fullcourtdefense-cli 1.14.5 → 1.14.7

package/dist/commands/discoverAgentFiles.js

@@ -41,16 +41,12 @@ const path = __importStar(require("path"));
 const MAX_FILES = 150;
 const MAX_FILE_BYTES = 512 * 1024;
 const EXCERPT_LEN = 180;
-const RISK_HEURISTICS = [
-    { re: /\b(?:shell|bash|exec|subprocess|terminal|run_command)\b/i, tag: 'allows_shell' },
-    { re: /\b(?:ignore (?:all )?(?:previous )?instructions|bypass|jailbreak|DAN mode)\b/i, tag: 'jailbreak_hint' },
-    { re: /\b(?:always allow|never block|disable security|skip validation)\b/i, tag: 'weak_guardrails' },
-    { re: /\b(?:read any file|full filesystem|entire filesystem|workspace trust|trusted workspace|\/etc\/passwd|sudo)\b/i, tag: 'broad_filesystem' },
-    { re: /\b(?:auto[- ]?approve|without asking|unattended|non[- ]?interactive|yolo mode)\b/i, tag: 'auto_approval' },
-    { re: /\b(?:curl|wget|webhook|exfiltrate|post to slack|send email|http request)\b/i, tag: 'network_exfil' },
-    { re: /\b(?:send email|post to slack|transfer funds|delete all|publish package|npm publish|git push)\b/i, tag: 'destructive_actions' },
-    { re: /\b(?:api[_-]?key|secret|password|token)\s*[:=]/i, tag: 'embedded_secret_ref' },
-];
+const NEGATED_RISK_LINE = /\b(?:do not|does not|don't|not an? (?:instruction|permission)|not permission|never|avoid|forbid|block|wrong|bad|dangerous|must not)\b/i;
+const ACTIVE_AGENT_SUBJECT = /\b(?:agent|assistant|model|tool|mcp|skill|it)\b/i;
+const EMBEDDED_SECRET_VALUE = /\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{24,}|ghp_[A-Za-z0-9_]{24,}|github_pat_[A-Za-z0-9_]{24,}|glpat-[A-Za-z0-9_-]{20,}|npm_[A-Za-z0-9]{24,}|hf_[A-Za-z0-9]{24,}|gsk_[A-Za-z0-9]{24,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{28,}|xox[baprs]-[A-Za-z0-9-]{20,})\b/;
+function stripCodeBlocks(content) {
+    return content.replace(/```[\s\S]*?```/g, '');
+}
 function stableId(parts) {
     return crypto.createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
 }
@@ -66,11 +62,49 @@ function readAgentFile(filePath) {
         return null;
     }
 }
+function lineHasRiskIntent(line, action, target) {
+    if (NEGATED_RISK_LINE.test(line))
+        return false;
+    if (!action.test(line))
+        return false;
+    return target ? target.test(line) : true;
+}
+function lineHasOrderedRiskIntent(line, pattern) {
+    return !NEGATED_RISK_LINE.test(line) && pattern.test(line);
+}
+function lineHasActiveAgentRisk(line, pattern) {
+    return !NEGATED_RISK_LINE.test(line) && ACTIVE_AGENT_SUBJECT.test(line) && pattern.test(line);
+}
 function analyzeContent(content) {
     const tags = new Set();
-    for (const rule of RISK_HEURISTICS) {
-        if (rule.re.test(content))
-            tags.add(rule.tag);
+    const text = stripCodeBlocks(content);
+    const lines = text.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+    const whole = lines.join('\n');
+    if (/\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*/i.test(whole) && EMBEDDED_SECRET_VALUE.test(whole)) {
+        tags.add('embedded_secret_ref');
+    }
+    for (const line of lines) {
+        if (lineHasActiveAgentRisk(line, /\b(?:allow|can|may|must|should|use|execute|invoke|enable|grant)\b.{0,100}\b(?:shell|bash|exec|subprocess|run_command|command runner|terminal)\b/i)) {
+            tags.add('allows_shell');
+        }
+        if (lineHasActiveAgentRisk(line, /\b(?:allow|can|may|must|should|read|write|access|trust|grant)\b.{0,100}\b(?:read any file|full filesystem|entire filesystem|trusted workspace|workspace trust|\/etc\/passwd|sudo)\b/i)) {
+            tags.add('broad_filesystem');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:ignore (?:all )?(?:previous )?instructions|bypass safety|bypass guardrails|DAN mode)\b/i)) {
+            tags.add('jailbreak_hint');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:always allow|disable security|skip validation|bypass validation)\b/i)) {
+            tags.add('weak_guardrails');
+        }
+        if (lineHasRiskIntent(line, /\b(?:auto[- ]?approve|without asking|unattended|non[- ]?interactive|yolo mode)\b/i)) {
+            tags.add('auto_approval');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:exfiltrate\b|(?:send|post|upload|curl|wget)\b.{0,120}\b(?:secret|token|credential|api[_-]?key|env|customer|database|private|confidential)\b.{0,120}\b(?:webhook|https?:|external|slack|email|url)|(?:send|post|upload|curl|wget)\b.{0,120}\b(?:webhook|https?:|external|slack|email|url)\b.{0,120}\b(?:secret|token|credential|api[_-]?key|env|customer|database|private|confidential))\b/i)) {
+            tags.add('network_exfil');
+        }
+        if (lineHasOrderedRiskIntent(line, /\b(?:allow|can|may|must|should|run|execute|auto[- ]?approve)\b.{0,120}\b(?:transfer funds|delete all|publish package|npm publish|git push|drop table|remove directory)\b/i)) {
+            tags.add('destructive_actions');
+        }
     }
     return [...tags];
 }

package/dist/commands/discoverBlastRadius.js

@@ -127,8 +127,8 @@ function computeBlastRadius(input) {
         combos.push({
             id: 'permissive_rules_plus_secrets',
             severity: 'high',
-            title: 'Permissive agent rules + local credentials',
-            detail: 'Agent instructions allow broad tool use while local credentials are present on disk.',
+            title: 'Agent can reach local credentials',
+            detail: `${criticalSecrets.length} high-risk credential(s) are on this machine, and agent instructions allow broad actions such as shell, filesystem, auto-approval, or network sends. If the agent is hijacked, those credentials could be read or used.`,
         });
     }
     if (packagePublisherSecrets.length > 0 && riskyAgentFiles.some(f => f.riskTags.includes('destructive_actions')
@@ -137,8 +137,8 @@ function computeBlastRadius(input) {
         combos.push({
             id: 'supply_chain_token_plus_agent_actions',
             severity: 'high',
-            title: 'Package publishing token + agent actions',
-            detail: `${packagePublisherSecrets.length} package/repository credential(s) found alongside rules or tools that can run commands.`,
+            title: 'Publishing token exposed to agent actions',
+            detail: `${packagePublisherSecrets.length} package/repository token(s) are on this machine while agent rules allow command execution, auto-approval, or publishing actions. A hijacked agent could publish packages or push code with those credentials.`,
         });
     }
     if (agentFiles.length >= 5 && !clientCoverage.some(c => c.cursorHooksInstalled)) {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.5"
+  "version": "1.14.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.5",
+  "version": "1.14.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -21,6 +21,8 @@
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
+    "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",
+    "test:realworld-posture": "npm run build && node scripts/test-realworld-posture-fixtures.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "prepublishOnly": "npm run build"