fullcourtdefense-cli 1.21.10 → 1.21.12

package/dist/commands/daemon.js

@@ -51,6 +51,7 @@ const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
+const machineActionVerify_1 = require("../machineActionVerify");
 const desktopChatGuard_1 = require("./desktopChatGuard");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
@@ -531,6 +532,25 @@ async function runDaemon(args, config) {
         if (executingActionIds.has(action.id))
             return;
         executingActionIds.add(action.id);
+        // Cryptographic gate: never execute an action the control plane didn't
+        // sign — a Firestore/backend compromise must not become fleet-wide RCE.
+        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action);
+        if (!verdict.ok) {
+            log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
+            await reportMachineAction(action.id, 'failed', { error: `Signature verification failed: ${verdict.reason}` });
+            executingActionIds.delete(action.id);
+            await uploadLogTail();
+            return;
+        }
+        if (verdict.reason)
+            log(`Remote action signature notice: ${verdict.reason}`);
+        const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
+        if (action.machineId && action.machineId !== localIdentity.machineId) {
+            // Warn-only for now: enrolled machines can carry legacy fingerprints that
+            // differ from the freshly computed identity. Tighten to reject once the
+            // fleet is fully on stable machine ids.
+            log(`Remote action machine-binding notice: action targets ${action.machineId}, local id is ${localIdentity.machineId}.`);
+        }
         await reportMachineAction(action.id, 'running');
         log(`Remote action started: ${action.type} (${action.id}).`);
         await uploadLogTail();

package/dist/commands/login.d.ts

@@ -11,7 +11,7 @@ export interface LoginArgs {
  *
  * The machine authenticates to the org with a reusable fleet token (distributed
  * by IT/MDM), self-enrolls under its stable machine id, and receives a dedicated
- * per-machine Shield (monitor-first). Credentials are written to
+ * per-machine Shield (enforcing by default). Credentials are written to
  * ~/.fullcourtdefense.yml so no manual copy/paste of Shield IDs/keys is needed.
  */
 export declare function loginCommand(args: LoginArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/login.js

@@ -8,7 +8,7 @@ const machineIdentity_1 = require("../machineIdentity");
  *
  * The machine authenticates to the org with a reusable fleet token (distributed
  * by IT/MDM), self-enrolls under its stable machine id, and receives a dedicated
- * per-machine Shield (monitor-first). Credentials are written to
+ * per-machine Shield (enforcing by default). Credentials are written to
  * ~/.fullcourtdefense.yml so no manual copy/paste of Shield IDs/keys is needed.
  */
 async function loginCommand(args, config) {
@@ -58,7 +58,12 @@ async function loginCommand(args, config) {
     });
     console.log('');
     console.log(`\x1b[32m✓ ${result.reused ? 'Re-enrolled' : 'Enrolled'}\x1b[0m  ${result.shieldName}`);
-    console.log(`  Mode:    ${result.mode} (monitor-first — no blocking until you enable enforcement)`);
+    const modeNote = result.mode === 'block'
+        ? 'enforcing — dangerous actions and matching policies are blocked'
+        : result.mode === 'monitor'
+            ? 'monitor — actions are logged but not blocked'
+            : 'shadow — evaluation only, nothing is blocked';
+    console.log(`  Mode:    ${result.mode} (${modeNote}). Change it anytime from the dashboard.`);
     console.log(`  Config:  ${savedPath}`);
     console.log('');
     console.log('Next: \x1b[1mfullcourtdefense install-all\x1b[0m to wrap your MCP clients and install available runtime hooks.');

package/dist/commands/onboard.js

@@ -419,7 +419,7 @@ async function onboardCommand(args, config) {
     const dashboard = (0, notify_1.consoleUrl)('/agent-security/users?view=desktop');
     console.log('');
     if (requiredFailures.length === 0) {
-        console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet (monitor-first until an admin enables enforcement).`);
+        console.log(`${GREEN}${BOLD}This machine is protected.${RESET} It reports to your org's AI Fleet and enforces your policies (dangerous actions are blocked). An admin can switch it to monitor-only from the dashboard.`);
         console.log(`${DIM}Fleet view: ${dashboard}${RESET}`);
         console.log(`${DIM}Restart your AI clients (Cursor, Claude, VS Code, …) so they pick up the wrapped configs.${RESET}`);
         mark('verification', 'completed');

package/dist/machineActionVerify.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Ed25519 verification for remote machine actions pulled from the control
+ * plane (GET /api/cli/bundle -> machineAction).
+ *
+ * The daemon must not execute an action just because the backend returned it:
+ * a compromised backend/Firestore or stolen admin session could queue actions
+ * for the whole fleet. Every action is signed server-side with a private key
+ * held in GCP Secret Manager; this module re-builds the canonical payload and
+ * verifies the signature against the public key pinned below.
+ *
+ * Enforcement: when a pinned/override public key is available, actions with a
+ * missing or invalid signature are REJECTED. `FCD_MACHINE_ACTION_UNSIGNED_OK=1`
+ * is an explicit, loudly-logged local escape hatch for rollout emergencies.
+ *
+ * Keep the canonical payload construction in sync with
+ * backend/src/modules/discovery/machine-action-signing.ts.
+ */
+export declare const MACHINE_ACTION_SIGNATURE_VERSION = "fcd-machine-action-v1";
+export interface VerifiableMachineAction {
+    id: string;
+    type: string;
+    reason: string;
+    createdAt: string;
+    expiresAt: string;
+    organizationId?: string;
+    machineId?: string;
+    signature?: {
+        signature: string;
+        keyId: string;
+        alg: string;
+        version: string;
+    };
+}
+export interface MachineActionVerdict {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Verify a machine action before execution. Rejects when:
+ *  - the signature is missing (unless the local escape hatch is set),
+ *  - the signature's keyId is unknown,
+ *  - the Ed25519 verification fails (any signed field was tampered with),
+ *  - the action is already expired.
+ */
+export declare function verifyMachineAction(action: VerifiableMachineAction): MachineActionVerdict;

package/dist/machineActionVerify.js

@@ -0,0 +1,134 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_ACTION_SIGNATURE_VERSION = void 0;
+exports.verifyMachineAction = verifyMachineAction;
+const crypto = __importStar(require("crypto"));
+/**
+ * Ed25519 verification for remote machine actions pulled from the control
+ * plane (GET /api/cli/bundle -> machineAction).
+ *
+ * The daemon must not execute an action just because the backend returned it:
+ * a compromised backend/Firestore or stolen admin session could queue actions
+ * for the whole fleet. Every action is signed server-side with a private key
+ * held in GCP Secret Manager; this module re-builds the canonical payload and
+ * verifies the signature against the public key pinned below.
+ *
+ * Enforcement: when a pinned/override public key is available, actions with a
+ * missing or invalid signature are REJECTED. `FCD_MACHINE_ACTION_UNSIGNED_OK=1`
+ * is an explicit, loudly-logged local escape hatch for rollout emergencies.
+ *
+ * Keep the canonical payload construction in sync with
+ * backend/src/modules/discovery/machine-action-signing.ts.
+ */
+exports.MACHINE_ACTION_SIGNATURE_VERSION = 'fcd-machine-action-v1';
+/**
+ * Production control-plane public key (keyId v1). Rotations ship a new CLI
+ * release with the additional key appended.
+ */
+const EMBEDDED_PUBLIC_KEYS_PEM = {
+    v1: `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAbzPhAyATO3n6FL0rfPmlmFa8xz7VABNlU9iOh0GwucI=
+-----END PUBLIC KEY-----`,
+};
+function toIso(value) {
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? '' : parsed.toISOString();
+}
+function canonicalPayload(action) {
+    return Buffer.from(JSON.stringify([
+        exports.MACHINE_ACTION_SIGNATURE_VERSION,
+        action.id,
+        action.organizationId || '',
+        action.machineId || '',
+        action.type,
+        action.reason,
+        toIso(action.createdAt),
+        toIso(action.expiresAt),
+    ]), 'utf8');
+}
+/** Resolve the verification key for a signature keyId (env override wins — staging/tests). */
+function resolvePublicKeyPem(keyId) {
+    const override = process.env.FCD_MACHINE_ACTION_PUBLIC_KEY?.trim();
+    if (override) {
+        return override.includes('-----BEGIN')
+            ? override
+            : Buffer.from(override, 'base64').toString('utf8');
+    }
+    return EMBEDDED_PUBLIC_KEYS_PEM[keyId];
+}
+function unsignedAllowed() {
+    return process.env.FCD_MACHINE_ACTION_UNSIGNED_OK === '1';
+}
+/**
+ * Verify a machine action before execution. Rejects when:
+ *  - the signature is missing (unless the local escape hatch is set),
+ *  - the signature's keyId is unknown,
+ *  - the Ed25519 verification fails (any signed field was tampered with),
+ *  - the action is already expired.
+ */
+function verifyMachineAction(action) {
+    const expiresAt = Date.parse(action.expiresAt);
+    if (Number.isFinite(expiresAt) && expiresAt <= Date.now()) {
+        return { ok: false, reason: 'Action is expired.' };
+    }
+    if (!action.signature?.signature) {
+        if (unsignedAllowed()) {
+            return { ok: true, reason: 'UNSIGNED action accepted via FCD_MACHINE_ACTION_UNSIGNED_OK=1.' };
+        }
+        return {
+            ok: false,
+            reason: 'Action is not signed by the control plane. Rejected: this CLI requires Ed25519-signed remote actions (provision MACHINE_ACTION_SIGNING_KEY on the backend).',
+        };
+    }
+    const { signature } = action;
+    if (signature.alg !== 'ed25519' || signature.version !== exports.MACHINE_ACTION_SIGNATURE_VERSION) {
+        return { ok: false, reason: `Unsupported signature scheme (${signature.alg}/${signature.version}).` };
+    }
+    const publicKeyPem = resolvePublicKeyPem(signature.keyId);
+    if (!publicKeyPem) {
+        return { ok: false, reason: `No pinned public key for signing keyId "${signature.keyId}" — upgrade the CLI or check FCD_MACHINE_ACTION_PUBLIC_KEY.` };
+    }
+    try {
+        const key = crypto.createPublicKey(publicKeyPem);
+        const valid = crypto.verify(null, canonicalPayload(action), key, Buffer.from(signature.signature, 'base64'));
+        return valid
+            ? { ok: true }
+            : { ok: false, reason: 'Invalid signature — the action payload does not match what the control plane signed.' };
+    }
+    catch (error) {
+        return { ok: false, reason: `Signature verification error: ${error.message}` };
+    }
+}

package/dist/runtimeConfig.d.ts

@@ -40,6 +40,16 @@ export interface RuntimeBundle {
         reason: string;
         createdAt: string;
         expiresAt: string;
+        /** Signed fields — present so the daemon can re-build the canonical payload. */
+        organizationId?: string;
+        machineId?: string;
+        /** Ed25519 control-plane signature; the daemon rejects unsigned/invalid actions. */
+        signature?: {
+            signature: string;
+            keyId: string;
+            alg: string;
+            version: string;
+        };
     };
 }
 export interface FetchBundleInput {

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.10"
+  "version": "1.21.12"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.10",
+  "version": "1.21.12",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -31,6 +31,7 @@
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "test:daemon-e2e": "npm run build && node scripts/test-daemon-e2e.js",
+    "test:machine-action-signing": "npm run build && node scripts/test-machine-action-signing.js",
     "test:integrity": "npm run build && node scripts/test-integrity.js",
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",