seed = [os.hostname(), os.userInfo().username, os.platform(), os.arch()].join('|');
     return crypto.createHash('sha256').update(seed).digest('hex').slice(0, 16);
 }
+/** Detect ephemeral CI runners so they are never listed as user machines in the fleet. */
+function isCiEnvironment() {
+    return process.env.GITHUB_ACTIONS === 'true'
+        || process.env.GITLAB_CI === 'true'
+        || process.env.TF_BUILD === 'True' // Azure Pipelines
+        || !!process.env.JENKINS_URL
+        || !!process.env.BUILDKITE
+        || !!process.env.CIRCLECI
+        || process.env.CI === 'true';
+}
 function buildHostMetadata(userEmail, probeMode = 'config') {
     const info = os.userInfo();
     return {
@@ -103,6 +113,7 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
         scannedAt: new Date().toISOString(),
         probeMode,
         shellAudit: (0, windowsAudit_1.getShellAuditReport)(),
+        isCi: isCiEnvironment() || undefined,
     };
 }
 /** Where MCP client configs live — see discoverPaths.ts for the canonical list. */

package/dist/commands/discoverAgentFiles.js

@@ -45,8 +45,10 @@ const RISK_HEURISTICS = [
     { re: /\b(?:shell|bash|exec|subprocess|terminal|run_command)\b/i, tag: 'allows_shell' },
     { re: /\b(?:ignore (?:all )?(?:previous )?instructions|bypass|jailbreak|DAN mode)\b/i, tag: 'jailbreak_hint' },
     { re: /\b(?:always allow|never block|disable security|skip validation)\b/i, tag: 'weak_guardrails' },
-    { re: /\b(?:read any file|full filesystem|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
-    { re: /\b(?:send email|post to slack|transfer funds|delete all)\b/i, tag: 'destructive_actions' },
+    { re: /\b(?:read any file|full filesystem|entire filesystem|workspace trust|trusted workspace|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
+    { re: /\b(?:auto[- ]?approve|without asking|unattended|non[- ]?interactive|yolo mode)\b/i, tag: 'auto_approval' },
+    { re: /\b(?:curl|wget|webhook|exfiltrate|post to slack|send email|http request)\b/i, tag: 'network_exfil' },
+    { re: /\b(?:send email|post to slack|transfer funds|delete all|publish package|npm publish|git push)\b/i, tag: 'destructive_actions' },
     { re: /\b(?:api[_-]?key|secret|password|token)\s*[:=]/i, tag: 'embedded_secret_ref' },
 ];
 function stableId(parts) {

package/dist/commands/discoverBlastRadius.js

@@ -25,6 +25,9 @@ function computeBlastRadius(input) {
     const { mcpServers, clientCoverage, secrets, agentFiles } = input;
     const directServers = mcpServers.filter(s => s.proxyStatus === 'direct');
     const criticalSecrets = secrets.findings.filter(f => f.severity === 'critical' || f.severity === 'high');
+    const credentialStoreSecrets = criticalSecrets.filter(f => f.category === 'credential_store' || f.category === 'ssh_key');
+    const shellHistorySecrets = criticalSecrets.filter(f => f.category === 'shell_history');
+    const packagePublisherSecrets = criticalSecrets.filter(f => ['npm', 'pypi', 'github'].includes(f.provider || ''));
     const riskyAgentFiles = agentFiles.filter(f => f.riskTags.length > 0);
     if (hasTag(directServers, 'shell/exec', true)) {
         combos.push({
@@ -58,6 +61,22 @@ function computeBlastRadius(input) {
             detail: `${criticalSecrets.length} high/critical secret(s) on this machine while shell/exec MCP is enabled.`,
         });
     }
+    if (directServers.length > 0 && credentialStoreSecrets.length > 0) {
+        combos.push({
+            id: 'direct_mcp_plus_credential_store',
+            severity: 'critical',
+            title: 'Direct MCP + credential stores',
+            detail: `${credentialStoreSecrets.length} credential-store secret(s) are readable while direct MCP tools are configured.`,
+        });
+    }
+    if (shellHistorySecrets.length > 0) {
+        combos.push({
+            id: 'shell_history_secrets',
+            severity: hasTag(directServers, 'shell/exec', true) ? 'critical' : 'high',
+            title: 'Secrets in shell history',
+            detail: `${shellHistorySecrets.length} token or credential value(s) were found in recent shell history.`,
+        });
+    }
     if (hasTag(directServers, 'web/network', true) && criticalSecrets.length > 0) {
         combos.push({
             id: 'browser_plus_secrets',
@@ -101,6 +120,27 @@ function computeBlastRadius(input) {
             detail: 'Cursor rules or skills mention shell, filesystem, or weak guardrails — review what the agent is allowed to do.',
         });
     }
+    if (riskyAgentFiles.some(f => f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('weak_guardrails')
+        || f.riskTags.includes('auto_approval')
+        || f.riskTags.includes('network_exfil')) && criticalSecrets.length > 0) {
+        combos.push({
+            id: 'permissive_rules_plus_secrets',
+            severity: 'high',
+            title: 'Permissive agent rules + local credentials',
+            detail: 'Agent instructions allow broad tool use while local credentials are present on disk.',
+        });
+    }
+    if (packagePublisherSecrets.length > 0 && riskyAgentFiles.some(f => f.riskTags.includes('destructive_actions')
+        || f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('auto_approval'))) {
+        combos.push({
+            id: 'supply_chain_token_plus_agent_actions',
+            severity: 'high',
+            title: 'Package publishing token + agent actions',
+            detail: `${packagePublisherSecrets.length} package/repository credential(s) found alongside rules or tools that can run commands.`,
+        });
+    }
     if (agentFiles.length >= 5 && !clientCoverage.some(c => c.cursorHooksInstalled)) {
         combos.push({
             id: 'rich_instructions_no_hooks',

package/dist/commands/discoverSecrets.js

@@ -70,6 +70,8 @@ const SECRET_PATTERNS = [
     { re: /\bhvs\.[a-zA-Z0-9_-]{20,}\b/, provider: 'vault', severity: 'critical', title: 'HashiCorp Vault token', impact: 'access to every secret the token policy allows' },
     { re: /\bag_org_[a-zA-Z0-9_-]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'FullCourtDefense org API key', impact: 'org-scoped scan and shield API access' },
     { re: /\bshsk_[a-zA-Z0-9]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'Shield API key', impact: 'submit scans as this shield' },
+    { re: /\b(?:authorization:\s*)?bearer\s+[A-Za-z0-9._~+/=-]{20,}\b/i, provider: 'bearer', severity: 'high', title: 'Bearer token', impact: 'API access for the token scope' },
+    { re: /https?:\/\/[^/\s:'"]+:[^@\s'"]+@[^\s'"]+/i, provider: 'url_basic_auth', severity: 'high', title: 'URL with embedded credentials', impact: 'authenticate to the referenced service' },
     { re: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/, provider: 'jwt', severity: 'medium', title: 'JWT token', impact: 'impersonate the session until the token expires' },
     { re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/, provider: 'private_key', severity: 'critical', title: 'Private key material', impact: 'authenticate as the key owner' },
     { re: /postgres(?:ql)?:\/\/[^\s'"]+:[^\s'"]+@/i, provider: 'database', severity: 'critical', title: 'Database connection string', impact: 'direct database read/write access' },
@@ -89,7 +91,14 @@ const PROVIDER_REMEDIATION = {
     sendgrid: 'Delete this key in SendGrid → Settings → API Keys and create a scoped replacement. SendGrid keys are shown once — the new one goes straight into a secret manager.',
     slack: 'Regenerate the token/webhook in your Slack app settings (api.slack.com/apps) and update the consumer.',
     npm: 'Revoke it with `npm token revoke` and create a granular automation token with the minimum package scope.',
+    pypi: 'Revoke the PyPI token, create a project-scoped token, and store it in your package publisher/secret manager.',
     vault: 'Revoke the token (`vault token revoke`) and issue short-TTL tokens instead of long-lived ones.',
+    docker: 'Log out of unneeded registries (`docker logout <registry>`) and prefer short-lived registry tokens.',
+    kubernetes: 'Move kubeconfigs with cluster-admin or long-lived tokens out of agent-readable paths; prefer short-lived cloud auth plugins.',
+    gcp_adc: 'Revoke the local ADC refresh token (`gcloud auth application-default revoke`) if unneeded, then re-auth with least-privilege accounts.',
+    netrc: 'Remove plaintext passwords from .netrc or replace them with token helpers / OS keychain storage.',
+    bearer: 'Rotate the token and avoid pasting bearer tokens into shell history or config files.',
+    url_basic_auth: 'Rotate the password/token embedded in the URL and replace it with environment or secret-manager lookup.',
     database: 'Change the database password and move the connection string to a secret manager; restrict the DB user\u2019s privileges.',
 };
 const SKIP_DIR_NAMES = new Set([
@@ -100,6 +109,8 @@ const SKIP_DIR_NAMES = new Set([
 const MAX_FILE_BYTES = 256 * 1024;
 const MAX_ENV_FILES = 400;
 const MAX_FINDINGS = 200;
+const INLINE_ALLOW_COMMENT = /\b(?:gitleaks:allow|trufflehog:ignore|pragma:\s*allowlist\s+secret|nosecret|secretlint-disable)\b/i;
+const PLACEHOLDER_WORDS = /(?:example|sample|dummy|fake|placeholder|changeme|change_me|replace_me|your[_-]?key|your[_-]?token|test[_-]?only)/i;
 function redact(value) {
     const trimmed = value.trim();
     if (trimmed.length <= 8)
@@ -109,6 +120,92 @@ function redact(value) {
 function findingId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
+function pushStoreFinding(out, seen, input) {
+    if (out.length >= MAX_FINDINGS)
+        return;
+    const id = findingId([input.filePath, input.provider, input.title]);
+    if (seen.has(id))
+        return;
+    seen.add(id);
+    out.push({
+        id,
+        category: input.category,
+        severity: input.severity,
+        provider: input.provider,
+        filePath: input.filePath,
+        title: input.title,
+        detail: input.detail,
+        remediation: input.remediation || PROVIDER_REMEDIATION[input.provider] || 'Remove or rotate this credential and store it outside agent-readable plaintext files.',
+    });
+}
+function looksLikePlaceholder(raw, line) {
+    const joined = `${raw} ${line}`;
+    if (PLACEHOLDER_WORDS.test(joined))
+        return true;
+    if (/(?:sk-proj-|sk-|gsk_|xai-|hf_|npm_|ag_org_|shsk_)[x0a]{16,}/i.test(raw))
+        return true;
+    const compact = raw.replace(/[^A-Za-z0-9]/g, '');
+    if (!compact)
+        return false;
+    if (/^(?:x+|0+|1+|a+|z+)$/i.test(compact))
+        return true;
+    if (/^(?:1234567890|abcdef|abc123){2,}$/i.test(compact))
+        return true;
+    return false;
+}
+function scanCredentialStorePosture(filePath, content, category, out, seen) {
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    if (normalized.endsWith('/.docker/config.json') && /"auths"\s*:|"auth"\s*:|"identitytoken"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'docker',
+            severity: 'high',
+            title: 'Docker registry credentials',
+            detail: 'Docker config contains registry auth material that agent tools or local malware can read.',
+        });
+    }
+    if (normalized.endsWith('/.kube/config') && /\b(?:token|client-key-data|client-certificate-data)\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'kubernetes',
+            severity: /cluster-admin|system:masters/i.test(content) ? 'critical' : 'high',
+            title: 'Kubernetes kubeconfig credential',
+            detail: 'Kubeconfig contains cluster credentials or client key material reachable from this machine.',
+        });
+    }
+    if (/gcloud\/application_default_credentials\.json$/i.test(normalized) && /"refresh_token"\s*:|"client_secret"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'gcp_adc',
+            severity: 'high',
+            title: 'Google Cloud ADC refresh token',
+            detail: 'Application Default Credentials can mint access tokens for the signed-in Google account.',
+        });
+    }
+    if (normalized.endsWith('/.netrc') && /\bmachine\s+\S+[\s\S]{0,300}\b(?:password|login)\s+\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'netrc',
+            severity: 'high',
+            title: 'Netrc plaintext credential',
+            detail: '.netrc contains machine login/password material used by CLI tools.',
+        });
+    }
+    if (normalized.endsWith('/.pypirc') && /\b(?:password|token)\s*=\s*\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'pypi',
+            severity: 'high',
+            title: 'Python package registry credential',
+            detail: '.pypirc contains package publishing credentials (supply-chain risk).',
+        });
+    }
+}
 function scoreFromFindings(findings) {
     let score = 100;
     for (const f of findings) {
@@ -135,6 +232,8 @@ function scanTextLines(filePath, content, category, out, seen) {
         const line = lines[i];
         if (!line.trim() || line.trim().startsWith('#'))
             continue;
+        if (INLINE_ALLOW_COMMENT.test(line))
+            continue;
         // First (most specific) pattern wins per matched string — prevents e.g. an
         // sk-ant- Anthropic key from also being reported as a generic OpenAI sk- key.
         const matchedRaws = [];
@@ -168,6 +267,12 @@ function scanTextLines(filePath, content, category, out, seen) {
                 detail = `Matched ${pattern.provider} pattern in ${path.basename(filePath)} — looks like an intentional placeholder.`;
                 remediation = 'Confirm this is a dummy value. If a real credential was pasted into the example file, rotate it and replace with a placeholder.';
             }
+            else if (looksLikePlaceholder(raw, line)) {
+                severity = 'info';
+                title = `${pattern.title} (placeholder-like value)`;
+                detail = `Matched ${pattern.provider} pattern in ${path.basename(filePath)}, but the value/line contains common placeholder markers.`;
+                remediation = 'Replace placeholders before production. If this is a real credential despite the placeholder wording, rotate it and move it to a secret manager.';
+            }
             else if (isClientExposedWebKey) {
                 severity = 'medium';
                 title = 'Google/Firebase web API key (client-exposed)';
@@ -312,9 +417,11 @@ function scanSecrets(options = {}) {
         if (store.category === 'shell_history') {
             const tail = content.split(/\r?\n/).slice(-500).join('\n');
             scanTextLines(store.path, tail, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, tail, store.category, findings, seen);
         }
         else {
             scanTextLines(store.path, content, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, content, store.category, findings, seen);
         }
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.3"
+  "version": "1.14.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.3",
+  "version": "1.14.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -20,6 +20,8 @@
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
+    "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
+    "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },