fullcourtdefense-cli 1.18.6 → 1.18.7

package/dist/commands/deterministicGuard.js

@@ -52,6 +52,105 @@ const SECRET_PATTERNS = [
     { itemId: 'huggingface_token', label: 'HuggingFace token', re: /\bhf_[A-Za-z0-9]{30,}\b/ },
     { itemId: 'database_url_password', label: 'database URL with password', re: /\b(?:postgres(?:ql)?|mongodb(?:\+srv)?|mysql):\/\/[^/\s'":]+:[^@\s'"]+@/i },
 ];
+// Contextual secret detection: bare high-entropy strings (hex app secrets,
+// random tokens) have no recognizable prefix, so SECRET_PATTERNS misses them.
+// When one sits next to a credential keyword ("secret", "password", "api key"
+// ...), treat it as secret material. Keyword proximity keeps git SHAs, UUIDs
+// in URLs, and hashes in ordinary output from false-positiving.
+// English terms use \b word boundaries (so "tokenizer" does not match "token").
+// Deliberately canonical words only — no typo/shorthand variants (pswd, scrt,
+// ...). A deterministic guard must stay predictable; typo evasion is handled
+// by the cloud tier (meta-safety specialist is typo-augmented).
+const CONTEXT_SECRET_KEYWORD_EN = /\b(?:secret|password|passwd|pwd|credential|passphrase|api[ _-]?key|apikey|access[ _-]?key|private[ _-]?key|client[ _-]?secret|app[ _-]?secret|signing[ _-]?key|auth[ _-]?token|bearer|token)\b/i;
+// Language-agnostic pack: password/secret/key words across common languages.
+// No \b — JS word boundaries break on diacritics and non-Latin scripts. Broad
+// everyday words ("clave", "chiave", "ключ") are safe to include because a
+// keyword NEVER blocks alone: a high-entropy credential-looking token must
+// also sit within the context window.
+const CONTEXT_SECRET_KEYWORD_MULTI = new RegExp([
+    // Romance: Romanian (first customer — parola/parolă, cheie/cheia/cheile,
+    // credențial; "secret"/"token" are identical to English and covered there),
+    // Spanish, French, Italian, Portuguese
+    'parol', 'chei', 'credenția', 'credentia', 'contraseñ', 'clave', 'mot de passe', 'clé', 'jeton', 'chiave', 'segret', 'senha', 'chave', 'segredo',
+    // Germanic: German, Dutch, Swedish, Norwegian, Danish
+    'passwort', 'kennwort', 'schlüssel', 'geheim', 'wachtwoord', 'sleutel', 'lösenord', 'løsenord', 'passord', 'adgangskode', 'nøkkel', 'hemlig',
+    // Slavic (Latin + Cyrillic): Polish, Czech, Russian, Ukrainian, Bulgarian, Serbian
+    'hasło', 'haslo', 'klucz', 'sekret', 'heslo', 'klíč', 'geslo', 'пароль', 'парол', 'ключ', 'секрет', 'токен',
+    // Turkish, Hungarian, Finnish, Greek
+    'şifre', 'sifre', 'anahtar', 'gizli', 'jelszó', 'jelszo', 'kulcs', 'titok', 'salasana', 'avain', 'salainen', 'κωδικ', 'μυστικ', 'κλειδ',
+    // Hebrew, Arabic, Persian
+    'סיסמה', 'סיסמא', 'מפתח', 'סוד', 'كلمة المرور', 'كلمة السر', 'مفتاح', 'رمز سري', 'رمز', 'گذرواژه', 'رمز عبور',
+    // Indic: Hindi, Bengali, Tamil
+    'पासवर्ड', 'कुंजी', 'गुप्त', 'পাসওয়ার্ড', 'கடவுச்சொல்',
+    // CJK: Chinese (simplified + traditional), Japanese, Korean
+    '密码', '密碼', '密钥', '密鑰', '口令', '令牌', '秘钥', 'パスワード', 'トークン', '秘密鍵', '비밀번호', '암호', '토큰', '비밀 키',
+    // Vietnamese, Indonesian/Malay, Thai
+    'mật khẩu', 'bí mật', 'kata sandi', 'kata laluan', 'rahasia', 'rahsia', 'kunci', 'รหัสผ่าน', 'กุญแจ', 'ความลับ',
+].join('|'), 'iu');
+function hasSecretKeyword(text) {
+    return CONTEXT_SECRET_KEYWORD_EN.test(text) || CONTEXT_SECRET_KEYWORD_MULTI.test(text);
+}
+const CONTEXT_WINDOW_CHARS = 120;
+function shannonEntropy(value) {
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) || 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+function isHighEntropyToken(token) {
+    // Pure hex (app secrets, HMAC keys): hex charset caps entropy at 4 bits and
+    // excludes most English letters, so a modest bar is already selective.
+    if (/^[A-Fa-f0-9]+$/.test(token)) {
+        return token.length >= 24 && shannonEntropy(token) >= 3.0;
+    }
+    // Mixed charset: the 3.8-bit bar keeps camelCase identifiers and English-y
+    // names out (they sit ~3.0-3.6) while random tokens land at ~4.1+.
+    if (token.length >= 20 && /\d/.test(token) && /[A-Za-z]/.test(token) && shannonEntropy(token) >= 3.8)
+        return true;
+    // KEY=value style: evaluate the assigned value on its own.
+    const assigned = token.includes('=') ? token.split('=').pop() : undefined;
+    if (assigned && assigned !== token && assigned.length >= 20)
+        return isHighEntropyToken(assigned);
+    return false;
+}
+function maskSecretValue(value) {
+    return value.length <= 10 ? '***' : `${value.slice(0, 6)}…${value.slice(-4)} (${value.length} chars)`;
+}
+function findContextualSecret(text) {
+    if (!hasSecretKeyword(text))
+        return undefined;
+    for (const match of text.matchAll(/[A-Za-z0-9_\-+/=]{20,}/g)) {
+        const token = match[0];
+        const index = match.index ?? 0;
+        // Skip tokens inside URLs / file paths — path segments and query params
+        // routinely look random but are not pasteable credentials.
+        const before = text.slice(Math.max(0, index - 2), index);
+        if (/[/\\.]/.test(before))
+            continue;
+        const windowText = text.slice(Math.max(0, index - CONTEXT_WINDOW_CHARS), Math.min(text.length, index + token.length + CONTEXT_WINDOW_CHARS));
+        if (!hasSecretKeyword(windowText.replace(token, '')))
+            continue;
+        if (!isHighEntropyToken(token))
+            continue;
+        return { itemId: 'contextual_secret', label: 'credential-like string near a secret keyword', value: maskSecretValue(token) };
+    }
+    return undefined;
+}
+/** toolArgs like { password: "<random>" } — the keyword lives in the key, not the value. */
+function contextualSecretFromKeyPath(keyPath, value) {
+    const lastKey = keyPath.split('.').pop() || '';
+    if (!hasSecretKeyword(lastKey.replace(/[_-]/g, ' ')))
+        return undefined;
+    const trimmed = value.trim();
+    if (!/^[A-Za-z0-9_\-+/=]+$/.test(trimmed) || !isHighEntropyToken(trimmed))
+        return undefined;
+    return { itemId: 'contextual_secret', label: `credential-like value in "${lastKey}"`, value: maskSecretValue(trimmed) };
+}
 const METADATA_ENDPOINTS = [
     { itemId: 'aws_gcp_metadata_ip', value: '169.254.169.254', label: 'cloud metadata endpoint' },
     { itemId: 'gcp_metadata_host', value: 'metadata.google.internal', label: 'GCP metadata endpoint' },
@@ -358,7 +457,9 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
     }
     if (outbound) {
         for (const candidate of candidates) {
-            const secret = findSecret(candidate.value);
+            const secret = findSecret(candidate.value)
+                || contextualSecretFromKeyPath(candidate.keyPath, candidate.value)
+                || findContextualSecret(candidate.value);
             if (secret) {
                 return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-exfiltration', `Blocked outbound data containing ${secret.label}.`, secret.value, secret.label, options);
             }
@@ -372,7 +473,7 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
     return undefined;
 }
 function scanDeterministicTextResponse(text, options) {
-    const secret = findSecret(text);
+    const secret = findSecret(text) || findContextualSecret(text);
     if (!secret)
         return undefined;
     return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-in-tool-response', `Blocked tool response containing ${secret.label}.`, secret.value, secret.label, options);
@@ -397,6 +498,14 @@ function scanDeterministicPrompt(text, options) {
     if (secret && OUTBOUND_TOOL_HINT.test(trimmed)) {
         return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-secret-exfiltration', `Blocked prompt asking to send ${secret.label}.`, secret.value, secret.label, options);
     }
+    // Pasting a credential next to "secret"/"password"/"api key" wording blocks
+    // even without send intent — once it is in the agent context it can leak
+    // through any later tool call. Known-prefix secrets without such wording
+    // keep the outbound-intent requirement above (devs paste keys to debug).
+    const contextualSecret = findContextualSecret(trimmed);
+    if (contextualSecret) {
+        return builtIn(contextualSecret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-contextual-secret', `Blocked prompt containing ${contextualSecret.label}.`, contextualSecret.value, contextualSecret.label, options);
+    }
     const sensitivePath = containsSensitiveCredentialPath(trimmed);
     if (sensitivePath && bareOrActionIntent(trimmed, /\b(?:read|open|cat|show|print|copy|upload|send|exfiltrate)\b/i)) {
         return builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-prompt-sensitive-credential-path', `Blocked prompt targeting ${sensitivePath.label}.`, trimmed, sensitivePath.label, options);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.6"
+  "version": "1.18.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.6",
+  "version": "1.18.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {