fullcourtdefense-cli 1.14.4 → 1.14.5

package/dist/commands/discoverAgentFiles.js

@@ -45,8 +45,10 @@ const RISK_HEURISTICS = [
     { re: /\b(?:shell|bash|exec|subprocess|terminal|run_command)\b/i, tag: 'allows_shell' },
     { re: /\b(?:ignore (?:all )?(?:previous )?instructions|bypass|jailbreak|DAN mode)\b/i, tag: 'jailbreak_hint' },
     { re: /\b(?:always allow|never block|disable security|skip validation)\b/i, tag: 'weak_guardrails' },
-    { re: /\b(?:read any file|full filesystem|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
-    { re: /\b(?:send email|post to slack|transfer funds|delete all)\b/i, tag: 'destructive_actions' },
+    { re: /\b(?:read any file|full filesystem|entire filesystem|workspace trust|trusted workspace|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
+    { re: /\b(?:auto[- ]?approve|without asking|unattended|non[- ]?interactive|yolo mode)\b/i, tag: 'auto_approval' },
+    { re: /\b(?:curl|wget|webhook|exfiltrate|post to slack|send email|http request)\b/i, tag: 'network_exfil' },
+    { re: /\b(?:send email|post to slack|transfer funds|delete all|publish package|npm publish|git push)\b/i, tag: 'destructive_actions' },
     { re: /\b(?:api[_-]?key|secret|password|token)\s*[:=]/i, tag: 'embedded_secret_ref' },
 ];
 function stableId(parts) {

package/dist/commands/discoverBlastRadius.js

@@ -25,6 +25,9 @@ function computeBlastRadius(input) {
     const { mcpServers, clientCoverage, secrets, agentFiles } = input;
     const directServers = mcpServers.filter(s => s.proxyStatus === 'direct');
     const criticalSecrets = secrets.findings.filter(f => f.severity === 'critical' || f.severity === 'high');
+    const credentialStoreSecrets = criticalSecrets.filter(f => f.category === 'credential_store' || f.category === 'ssh_key');
+    const shellHistorySecrets = criticalSecrets.filter(f => f.category === 'shell_history');
+    const packagePublisherSecrets = criticalSecrets.filter(f => ['npm', 'pypi', 'github'].includes(f.provider || ''));
     const riskyAgentFiles = agentFiles.filter(f => f.riskTags.length > 0);
     if (hasTag(directServers, 'shell/exec', true)) {
         combos.push({
@@ -58,6 +61,22 @@ function computeBlastRadius(input) {
             detail: `${criticalSecrets.length} high/critical secret(s) on this machine while shell/exec MCP is enabled.`,
         });
     }
+    if (directServers.length > 0 && credentialStoreSecrets.length > 0) {
+        combos.push({
+            id: 'direct_mcp_plus_credential_store',
+            severity: 'critical',
+            title: 'Direct MCP + credential stores',
+            detail: `${credentialStoreSecrets.length} credential-store secret(s) are readable while direct MCP tools are configured.`,
+        });
+    }
+    if (shellHistorySecrets.length > 0) {
+        combos.push({
+            id: 'shell_history_secrets',
+            severity: hasTag(directServers, 'shell/exec', true) ? 'critical' : 'high',
+            title: 'Secrets in shell history',
+            detail: `${shellHistorySecrets.length} token or credential value(s) were found in recent shell history.`,
+        });
+    }
     if (hasTag(directServers, 'web/network', true) && criticalSecrets.length > 0) {
         combos.push({
             id: 'browser_plus_secrets',
@@ -101,6 +120,27 @@ function computeBlastRadius(input) {
             detail: 'Cursor rules or skills mention shell, filesystem, or weak guardrails — review what the agent is allowed to do.',
         });
     }
+    if (riskyAgentFiles.some(f => f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('weak_guardrails')
+        || f.riskTags.includes('auto_approval')
+        || f.riskTags.includes('network_exfil')) && criticalSecrets.length > 0) {
+        combos.push({
+            id: 'permissive_rules_plus_secrets',
+            severity: 'high',
+            title: 'Permissive agent rules + local credentials',
+            detail: 'Agent instructions allow broad tool use while local credentials are present on disk.',
+        });
+    }
+    if (packagePublisherSecrets.length > 0 && riskyAgentFiles.some(f => f.riskTags.includes('destructive_actions')
+        || f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('auto_approval'))) {
+        combos.push({
+            id: 'supply_chain_token_plus_agent_actions',
+            severity: 'high',
+            title: 'Package publishing token + agent actions',
+            detail: `${packagePublisherSecrets.length} package/repository credential(s) found alongside rules or tools that can run commands.`,
+        });
+    }
     if (agentFiles.length >= 5 && !clientCoverage.some(c => c.cursorHooksInstalled)) {
         combos.push({
             id: 'rich_instructions_no_hooks',

package/dist/commands/discoverSecrets.js

@@ -70,6 +70,8 @@ const SECRET_PATTERNS = [
     { re: /\bhvs\.[a-zA-Z0-9_-]{20,}\b/, provider: 'vault', severity: 'critical', title: 'HashiCorp Vault token', impact: 'access to every secret the token policy allows' },
     { re: /\bag_org_[a-zA-Z0-9_-]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'FullCourtDefense org API key', impact: 'org-scoped scan and shield API access' },
     { re: /\bshsk_[a-zA-Z0-9]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'Shield API key', impact: 'submit scans as this shield' },
+    { re: /\b(?:authorization:\s*)?bearer\s+[A-Za-z0-9._~+/=-]{20,}\b/i, provider: 'bearer', severity: 'high', title: 'Bearer token', impact: 'API access for the token scope' },
+    { re: /https?:\/\/[^/\s:'"]+:[^@\s'"]+@[^\s'"]+/i, provider: 'url_basic_auth', severity: 'high', title: 'URL with embedded credentials', impact: 'authenticate to the referenced service' },
     { re: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/, provider: 'jwt', severity: 'medium', title: 'JWT token', impact: 'impersonate the session until the token expires' },
     { re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/, provider: 'private_key', severity: 'critical', title: 'Private key material', impact: 'authenticate as the key owner' },
     { re: /postgres(?:ql)?:\/\/[^\s'"]+:[^\s'"]+@/i, provider: 'database', severity: 'critical', title: 'Database connection string', impact: 'direct database read/write access' },
@@ -89,7 +91,14 @@ const PROVIDER_REMEDIATION = {
     sendgrid: 'Delete this key in SendGrid → Settings → API Keys and create a scoped replacement. SendGrid keys are shown once — the new one goes straight into a secret manager.',
     slack: 'Regenerate the token/webhook in your Slack app settings (api.slack.com/apps) and update the consumer.',
     npm: 'Revoke it with `npm token revoke` and create a granular automation token with the minimum package scope.',
+    pypi: 'Revoke the PyPI token, create a project-scoped token, and store it in your package publisher/secret manager.',
     vault: 'Revoke the token (`vault token revoke`) and issue short-TTL tokens instead of long-lived ones.',
+    docker: 'Log out of unneeded registries (`docker logout <registry>`) and prefer short-lived registry tokens.',
+    kubernetes: 'Move kubeconfigs with cluster-admin or long-lived tokens out of agent-readable paths; prefer short-lived cloud auth plugins.',
+    gcp_adc: 'Revoke the local ADC refresh token (`gcloud auth application-default revoke`) if unneeded, then re-auth with least-privilege accounts.',
+    netrc: 'Remove plaintext passwords from .netrc or replace them with token helpers / OS keychain storage.',
+    bearer: 'Rotate the token and avoid pasting bearer tokens into shell history or config files.',
+    url_basic_auth: 'Rotate the password/token embedded in the URL and replace it with environment or secret-manager lookup.',
     database: 'Change the database password and move the connection string to a secret manager; restrict the DB user\u2019s privileges.',
 };
 const SKIP_DIR_NAMES = new Set([
@@ -111,6 +120,24 @@ function redact(value) {
 function findingId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
+function pushStoreFinding(out, seen, input) {
+    if (out.length >= MAX_FINDINGS)
+        return;
+    const id = findingId([input.filePath, input.provider, input.title]);
+    if (seen.has(id))
+        return;
+    seen.add(id);
+    out.push({
+        id,
+        category: input.category,
+        severity: input.severity,
+        provider: input.provider,
+        filePath: input.filePath,
+        title: input.title,
+        detail: input.detail,
+        remediation: input.remediation || PROVIDER_REMEDIATION[input.provider] || 'Remove or rotate this credential and store it outside agent-readable plaintext files.',
+    });
+}
 function looksLikePlaceholder(raw, line) {
     const joined = `${raw} ${line}`;
     if (PLACEHOLDER_WORDS.test(joined))
@@ -126,6 +153,59 @@ function looksLikePlaceholder(raw, line) {
         return true;
     return false;
 }
+function scanCredentialStorePosture(filePath, content, category, out, seen) {
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    if (normalized.endsWith('/.docker/config.json') && /"auths"\s*:|"auth"\s*:|"identitytoken"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'docker',
+            severity: 'high',
+            title: 'Docker registry credentials',
+            detail: 'Docker config contains registry auth material that agent tools or local malware can read.',
+        });
+    }
+    if (normalized.endsWith('/.kube/config') && /\b(?:token|client-key-data|client-certificate-data)\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'kubernetes',
+            severity: /cluster-admin|system:masters/i.test(content) ? 'critical' : 'high',
+            title: 'Kubernetes kubeconfig credential',
+            detail: 'Kubeconfig contains cluster credentials or client key material reachable from this machine.',
+        });
+    }
+    if (/gcloud\/application_default_credentials\.json$/i.test(normalized) && /"refresh_token"\s*:|"client_secret"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'gcp_adc',
+            severity: 'high',
+            title: 'Google Cloud ADC refresh token',
+            detail: 'Application Default Credentials can mint access tokens for the signed-in Google account.',
+        });
+    }
+    if (normalized.endsWith('/.netrc') && /\bmachine\s+\S+[\s\S]{0,300}\b(?:password|login)\s+\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'netrc',
+            severity: 'high',
+            title: 'Netrc plaintext credential',
+            detail: '.netrc contains machine login/password material used by CLI tools.',
+        });
+    }
+    if (normalized.endsWith('/.pypirc') && /\b(?:password|token)\s*=\s*\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'pypi',
+            severity: 'high',
+            title: 'Python package registry credential',
+            detail: '.pypirc contains package publishing credentials (supply-chain risk).',
+        });
+    }
+}
 function scoreFromFindings(findings) {
     let score = 100;
     for (const f of findings) {
@@ -337,9 +417,11 @@ function scanSecrets(options = {}) {
         if (store.category === 'shell_history') {
             const tail = content.split(/\r?\n/).slice(-500).join('\n');
             scanTextLines(store.path, tail, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, tail, store.category, findings, seen);
         }
         else {
             scanTextLines(store.path, content, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, content, store.category, findings, seen);
         }
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.4"
+  "version": "1.14.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.4",
+  "version": "1.14.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -21,6 +21,7 @@
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
+    "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },