fullcourtdefense-cli 1.14.4 → 1.14.6

package/dist/commands/discoverAgentFiles.js

@@ -41,14 +41,10 @@ const path = __importStar(require("path"));
 const MAX_FILES = 150;
 const MAX_FILE_BYTES = 512 * 1024;
 const EXCERPT_LEN = 180;
-const RISK_HEURISTICS = [
-    { re: /\b(?:shell|bash|exec|subprocess|terminal|run_command)\b/i, tag: 'allows_shell' },
-    { re: /\b(?:ignore (?:all )?(?:previous )?instructions|bypass|jailbreak|DAN mode)\b/i, tag: 'jailbreak_hint' },
-    { re: /\b(?:always allow|never block|disable security|skip validation)\b/i, tag: 'weak_guardrails' },
-    { re: /\b(?:read any file|full filesystem|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
-    { re: /\b(?:send email|post to slack|transfer funds|delete all)\b/i, tag: 'destructive_actions' },
-    { re: /\b(?:api[_-]?key|secret|password|token)\s*[:=]/i, tag: 'embedded_secret_ref' },
-];
+const NEGATED_RISK_LINE = /\b(?:do not|don't|never|avoid|forbid|block|wrong|bad|dangerous|must not)\b/i;
+function stripCodeBlocks(content) {
+    return content.replace(/```[\s\S]*?```/g, '');
+}
 function stableId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
@@ -64,11 +60,46 @@ function readAgentFile(filePath) {
         return null;
     }
 }
+function lineHasRiskIntent(line, action, target) {
+    if (NEGATED_RISK_LINE.test(line))
+        return false;
+    if (!action.test(line))
+        return false;
+    return target ? target.test(line) : true;
+}
+function lineHasOrderedRiskIntent(line, pattern) {
+    return !NEGATED_RISK_LINE.test(line) && pattern.test(line);
+}
 function analyzeContent(content) {
     const tags = new Set();
-    for (const rule of RISK_HEURISTICS) {
-        if (rule.re.test(content))
-            tags.add(rule.tag);
+    const text = stripCodeBlocks(content);
+    const lines = text.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+    const whole = lines.join('\n');
+    if (/\b(?:ignore (?:all )?(?:previous )?instructions|bypass|jailbreak|DAN mode)\b/i.test(whole)) {
+        tags.add('jailbreak_hint');
+    }
+    if (/\b(?:always allow|never block|disable security|skip validation)\b/i.test(whole)) {
+        tags.add('weak_guardrails');
+    }
+    if (/\b(?:api[_-]?key|secret|password|token)\s*[:=]/i.test(whole)) {
+        tags.add('embedded_secret_ref');
+    }
+    for (const line of lines) {
+        if (lineHasOrderedRiskIntent(line, /\b(?:allow|can|may|must|should|use|run|execute|invoke|call|enable|grant)\b.{0,100}\b(?:shell|bash|exec|subprocess|run_command|command runner)\b/i)) {
+            tags.add('allows_shell');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:allow|can|may|must|should|read|write|access|trust|grant)\b.{0,100}\b(?:read any file|full filesystem|entire filesystem|trusted workspace|workspace trust|\/etc\/passwd|sudo)\b/i)) {
+            tags.add('broad_filesystem');
+        }
+        if (lineHasRiskIntent(line, /\b(?:auto[- ]?approve|without asking|unattended|non[- ]?interactive|yolo mode)\b/i)) {
+            tags.add('auto_approval');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:exfiltrate|send|post|upload|curl|wget)\b.{0,120}\b(?:secret|token|credential|api[_-]?key|env|customer|database|private|confidential)\b/i)) {
+            tags.add('network_exfil');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:allow|can|may|must|should|run|execute|auto[- ]?approve)\b.{0,120}\b(?:transfer funds|delete all|publish package|npm publish|git push|drop table|remove directory)\b/i)) {
+            tags.add('destructive_actions');
+        }
     }
     return [...tags];
 }

