fullcourtdefense-cli 1.18.6 → 1.18.8

package/dist/commands/daemon.js

@@ -465,6 +465,67 @@ async function runDaemon(args, config) {
             log(`Could not report remote action ${actionId} status ${status}; the server will expire it safely.`);
         }
     };
+    // ── Honest upgrade_cli completion ─────────────────────────────────────────
+    // An MSI/npm upgrade replaces THIS process: the daemon that triggered the
+    // update cannot observe the outcome. Persist the action id, let the freshly
+    // upgraded daemon (or a stale-marker check) report the REAL result — the
+    // dashboard should never show "succeeded" for a version that never arrived.
+    const pendingUpgradeFile = () => path.join(daemonDir(), 'pending-upgrade.json');
+    const PENDING_UPGRADE_STALE_MS = 15 * 60_000;
+    const writePendingUpgradeMarker = (actionId, target) => {
+        try {
+            fs.writeFileSync(pendingUpgradeFile(), JSON.stringify({
+                actionId,
+                target,
+                fromVersion: cliVersion(),
+                startedAt: new Date().toISOString(),
+            }), 'utf8');
+        }
+        catch { /* marker is best-effort; the server TTL expires the action safely */ }
+    };
+    const verifyPendingUpgrade = async () => {
+        let marker;
+        try {
+            marker = JSON.parse(fs.readFileSync(pendingUpgradeFile(), 'utf8'));
+        }
+        catch {
+            return; // no pending upgrade
+        }
+        if (!marker?.actionId || !marker.target) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            return;
+        }
+        const current = cliVersion();
+        if (compareVersions(current, marker.target) >= 0) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            await reportMachineAction(marker.actionId, 'succeeded', {
+                resultSummary: `CLI updated to ${current} and the daemon restarted on the new build.`,
+            });
+            log(`Upgrade verified: CLI ${marker.fromVersion || 'unknown'} -> ${current} is live (action ${marker.actionId}).`);
+            await uploadLogTail();
+            return;
+        }
+        const startedAt = marker.startedAt ? Date.parse(marker.startedAt) : NaN;
+        if (!Number.isFinite(startedAt) || Date.now() - startedAt > PENDING_UPGRADE_STALE_MS) {
+            try {
+                fs.unlinkSync(pendingUpgradeFile());
+            }
+            catch { /* ignore */ }
+            await reportMachineAction(marker.actionId, 'failed', {
+                error: `The updater was triggered but the CLI still reports ${current || 'unknown'} after ${Math.round(PENDING_UPGRADE_STALE_MS / 60_000)} minutes (target ${marker.target}). Check %ProgramData%\\FullCourtDefense\\updater.log on the machine.`,
+            });
+            log(`Upgrade verification failed: still on ${current || 'unknown'}, target was ${marker.target} (action ${marker.actionId}).`);
+            await uploadLogTail();
+        }
+        // Otherwise the install is still in flight — keep the marker and re-check
+        // on the next heartbeat; the post-install daemon relaunch settles it.
+    };
     const executeMachineAction = async (action) => {
         if (executingActionIds.has(action.id))
             return;
@@ -547,7 +608,14 @@ async function runDaemon(args, config) {
                     resultSummary = `CLI ${cliVersion() || 'unknown'} is already at ${target}.`;
                 }
                 else if (outcome.started) {
-                    resultSummary = outcome.detail;
+                    // The install replaces this process — DON'T report success yet.
+                    // Leave the action "running" with a marker; the freshly upgraded
+                    // daemon confirms the new version (or the check reports failure).
+                    writePendingUpgradeMarker(action.id, target);
+                    log(`Upgrade CLI: installer started — success will be confirmed once the new daemon is on ${target}.`);
+                    executingActionIds.delete(action.id);
+                    await uploadLogTail();
+                    return;
                 }
                 else {
                     throw new Error(outcome.detail);
@@ -660,10 +728,16 @@ async function runDaemon(args, config) {
             await uploadLogTail();
         }
         catch { /* spool stays on disk for the next tick */ }
+        // Settle any in-flight upgrade_cli action (success once the new build is
+        // live, failure when the target never arrived).
+        await verifyPendingUpgrade();
     };
     // --- boot ---------------------------------------------------------------
     const watched = refreshWatchTargets();
     log(`Watching ${watched} config file(s) across ${watchers.size} director${watchers.size === 1 ? 'y' : 'ies'}.`);
+    // First: if this boot IS the post-upgrade relaunch, confirm the pending
+    // upgrade_cli action before anything else touches the control plane.
