fullcourtdefense-cli 1.21.37 → 1.21.39

package/dist/commands/daemon.js

@@ -602,11 +602,21 @@ async function runDaemon(args, config) {
                 .split(/\r?\n/).map(line => line.trim()).filter(Boolean).slice(-200).map(line => line.slice(0, 400));
         }
         catch { /* log unreadable — the bundle reports everything else */ }
+        // The hook's own log — what the developer's IDE actually experienced
+        // (verdicts, timeouts, fail-closed decisions). Metadata-only by default;
+        // content previews exist only when support opted into FCD_HOOK_DEBUG.
+        let hookLogTail = [];
+        try {
+            hookLogTail = fs.readFileSync(path.join(os.homedir(), '.fullcourtdefense-hook.log'), 'utf8')
+                .split(/\r?\n/).map(line => line.trim()).filter(Boolean).slice(-80).map(line => line.slice(0, 400));
+        }
+        catch { /* no hook activity on this machine yet */ }
         return {
             cliVersion: cliVersion(),
             platform: process.platform,
             collectedAt: new Date().toISOString(),
             daemonLogTail,
+            hookLogTail,
             updaterLogTail: (0, selfUpdate_1.readUpdaterLogTail)(60),
             distress: (0, distress_1.readDistressLedger)(),
             credentialTrace: (0, config_1.getCredentialResolutionTrace)(),

package/dist/commands/deterministicGuard.d.ts

@@ -26,6 +26,13 @@ export interface LocalSafetyScanOptions {
     inspectScripts?: boolean;
     /** Absolute paths of planted honeypot decoy files — ANY reference blocks. */
     honeypotPaths?: string[];
+    /**
+     * Org-managed trusted script paths (substring match on the normalized path).
+     * Content scanning is skipped for referenced scripts under these paths — the
+     * admin-controlled exception for repos whose test suites legitimately contain
+     * attack fixtures (security tooling, guard regression tests).
+     */
+    trustedScriptPaths?: string[];
 }
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -372,8 +372,16 @@ function destructiveCommandReason(value) {
         return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
     if (/\b(?:del|erase)\s+\/[a-z]*s[a-z]*\s+\/[a-z]*q[a-z]*\s+[a-z]:\\(?:\s|$)/i.test(text))
         return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
-    if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force') && /[a-z]:\\?(?:\s|$)/i.test(text))
+    // Drive-ROOT Remove-Item only: the bare drive (C:\) must be an argument of
+    // the SAME Remove-Item command (no ;|& between them). The previous loose
+    // drive-letter match flagged ANY text containing Remove-Item -Recurse
+    // -Force plus an unrelated "x: " pattern — e.g. our own installer's
+    // legitimate cleanup script, blocking a customer's git command that merely
+    // referenced it.
+    if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force')
+        && /remove-item\b[^;|&]{0,80}?["']?\b[a-z]:[\\/]?["']?(?=\s|$|[;&|])/i.test(text)) {
         return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
+    }
     if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
         return { itemId: 'fork_bomb', reason: 'fork bomb' };
     if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
@@ -438,9 +446,27 @@ function infraDestroyReason(value) {
         return { itemId: 'az_group_delete_yes', reason: 'Azure resource group deletion' };
     return undefined;
 }
+/**
+ * Local file editors (Write / StrReplace / edit_file / EditNotebook / apply_patch ...)
+ * write to DISK — that is not egress. Their contents/new_string arguments legitimately
+ * carry secret-shaped fixtures (test suites, docs, security tooling source), and the
+ * `content(s)` key name otherwise matches the outbound-payload heuristic, which blocked
+ * editing our own guard test files. Real exfiltration is still caught at the actual
+ * egress point (outbound/HTTP tools, shell commands), where secret rules apply unchanged.
+ */
+function isLocalFileEditor(toolName, candidates) {
+    if (!/(?:write|edit|replace|patch|notebook|create)/i.test(toolName))
+        return false;
+    return candidates.some(candidate => {
+        const lastKey = (candidate.keyPath.split('.').pop() || '').toLowerCase();
+        return ['path', 'file', 'filename', 'file_path', 'filepath', 'target_file', 'target_notebook'].includes(lastKey);
+    });
+}
 function isOutboundContext(toolName, candidates) {
     if (OUTBOUND_TOOL_HINT.test(toolName))
         return true;
+    if (isLocalFileEditor(toolName, candidates))
+        return false;
     return candidates.some(candidate => /(?:url|uri|webhook|endpoint|recipient|channel|email|to|body|payload|message|content)/i.test(candidate.keyPath));
 }
 function isCommandContext(toolName, candidate) {
@@ -485,13 +511,20 @@ function scanTextValue(toolName, value, options) {
     const custom = customBlock(value, options);
     if (custom)
         return custom;
+    // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
+    // scan — otherwise turning off (or gating) a path rule would mask a real
+    // reverse shell / destructive command in the same value.
     const sensitivePath = containsSensitiveCredentialPath(value);
     if (sensitivePath) {
-        return builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', `Blocked local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', `Blocked local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        if (finding)
+            return finding;
     }
     const metadata = containsMetadataEndpoint(value);
     if (metadata) {
-        return builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, value, metadata.value, options);
+        const finding = builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, value, metadata.value, options);
+        if (finding)
+            return finding;
     }
     const reverseShell = reverseShellReason(value);
     if (reverseShell) {
@@ -699,8 +732,48 @@ function referencedScripts(command, cwd) {
     }
     return Array.from(new Set(scripts));
 }
+/**
+ * Verbs that make a sensitive path / metadata endpoint on a script line ACTIONABLE:
+ * reading, copying, uploading, or requesting it. A mere string mention (test fixture,
+ * detector regex, doc comment) has none of these on the same line.
+ */
+// Collision-hardened forms: `ssh` must be a command start (NOT the `.ssh` of the
+// flagged path itself), `type` the cmd.exe read form (`type file`, not `type:` in
+// JSON/TS fixtures), `open` a call (`open(`), `requests.*` a python HTTP call.
+const SCRIPT_ACCESS_VERB = /\b(?:cat|gc|get-content|get-item|copy(?:-item)?|cp|xcopy|robocopy|move(?:-item)?|mv|scp|sftp|rsync|curl|wget|invoke-webrequest|invoke-restmethod|iwr|irm|openssl|tar|zip|7z|certutil|base64|readfile(?:sync)?|createreadstream|read_text|read_bytes|fopen|urlopen|fetch|upload|download)\b|\btype\s+\S|(?:^|[^.\w])ssh(?:-add|-keygen|\.exe)?\s|\bopen\s*\(|\brequests\.\w+\s*\(/i;
+/**
+ * A path/metadata finding inside a referenced script only counts when some LINE both
+ * contains the flagged pattern AND acts on it. Scripts (and their tests, and security
+ * tooling) routinely mention credential paths as inert strings — "found inside
+ * referenced script" used to block running our own guard test suite over fixtures.
+ */
+function scriptActsOnFinding(content, category) {
+    const matcher = category === 'sensitive_file'
+        ? (line) => Boolean(containsSensitiveCredentialPath(line))
+        : (line) => Boolean(containsMetadataEndpoint(line));
+    for (const rawLine of content.split(/\r?\n/)) {
+        if (!rawLine || rawLine.length > 4000)
+            continue;
+        if (matcher(rawLine) && SCRIPT_ACCESS_VERB.test(rawLine))
+            return true;
+    }
+    return false;
+}
+/** Org-trusted script paths (from the Local Safety snapshot): skip content scanning. */
+function isTrustedScriptPath(script, options) {
+    const trusted = options?.trustedScriptPaths;
+    if (!trusted || trusted.length === 0)
+        return false;
+    const normalized = normalizeForPath(script);
+    return trusted.some(entry => {
+        const pattern = normalizeForPath(String(entry || '')).replace(/\/+$/, '');
+        return pattern.length >= 3 && normalized.includes(pattern);
+    });
+}
 function scanReferencedScript(command, cwd, options) {
     for (const script of referencedScripts(command, cwd)) {
+        if (isTrustedScriptPath(script, options))
+            continue;
         let content = '';
         if (script.startsWith('npm:')) {
             content = script;
@@ -716,7 +789,18 @@ function scanReferencedScript(command, cwd, options) {
                 continue;
             }
         }
-        const finding = scanTextValue('script_file', content, options);
+        // Path/metadata findings must be ACTIONABLE inside the script; suppress inert
+        // string mentions and rescan so command-shaped rules (reverse shell, destructive
+        // delete...) in the SAME file still surface.
+        let scanOptions = options;
+        let finding = scanTextValue('script_file', content, scanOptions);
+        while (finding
+            && (finding.category === 'sensitive_file' || finding.category === 'metadata_ssrf')
+            && !scriptActsOnFinding(content, finding.category)) {
+            const baseDisabled = scanOptions?.disabledBuiltInItemIds || Array.from(DEFAULT_DISABLED_BUILT_INS);
+            scanOptions = { ...(scanOptions || {}), disabledBuiltInItemIds: [...baseDisabled, finding.itemId] };
+            finding = scanTextValue('script_file', content, scanOptions);
+        }
         if (!finding)
             continue;
         return {

package/dist/commands/hook.js

@@ -533,6 +533,16 @@ function machineMetadata(client = 'cursor') {
         agentClient: client,
     };
 }
+/**
+ * The developer-facing block line must answer "WHO blocked me and where do I
+ * see/manage it" in one glance — a bare reason string left developers unable
+ * to tell a built-in rule from an org policy or to find the console entry.
+ */
+function localBlockUserMessage(finding) {
+    const origin = finding.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+    return `Blocked by FullCourtDefense local guard — ${finding.reason}`
+        + ` [${origin} "${finding.itemId}" — logged to your org's console (machine timeline); admins manage rules under Shield → Local Safety]`;
+}
 function spoolLocalFinding(input) {
     (0, telemetry_1.spoolEvent)({
         decision: 'block',
@@ -767,7 +777,7 @@ async function hookCommand(args, config) {
                 return;
             }
             spoolLocalFinding({ finding: localBlock, toolName: 'prompt', operation: 'prompt' });
-            respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this prompt locally (${localBlock.ruleId}). Do not retry.`);
+            respond(true, localBlockUserMessage(localBlock), `FullCourtDefense blocked this prompt locally (${localBlock.ruleId}). Do not retry.`);
             return;
         }
         if (localOnly) {
@@ -811,7 +821,7 @@ async function enforceActionPolicy(ctx) {
             return;
         }
         spoolLocalFinding({ finding: localBlock, toolName: call.toolName, operation: event });
-        respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this ${event} locally (${localBlock.ruleId}). Do not retry.`);
+        respond(true, localBlockUserMessage(localBlock), `FullCourtDefense blocked this ${event} locally (${localBlock.ruleId}). Do not retry.`);
         return;
     }
     // --- Deterministic taint tracking (local, no backend) ---

package/dist/commands/mcpGateway.js

@@ -836,7 +836,8 @@ class McpGatewayServer {
             const localBlock = (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs, (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             if (localBlock) {
                 this.spoolLocalFinding(localBlock, toolName, operation);
-                throw new Error(`${localBlock.reason} (${localBlock.ruleId}: ${localBlock.evidence})`);
+                const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+                throw new Error(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
             }
             let preflight;
             try {
@@ -936,7 +937,8 @@ class McpGatewayServer {
             const localResponseBlock = (0, deterministicGuard_1.scanDeterministicTextResponse)(contentToText(rawResult), (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot));
             if (localResponseBlock) {
                 this.spoolLocalFinding(localResponseBlock, toolName, operation);
-                throw new Error(`${localResponseBlock.reason} (${localResponseBlock.ruleId}: ${localResponseBlock.evidence})`);
+                const responseOrigin = localResponseBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
+                throw new Error(`${localResponseBlock.reason} (${responseOrigin} "${localResponseBlock.itemId}", ${localResponseBlock.ruleId}: ${localResponseBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
             }
             const finalResult = this.gatewayConfig.scanResponse
                 ? await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult })

package/dist/localSafetySnapshot.d.ts

@@ -3,6 +3,8 @@ export interface LocalSafetySnapshot {
     policyHash: string;
     disabledBuiltInItemIds: string[];
     customBlocks: LocalSafetyCustomBlock[];
+    /** Org-managed trusted script paths — content scanning skipped under these. */
+    trustedScriptPaths?: string[];
     updatedAt?: string;
 }
 export interface LocalSafetySnapshotInput {

package/dist/localSafetySnapshot.js

@@ -85,6 +85,9 @@ function toSnapshot(data) {
                 explanation: typeof item.explanation === 'string' ? item.explanation : undefined,
             }))
             : [],
+        trustedScriptPaths: Array.isArray(data.trustedScriptPaths)
+            ? data.trustedScriptPaths.filter((item) => typeof item === 'string' && item.trim().length >= 3)
+            : undefined,
         updatedAt: typeof data.updatedAt === 'string' ? data.updatedAt : undefined,
     };
 }
@@ -132,6 +135,7 @@ function snapshotToScanOptions(snapshot, extra = {}) {
     return {
         disabledBuiltInItemIds: snapshot?.disabledBuiltInItemIds,
         customBlocks: snapshot?.customBlocks,
+        trustedScriptPaths: snapshot?.trustedScriptPaths,
         policyHash: snapshot?.policyHash,
         // Machine-local decoy paths planted by the daemon — every enforcement
         // surface (hooks, MCP gateway, desktop chat guard) gets honeypot

package/dist/selfUpdate.js

@@ -329,7 +329,7 @@ function maybeSelfUpdate(input) {
     if (attempts >= UPDATE_LOOP_THRESHOLD) {
         const updaterTail = readUpdaterLogTail(3);
         (0, distress_1.reportDistress)('self-update', distress_1.DISTRESS.UPDATE_LOOP, `target ${input.targetVersion} triggered ${attempts}x, still on ${input.currentVersion || 'unknown'}`
-            + (updaterTail.length ? ` — updater.log: ${updaterTail[updaterTail.length - 1]}` : ' — updater.log unreadable (task may never have run)'));
+            + (updaterTail.length ? ` — updater.log: ${updaterTail.join(' | ')}` : ' — updater.log unreadable (task may never have run)'));
     }
     const kind = detectInstallKind();
     const result = kind === 'msi'

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.37"
+  "version": "1.21.39"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.37",
+  "version": "1.21.39",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,10 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
+    "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",
+    "test:msi-stop-filter": "node scripts/test-msi-stop-filter.js",
     "test:guard-content-context": "npm run build && node scripts/test-guard-content-context.js",
+    "test:guard-fp-fixes": "npm run build && node scripts/test-guard-fp-fixes.js",
     "test:honeypot": "npm run build && node scripts/test-honeypot.js",
     "test:browser-credentials-rule": "npm run build && node scripts/test-browser-credentials-rule.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
@@ -54,6 +57,7 @@
     "test:policy-gate-health": "npm run build && node scripts/test-policy-gate-health.js",
     "test:offline-policy": "npm run build && node scripts/test-offline-policy-enforcement.js",
     "test:real-scenario": "npm run build && node scripts/test-real-scenario-drill.js",
+    "test:blocking-approval": "npm run build && node scripts/test-blocking-approval-drill.js",
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"