package/dist/commands/discoverBlastRadius.js

@@ -25,6 +25,9 @@ function computeBlastRadius(input) {
     const { mcpServers, clientCoverage, secrets, agentFiles } = input;
     const directServers = mcpServers.filter(s => s.proxyStatus === 'direct');
     const criticalSecrets = secrets.findings.filter(f => f.severity === 'critical' || f.severity === 'high');
+    const credentialStoreSecrets = criticalSecrets.filter(f => f.category === 'credential_store' || f.category === 'ssh_key');
+    const shellHistorySecrets = criticalSecrets.filter(f => f.category === 'shell_history');
+    const packagePublisherSecrets = criticalSecrets.filter(f => ['npm', 'pypi', 'github'].includes(f.provider || ''));
     const riskyAgentFiles = agentFiles.filter(f => f.riskTags.length > 0);
     if (hasTag(directServers, 'shell/exec', true)) {
         combos.push({
@@ -58,6 +61,22 @@ function computeBlastRadius(input) {
             detail: `${criticalSecrets.length} high/critical secret(s) on this machine while shell/exec MCP is enabled.`,
         });
     }
+    if (directServers.length > 0 && credentialStoreSecrets.length > 0) {
+        combos.push({
+            id: 'direct_mcp_plus_credential_store',
+            severity: 'critical',
+            title: 'Direct MCP + credential stores',
+            detail: `${credentialStoreSecrets.length} credential-store secret(s) are readable while direct MCP tools are configured.`,
+        });
+    }
+    if (shellHistorySecrets.length > 0) {
+        combos.push({
+            id: 'shell_history_secrets',
+            severity: hasTag(directServers, 'shell/exec', true) ? 'critical' : 'high',
+            title: 'Secrets in shell history',
+            detail: `${shellHistorySecrets.length} token or credential value(s) were found in recent shell history.`,
+        });
+    }
     if (hasTag(directServers, 'web/network', true) && criticalSecrets.length > 0) {
         combos.push({
             id: 'browser_plus_secrets',
@@ -101,6 +120,27 @@ function computeBlastRadius(input) {
             detail: 'Cursor rules or skills mention shell, filesystem, or weak guardrails — review what the agent is allowed to do.',
         });
     }
+    if (riskyAgentFiles.some(f => f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('weak_guardrails')
+        || f.riskTags.includes('auto_approval')
+        || f.riskTags.includes('network_exfil')) && criticalSecrets.length > 0) {
+        combos.push({
+            id: 'permissive_rules_plus_secrets',
+            severity: 'high',
+            title: 'Agent can reach local credentials',
+            detail: `${criticalSecrets.length} high-risk credential(s) are on this machine, and agent instructions allow broad actions such as shell, filesystem, auto-approval, or network sends. If the agent is hijacked, those credentials could be read or used.`,
+        });
+    }
+    if (packagePublisherSecrets.length > 0 && riskyAgentFiles.some(f => f.riskTags.includes('destructive_actions')
+        || f.riskTags.includes('allows_shell')
+        || f.riskTags.includes('auto_approval'))) {
+        combos.push({
+            id: 'supply_chain_token_plus_agent_actions',
+            severity: 'high',
+            title: 'Publishing token exposed to agent actions',
+            detail: `${packagePublisherSecrets.length} package/repository token(s) are on this machine while agent rules allow command execution, auto-approval, or publishing actions. A hijacked agent could publish packages or push code with those credentials.`,
+        });
+    }
     if (agentFiles.length >= 5 && !clientCoverage.some(c => c.cursorHooksInstalled)) {
         combos.push({
             id: 'rich_instructions_no_hooks',

package/dist/commands/discoverSecrets.js

@@ -70,6 +70,8 @@ const SECRET_PATTERNS = [
     { re: /\bhvs\.[a-zA-Z0-9_-]{20,}\b/, provider: 'vault', severity: 'critical', title: 'HashiCorp Vault token', impact: 'access to every secret the token policy allows' },
     { re: /\bag_org_[a-zA-Z0-9_-]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'FullCourtDefense org API key', impact: 'org-scoped scan and shield API access' },
     { re: /\bshsk_[a-zA-Z0-9]{20,}\b/, provider: 'fullcourtdefense', severity: 'high', title: 'Shield API key', impact: 'submit scans as this shield' },
+    { re: /\b(?:authorization:\s*)?bearer\s+[A-Za-z0-9._~+/=-]{20,}\b/i, provider: 'bearer', severity: 'high', title: 'Bearer token', impact: 'API access for the token scope' },
+    { re: /https?:\/\/[^/\s:'"]+:[^@\s'"]+@[^\s'"]+/i, provider: 'url_basic_auth', severity: 'high', title: 'URL with embedded credentials', impact: 'authenticate to the referenced service' },
     { re: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/, provider: 'jwt', severity: 'medium', title: 'JWT token', impact: 'impersonate the session until the token expires' },
     { re: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/, provider: 'private_key', severity: 'critical', title: 'Private key material', impact: 'authenticate as the key owner' },
     { re: /postgres(?:ql)?:\/\/[^\s'"]+:[^\s'"]+@/i, provider: 'database', severity: 'critical', title: 'Database connection string', impact: 'direct database read/write access' },
@@ -89,7 +91,14 @@ const PROVIDER_REMEDIATION = {
     sendgrid: 'Delete this key in SendGrid → Settings → API Keys and create a scoped replacement. SendGrid keys are shown once — the new one goes straight into a secret manager.',
     slack: 'Regenerate the token/webhook in your Slack app settings (api.slack.com/apps) and update the consumer.',
     npm: 'Revoke it with `npm token revoke` and create a granular automation token with the minimum package scope.',
+    pypi: 'Revoke the PyPI token, create a project-scoped token, and store it in your package publisher/secret manager.',
     vault: 'Revoke the token (`vault token revoke`) and issue short-TTL tokens instead of long-lived ones.',
+    docker: 'Log out of unneeded registries (`docker logout <registry>`) and prefer short-lived registry tokens.',
+    kubernetes: 'Move kubeconfigs with cluster-admin or long-lived tokens out of agent-readable paths; prefer short-lived cloud auth plugins.',
+    gcp_adc: 'Revoke the local ADC refresh token (`gcloud auth application-default revoke`) if unneeded, then re-auth with least-privilege accounts.',
+    netrc: 'Remove plaintext passwords from .netrc or replace them with token helpers / OS keychain storage.',
+    bearer: 'Rotate the token and avoid pasting bearer tokens into shell history or config files.',
+    url_basic_auth: 'Rotate the password/token embedded in the URL and replace it with environment or secret-manager lookup.',
     database: 'Change the database password and move the connection string to a secret manager; restrict the DB user\u2019s privileges.',
 };
 const SKIP_DIR_NAMES = new Set([
@@ -111,6 +120,24 @@ function redact(value) {
 function findingId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
+function pushStoreFinding(out, seen, input) {
+    if (out.length >= MAX_FINDINGS)
+        return;
+    const id = findingId([input.filePath, input.provider, input.title]);
+    if (seen.has(id))
+        return;
+    seen.add(id);
+    out.push({
+        id,
+        category: input.category,
+        severity: input.severity,
+        provider: input.provider,
+        filePath: input.filePath,
+        title: input.title,
+        detail: input.detail,
+        remediation: input.remediation || PROVIDER_REMEDIATION[input.provider] || 'Remove or rotate this credential and store it outside agent-readable plaintext files.',
+    });
+}
 function looksLikePlaceholder(raw, line) {
     const joined = `${raw} ${line}`;
     if (PLACEHOLDER_WORDS.test(joined))
@@ -126,6 +153,59 @@ function looksLikePlaceholder(raw, line) {
         return true;
     return false;
 }
+function scanCredentialStorePosture(filePath, content, category, out, seen) {
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    if (normalized.endsWith('/.docker/config.json') && /"auths"\s*:|"auth"\s*:|"identitytoken"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'docker',
+            severity: 'high',
+            title: 'Docker registry credentials',
+            detail: 'Docker config contains registry auth material that agent tools or local malware can read.',
+        });
+    }
+    if (normalized.endsWith('/.kube/config') && /\b(?:token|client-key-data|client-certificate-data)\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'kubernetes',
+            severity: /cluster-admin|system:masters/i.test(content) ? 'critical' : 'high',
+            title: 'Kubernetes kubeconfig credential',
+            detail: 'Kubeconfig contains cluster credentials or client key material reachable from this machine.',
+        });
+    }
+    if (/gcloud\/application_default_credentials\.json$/i.test(normalized) && /"refresh_token"\s*:|"client_secret"\s*:/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'gcp_adc',
+            severity: 'high',
+            title: 'Google Cloud ADC refresh token',
+            detail: 'Application Default Credentials can mint access tokens for the signed-in Google account.',
+        });
+    }
+    if (normalized.endsWith('/.netrc') && /\bmachine\s+\S+[\s\S]{0,300}\b(?:password|login)\s+\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'netrc',
+            severity: 'high',
+            title: 'Netrc plaintext credential',
+            detail: '.netrc contains machine login/password material used by CLI tools.',
+        });
+    }
+    if (normalized.endsWith('/.pypirc') && /\b(?:password|token)\s*=\s*\S+/i.test(content)) {
+        pushStoreFinding(out, seen, {
+            filePath,
+            category,
+            provider: 'pypi',
+            severity: 'high',
+            title: 'Python package registry credential',
+            detail: '.pypirc contains package publishing credentials (supply-chain risk).',
+        });
+    }
+}
 function scoreFromFindings(findings) {
     let score = 100;
     for (const f of findings) {
@@ -337,9 +417,11 @@ function scanSecrets(options = {}) {
         if (store.category === 'shell_history') {
             const tail = content.split(/\r?\n/).slice(-500).join('\n');
             scanTextLines(store.path, tail, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, tail, store.category, findings, seen);
         }
         else {
             scanTextLines(store.path, content, store.category, findings, seen);
+            scanCredentialStorePosture(store.path, content, store.category, findings, seen);
         }
         if (findings.length >= MAX_FINDINGS)
             break;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.4"
+  "version": "1.14.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.4",
+  "version": "1.14.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -21,6 +21,9 @@
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
+    "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",
+    "test:realworld-posture": "npm run build && node scripts/test-realworld-posture-fixtures.js",
+    "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"
   },