+    await verifyPendingUpgrade();
     await pollBundle();
     // One protective pass at startup so a machine that drifted while the daemon
     // was down converges immediately. Runs BEFORE the first heartbeat: upgrades

package/dist/commands/deterministicGuard.js

@@ -52,6 +52,105 @@ const SECRET_PATTERNS = [
     { itemId: 'huggingface_token', label: 'HuggingFace token', re: /\bhf_[A-Za-z0-9]{30,}\b/ },
     { itemId: 'database_url_password', label: 'database URL with password', re: /\b(?:postgres(?:ql)?|mongodb(?:\+srv)?|mysql):\/\/[^/\s'":]+:[^@\s'"]+@/i },
 ];
+// Contextual secret detection: bare high-entropy strings (hex app secrets,
+// random tokens) have no recognizable prefix, so SECRET_PATTERNS misses them.
+// When one sits next to a credential keyword ("secret", "password", "api key"
+// ...), treat it as secret material. Keyword proximity keeps git SHAs, UUIDs
+// in URLs, and hashes in ordinary output from false-positiving.
+// English terms use \b word boundaries (so "tokenizer" does not match "token").
+// Deliberately canonical words only — no typo/shorthand variants (pswd, scrt,
+// ...). A deterministic guard must stay predictable; typo evasion is handled
+// by the cloud tier (meta-safety specialist is typo-augmented).
+const CONTEXT_SECRET_KEYWORD_EN = /\b(?:secret|password|passwd|pwd|credential|passphrase|api[ _-]?key|apikey|access[ _-]?key|private[ _-]?key|client[ _-]?secret|app[ _-]?secret|signing[ _-]?key|auth[ _-]?token|bearer|token)\b/i;
+// Language-agnostic pack: password/secret/key words across common languages.
+// No \b — JS word boundaries break on diacritics and non-Latin scripts. Broad
+// everyday words ("clave", "chiave", "ключ") are safe to include because a
+// keyword NEVER blocks alone: a high-entropy credential-looking token must
+// also sit within the context window.
+const CONTEXT_SECRET_KEYWORD_MULTI = new RegExp([
+    // Romance: Romanian (first customer — parola/parolă, cheie/cheia/cheile,
+    // credențial; "secret"/"token" are identical to English and covered there),
+    // Spanish, French, Italian, Portuguese
+    'parol', 'chei', 'credenția', 'credentia', 'contraseñ', 'clave', 'mot de passe', 'clé', 'jeton', 'chiave', 'segret', 'senha', 'chave', 'segredo',
+    // Germanic: German, Dutch, Swedish, Norwegian, Danish
+    'passwort', 'kennwort', 'schlüssel', 'geheim', 'wachtwoord', 'sleutel', 'lösenord', 'løsenord', 'passord', 'adgangskode', 'nøkkel', 'hemlig',
+    // Slavic (Latin + Cyrillic): Polish, Czech, Russian, Ukrainian, Bulgarian, Serbian
+    'hasło', 'haslo', 'klucz', 'sekret', 'heslo', 'klíč', 'geslo', 'пароль', 'парол', 'ключ', 'секрет', 'токен',
+    // Turkish, Hungarian, Finnish, Greek
+    'şifre', 'sifre', 'anahtar', 'gizli', 'jelszó', 'jelszo', 'kulcs', 'titok', 'salasana', 'avain', 'salainen', 'κωδικ', 'μυστικ', 'κλειδ',
+    // Hebrew, Arabic, Persian
+    'סיסמה', 'סיסמא', 'מפתח', 'סוד', 'كلمة المرور', 'كلمة السر', 'مفتاح', 'رمز سري', 'رمز', 'گذرواژه', 'رمز عبور',
+    // Indic: Hindi, Bengali, Tamil
+    'पासवर्ड', 'कुंजी', 'गुप्त', 'পাসওয়ার্ড', 'கடவுச்சொல்',
+    // CJK: Chinese (simplified + traditional), Japanese, Korean
+    '密码', '密碼', '密钥', '密鑰', '口令', '令牌', '秘钥', 'パスワード', 'トークン', '秘密鍵', '비밀번호', '암호', '토큰', '비밀 키',
+    // Vietnamese, Indonesian/Malay, Thai
+    'mật khẩu', 'bí mật', 'kata sandi', 'kata laluan', 'rahasia', 'rahsia', 'kunci', 'รหัสผ่าน', 'กุญแจ', 'ความลับ',
+].join('|'), 'iu');
+function hasSecretKeyword(text) {
+    return CONTEXT_SECRET_KEYWORD_EN.test(text) || CONTEXT_SECRET_KEYWORD_MULTI.test(text);
+}
+const CONTEXT_WINDOW_CHARS = 120;
+function shannonEntropy(value) {
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) || 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+function isHighEntropyToken(token) {
+    // Pure hex (app secrets, HMAC keys): hex charset caps entropy at 4 bits and
+    // excludes most English letters, so a modest bar is already selective.
+    if (/^[A-Fa-f0-9]+$/.test(token)) {
+        return token.length >= 24 && shannonEntropy(token) >= 3.0;
+    }
+    // Mixed charset: the 3.8-bit bar keeps camelCase identifiers and English-y
+    // names out (they sit ~3.0-3.6) while random tokens land at ~4.1+.
+    if (token.length >= 20 && /\d/.test(token) && /[A-Za-z]/.test(token) && shannonEntropy(token) >= 3.8)
+        return true;
+    // KEY=value style: evaluate the assigned value on its own.
+    const assigned = token.includes('=') ? token.split('=').pop() : undefined;
+    if (assigned && assigned !== token && assigned.length >= 20)
+        return isHighEntropyToken(assigned);
+    return false;
+}
+function maskSecretValue(value) {
+    return value.length <= 10 ? '***' : `${value.slice(0, 6)}…${value.slice(-4)} (${value.length} chars)`;
+}
+function findContextualSecret(text) {
+    if (!hasSecretKeyword(text))
+        return undefined;
+    for (const match of text.matchAll(/[A-Za-z0-9_\-+/=]{20,}/g)) {
+        const token = match[0];
+        const index = match.index ?? 0;
+        // Skip tokens inside URLs / file paths — path segments and query params
+        // routinely look random but are not pasteable credentials.
+        const before = text.slice(Math.max(0, index - 2), index);
+        if (/[/\\.]/.test(before))
+            continue;
+        const windowText = text.slice(Math.max(0, index - CONTEXT_WINDOW_CHARS), Math.min(text.length, index + token.length + CONTEXT_WINDOW_CHARS));
+        if (!hasSecretKeyword(windowText.replace(token, '')))
+            continue;
+        if (!isHighEntropyToken(token))
+            continue;
+        return { itemId: 'contextual_secret', label: 'credential-like string near a secret keyword', value: maskSecretValue(token) };
+    }
+    return undefined;
+}
+/** toolArgs like { password: "<random>" } — the keyword lives in the key, not the value. */
+function contextualSecretFromKeyPath(keyPath, value) {
+    const lastKey = keyPath.split('.').pop() || '';
+    if (!hasSecretKeyword(lastKey.replace(/[_-]/g, ' ')))
+        return undefined;
+    const trimmed = value.trim();
+    if (!/^[A-Za-z0-9_\-+/=]+$/.test(trimmed) || !isHighEntropyToken(trimmed))
+        return undefined;
+    return { itemId: 'contextual_secret', label: `credential-like value in "${lastKey}"`, value: maskSecretValue(trimmed) };
+}
 const METADATA_ENDPOINTS = [
     { itemId: 'aws_gcp_metadata_ip', value: '169.254.169.254', label: 'cloud metadata endpoint' },
     { itemId: 'gcp_metadata_host', value: 'metadata.google.internal', label: 'GCP metadata endpoint' },
@@ -358,7 +457,9 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
     }
     if (outbound) {
         for (const candidate of candidates) {
-            const secret = findSecret(candidate.value);
+            const secret = findSecret(candidate.value)
+                || contextualSecretFromKeyPath(candidate.keyPath, candidate.value)
+                || findContextualSecret(candidate.value);
             if (secret) {
                 return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-exfiltration', `Blocked outbound data containing ${secret.label}.`, secret.value, secret.label, options);
             }
@@ -372,7 +473,7 @@ function scanDeterministicToolCall(toolName, toolArgs, options) {
     return undefined;
 }
 function scanDeterministicTextResponse(text, options) {
-    const secret = findSecret(text);
+    const secret = findSecret(text) || findContextualSecret(text);
     if (!secret)
         return undefined;
     return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-in-tool-response', `Blocked tool response containing ${secret.label}.`, secret.value, secret.label, options);
@@ -397,6 +498,14 @@ function scanDeterministicPrompt(text, options) {
     if (secret && OUTBOUND_TOOL_HINT.test(trimmed)) {
         return builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-secret-exfiltration', `Blocked prompt asking to send ${secret.label}.`, secret.value, secret.label, options);
     }
+    // Pasting a credential next to "secret"/"password"/"api key" wording blocks
+    // even without send intent — once it is in the agent context it can leak
+    // through any later tool call. Known-prefix secrets without such wording
+    // keep the outbound-intent requirement above (devs paste keys to debug).
+    const contextualSecret = findContextualSecret(trimmed);
+    if (contextualSecret) {
+        return builtIn(contextualSecret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-contextual-secret', `Blocked prompt containing ${contextualSecret.label}.`, contextualSecret.value, contextualSecret.label, options);
+    }
     const sensitivePath = containsSensitiveCredentialPath(trimmed);
     if (sensitivePath && bareOrActionIntent(trimmed, /\b(?:read|open|cat|show|print|copy|upload|send|exfiltrate)\b/i)) {
         return builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-prompt-sensitive-credential-path', `Blocked prompt targeting ${sensitivePath.label}.`, trimmed, sensitivePath.label, options);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.6"
+  "version": "1.18.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.6",
+  "version": "1.18.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {