fullcourtdefense-cli 1.21.21 → 1.21.23

package/dist/commands/deterministicGuard.js

@@ -413,6 +413,33 @@ function isSqlContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return SQL_TOOL_HINT.test(toolName) || SQL_KEYS.has(lastKey) || SQL_KEYS.has(candidate.keyPath);
 }
+/**
+ * Metadata SSRF only matters where the string can actually BECOME a request: a shell
+ * command, an outbound/HTTP tool, or a URL-typed argument. Source code or file contents
+ * that merely MENTION the endpoint (e.g. editing a file that implements an SSRF guard)
+ * must not block — the unconditional match over-blocked ordinary development work.
+ */
+function isMetadataRequestContext(toolName, candidate) {
+    if (isCommandContext(toolName, candidate))
+        return true;
+    if (OUTBOUND_TOOL_HINT.test(toolName))
+        return true;
+    const lastKey = candidate.keyPath.split('.').pop() || '';
+    return /(?:url|uri|endpoint|host|address|webhook)/i.test(lastKey);
+}
+/**
+ * Sensitive credential PATHS only matter where the string is used AS a path (a file access,
+ * a path-typed argument) or inside a command. File CONTENTS being written/edited routinely
+ * mention such paths legitimately (security tooling source, tests, docs) and must not block.
+ */
+function isSensitivePathContext(toolName, candidate) {
+    if (isCommandContext(toolName, candidate))
+        return true;
+    if (/(?:read|open|cat|copy|download|upload|access|stat|list|glob|search|find|grep)/i.test(toolName))
+        return true;
+    const lastKey = candidate.keyPath.split('.').pop() || '';
+    return /(?:path|file|filename|dir|directory|target|source|src|dest|location|glob|pattern|uri|url)/i.test(lastKey);
+}
 function scanTextValue(toolName, value, options) {
     const custom = customBlock(value, options);
     if (custom)
@@ -443,17 +470,42 @@ function scanTextValue(toolName, value, options) {
     }
     return undefined;
 }
+/**
+ * A string can only DO something in an actionable context: a shell command, an outbound
+ * request, or a path/target argument. File CONTENTS being written or edited are inert —
+ * mentioning a blocked path/endpoint/pattern in source code, tests, or docs is normal
+ * development work and must never block (see isMetadataRequestContext / isSensitivePathContext).
+ */
+function isActionableContext(toolName, candidate) {
+    return isCommandContext(toolName, candidate)
+        || isSensitivePathContext(toolName, candidate)
+        || OUTBOUND_TOOL_HINT.test(toolName);
+}
 function scanDeterministicToolCall(toolName, toolArgs, options) {
     const candidates = collectStrings(toolArgs);
     const outbound = isOutboundContext(toolName, candidates);
     for (const candidate of candidates) {
+        // Custom rules ("block AI agents from touching this path/pattern") follow the same
+        // context principle as built-ins: enforce on access/execution/egress, not on editing
+        // file contents that merely mention the pattern.
+        if (!isActionableContext(toolName, candidate))
+            continue;
         const custom = customBlock(candidate.value, options);
         if (custom)
             return custom;
     }
     for (const candidate of candidates) {
         const finding = scanTextValue(toolName, candidate.value, options);
-        if (finding && (isCommandContext(toolName, candidate) || finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf'))
+        if (!finding)
+            continue;
+        // Context gates: a pattern is only dangerous where it can act — a command, a request
+        // target, or a path being accessed. A bare mention inside file contents / source code
+        // being written (e.g. editing security tooling or its tests) must not block.
+        if (finding.category === 'metadata_ssrf' && !isMetadataRequestContext(toolName, candidate))
+            continue;
+        if (finding.category === 'sensitive_file' && !isSensitivePathContext(toolName, candidate))
+            continue;
+        if (isCommandContext(toolName, candidate) || finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf')
             return finding;
     }
     for (const candidate of candidates) {

package/dist/commands/mcpGateway.js

@@ -876,8 +876,19 @@ class McpGatewayServer {
                     }
                 }
                 else {
-                    const reason = preflight.actionPolicy?.reason || preflight.intentEvaluation?.reasons?.[0] || `Tool call ${preflight.decision}.`;
-                    throw new Error(reason);
+                    // Detailed, self-explanatory block message: WHICH policy fired, WHAT rule matched,
+                    // and where to review it — so the developer (and the AI agent relaying the error)
+                    // can tell exactly why the call was refused instead of guessing.
+                    const policy = preflight.actionPolicy;
+                    const parts = [];
+                    parts.push(policy?.reason || preflight.intentEvaluation?.reasons?.[0] || `Tool call ${preflight.decision} by FullCourtDefense.`);
+                    if (policy?.policyName)
+                        parts.push(`Policy: "${policy.policyName}"`);
+                    if (policy?.matchedRule)
+                        parts.push(`Matched rule: ${policy.matchedRule}`);
+                    parts.push(`Tool: ${toolName}${operation && operation !== toolName ? ` (operation: ${operation})` : ''}`);
+                    parts.push(`Review or change this policy in the FullCourtDefense console → Agent Security → Policies.`);
+                    throw new Error(parts.join(' | '));
                 }
             }
             const rawResult = await this.downstream.callTool(toolName, toolArgs);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.21"
+  "version": "1.21.23"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.21",
+  "version": "1.21.23",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
+    "test:guard-content-context": "npm run build && node scripts/test-guard-content-context.js",
     "test:browser-credentials-rule": "npm run build && node scripts/test-browser-credentials-rule.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",