fullcourtdefense-cli 1.24.0 → 1.24.2

package/dist/actionPolicyEngine.js

@@ -294,7 +294,13 @@ function operationMatchesRule(operation, ruleOperations, matchText = '', toolCap
         const ruleAliases = operationAliases(upper);
         if ([...ruleAliases].some(alias => opAliases.has(alias)))
             return true;
-        if (op === upper || op.includes(upper) || upper.includes(op))
+        if (op === upper)
+            return true;
+        // Token-boundary containment, both directions — never raw substring. Raw substring
+        // matching let operation GET satisfy a "nuget push" rule ("nuGET") and would let
+        // SELECT match inside SELECTED. With boundaries, DELETE still matches DELETE_FILE,
+        // and operation "deploy" still satisfies a "gcloud run deploy" bank entry.
+        if (keywordAppearsAsWord(upper, op) || keywordAppearsAsWord(op, upper))
             return true;
         // READ is a category-level rule. It should cover read-only DB verbs observed from shell/SQL
         // activity, while a narrow SELECT/SHOW rule stays precise and does not match every READ.
@@ -347,6 +353,20 @@ const OPERATION_MATCH_SKIP_FIELDS = new Set([
     // Identity / metadata — NOT action signals. Excluded so the tool/agent name can never
     // pollute operation matching.
     'toolName', 'agentName', 'developerName', 'machineName', 'ipAddress', 'agentClient', 'gateway', 'mcpServer', 'environment',
+    // Document / file CONTENT — data being written or displayed, not the action itself.
+    // A file whose text mentions "delete" or "npm publish" is not a delete or a deploy;
+    // matching rule verbs against document bodies pauses ordinary file edits (real incident:
+    // writing a comment containing "safe to delete" tripped the Standard role's delete rule).
+    // The action signal for file ops is the operation (read/write/delete) + path; content
+    // safety (secrets, dangerous text) is Local Safety's job, not verb matching.
+    'content', 'contents', 'text', 'body', 'data', 'diff', 'patch', 'newText', 'oldText',
+    // Search PATTERNS — text being looked for, not an action (see search-intent handling
+    // in inferToolContext). Searching for "DROP TABLE" is a read.
+    'search.pattern',
+    // File PATHS — nouns, not verbs. Reading a file named "how-to-delete-accounts.md"
+    // is a read; the verb signal for file ops is the OPERATION (read/write/delete).
+    // Paths stay in context for path-based rule CONSTRAINTS, which are unaffected.
+    'path', 'filepath', 'file', 'filename', 'dir', 'directory', 'cwd',
 ]);
 function buildOperationMatchText(_toolName, context) {
     const parts = [];
@@ -546,10 +566,30 @@ function inferToolContext(toolName, args) {
             context[key] = String(val);
         }
     }
+    // Search-intent tools: their `query` is a text PATTERN to look for, not an action to run.
+    // Searching a codebase for "DROP TABLE" is a read — classifying the pattern as SQL would
+    // pause every code/document search that mentions a governed verb. The destructive-verb
+    // exclusion keeps hybrid tools (e.g. search_and_delete) out of this shortcut.
+    const nameWords = toolNameLower.replace(/[_\-.]/g, ' ');
+    const isSearchTool = /\b(search|grep|find|lookup|locate)\b/.test(nameWords)
+        && !/\b(delete|remove|drop|write|update|insert|replace|create)\b/.test(nameWords);
+    if (isSearchTool) {
+        operation = 'read';
+        if (typeof context.query === 'string') {
+            // Keep the pattern reachable for constraints, but OUT of `query` — `query` feeds
+            // verb match text and database session budgets, which a search pattern must not.
+            context['search.pattern'] = context.query;
+            delete context.query;
+        }
+    }
     // SQL detection: extract the SQL verb from common query/code/command payloads.
+    // Hyphen-glued matches are NOT SQL: PowerShell cmdlets (`Select-Object`, `Select-String`)
+    // and CLI flags (`--delete-branch`) must not classify as SELECT/DELETE — real SQL never
+    // hyphenates these verbs. Misclassifying also poisons context.query, which would count
+    // ordinary shell pipes against database session budgets.
     const sqlArg = args.query || args.sql || args.statement || args.command || args.code || args.script || args.input || '';
-    if (typeof sqlArg === 'string' && sqlArg.length > 0) {
-        const sqlMatch = sqlArg.match(/\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b/i);
+    if (!isSearchTool && typeof sqlArg === 'string' && sqlArg.length > 0) {
+        const sqlMatch = sqlArg.match(/(?<!-)\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b(?!-)/i);
         if (sqlMatch) {
             operation = sqlMatch[1].toUpperCase();
             context.query = sqlArg;

package/dist/commands/daemon.d.ts

@@ -32,6 +32,7 @@ export declare function discoverSweepCredentialEnv(credentials?: {
     shieldKey?: string;
     apiUrl?: string;
 }): Record<string, string>;
+export declare function cliVersion(): string | undefined;
 export type TaskLogonType = 'S4U' | 'InteractiveToken';
 /** Fully-qualified current user (DOMAIN\\user) for the task principal. */
 export declare function taskUserId(): string;

package/dist/commands/daemon.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.daemonDiscoverSweepArgs = daemonDiscoverSweepArgs;
 exports.summarizeDiscoverStderr = summarizeDiscoverStderr;
 exports.discoverSweepCredentialEnv = discoverSweepCredentialEnv;
+exports.cliVersion = cliVersion;
 exports.taskUserId = taskUserId;
 exports.taskLocalTimestamp = taskLocalTimestamp;
 exports.buildTaskXml = buildTaskXml;
@@ -383,7 +384,15 @@ async function runDaemon(args, config) {
     // Crash forensics: was the previous daemon killed without a clean shutdown?
     const postmortem = (0, daemonForensics_1.recordDaemonStart)({ version: cliVersion(), isPidAlive });
     if (postmortem) {
-        log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
+        const current = cliVersion();
+        if (postmortem.version && current && postmortem.version !== current) {
+            // The silent updater stops the old daemon forcefully — an unclean death
+            // of an OLDER version is the upgrade itself, not something to alarm on.
+            log(`Previous daemon (v${postmortem.version}) was replaced by this upgrade to v${current} — the updater's forced stop is expected, not a crash. Post-mortem recorded for the timeline.`);
+        }
+        else {
+            log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
+        }
     }
     // A fresh daemon runs right after every successful MSI update: if a
     // previously-reported update loop has been resolved by this version, clear

package/dist/commands/mcpGateway.js

@@ -59,6 +59,7 @@ const deterministicGuard_1 = require("./deterministicGuard");
 const restartNotice_1 = require("./restartNotice");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const runtimeConfig_1 = require("../runtimeConfig");
+const sessionLimits_1 = require("../sessionLimits");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const distress_1 = require("../distress");
@@ -864,6 +865,7 @@ class McpGatewayServer {
             // locally with the same engine the server runs (actionPolicyEngine.ts).
             let cachedPolicies;
             let reportOnlyMode = false;
+            let machineRole;
             try {
                 const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({
                     apiUrl: this.gatewayConfig.apiUrl,
@@ -875,6 +877,7 @@ class McpGatewayServer {
                 if (bundle.source !== 'default') {
                     expectedPolicyHash = bundle.policyHash || bundle.version;
                     cachedPolicies = bundle.actionPolicies;
+                    machineRole = bundle.machineRole;
                     reportOnlyMode = bundle.mode !== 'block'; // monitor/shadow machines must never block
                     // Machine-level offline stance (same rule as the IDE hooks): the
                     // bundle governs unless the gateway was installed with an explicit
@@ -921,6 +924,37 @@ class McpGatewayServer {
                 const origin = localBlock.source === 'custom' ? 'org custom rule' : 'built-in Local Safety rule';
                 throw new Error(`${localBlock.reason} (${origin} "${localBlock.itemId}", ${localBlock.ruleId}: ${localBlock.evidence}) — logged to your org's console; admins manage rules under Shield → Local Safety.`);
             }
+            // --- Machine-role session amount limits (pre-call: operation counts) ---
+            // The role's verb rules ride actionPolicies; this enforces the AMOUNTS.
+            // Count the classified operation, then stop the session once it exceeds
+            // the role's per-session budget — the exfiltration circuit breaker: each
+            // SELECT looks benign, the volume is the signal.
+            const limitSessionId = runtimeSessionId() || `gateway-${this.gatewayConfig.agentName || 'default'}`;
+            // Classified once here; the response-volume accounting below reuses the
+            // same target so DB rows land in the DB budget and file bytes in the file budget.
+            const limitInferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
+            const limitClassification = (0, sessionLimits_1.classifyOpForLimits)(operation || limitInferred.operation, limitInferred.context);
+            if (machineRole) {
+                const inferredOp = operation || limitInferred.operation;
+                const usage = limitClassification
+                    ? (0, sessionLimits_1.recordSessionOp)(limitSessionId, limitClassification.target, limitClassification.opClass)
+                    : (0, sessionLimits_1.getSessionUsage)(limitSessionId);
+                const violation = (0, sessionLimits_1.checkSessionLimits)(usage, machineRole.limits);
+                if (violation) {
+                    const reason = `Machine role "${machineRole.name}": ${violation.description}.`;
+                    if (machineRole.stage === 'monitor' || reportOnlyMode) {
+                        (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation: inferredOp, reason: `[monitor] ${reason}`, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
+                        (0, telemetry_1.triggerFlush)(false);
+                        process.stderr.write(`AgentGuard (monitor): ${reason}\n`);
+                    }
+                    else {
+                        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation: inferredOp, reason, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
+                        (0, telemetry_1.triggerFlush)(true);
+                        (0, notify_1.notifyOs)({ title: 'FullCourtDefense — session limit reached', message: `${toolName} blocked: ${violation.description}. Adjust the machine's role in the console if this is expected.` });
+                        throw new Error(`FullCourtDefense blocked ${toolName} — ${reason} An admin can raise the limit or change this machine's role in the console → AI Fleet → Roles.`);
+                    }
+                }
+            }
             let preflight;
             try {
                 preflight = await this.api.checkToolCall({ toolName, operation, toolArgs });
@@ -1044,6 +1078,35 @@ class McpGatewayServer {
                     process.stderr.write(`AgentGuard masked a ${finding.itemId} in the ${toolName} response.\n`);
                 }
             }
+            // --- Machine-role session amount limits (post-call: response volume) ---
+            // Measure what the tool actually returned (after masking) and stop the
+            // response from reaching the agent once the session's cumulative MB/rows
+            // budget is exhausted. The data stays on the MCP server — nothing above
+            // the limit is ever handed to the model.
+            if (machineRole) {
+                const responseText = contentToText(rawResult);
+                const responseBytes = Buffer.byteLength(typeof rawResult === 'string' ? rawResult : JSON.stringify(rawResult ?? ''), 'utf8');
+                const usage = (0, sessionLimits_1.recordSessionResponse)(limitSessionId, {
+                    bytes: responseBytes,
+                    rows: (0, sessionLimits_1.countResponseRows)(responseText),
+                    target: limitClassification?.target ?? 'other',
+                });
+                const violation = (0, sessionLimits_1.checkSessionLimits)(usage, machineRole.limits);
+                if (violation && sessionLimits_1.RESPONSE_VOLUME_LIMITS.has(violation.limit)) {
+                    const reason = `Machine role "${machineRole.name}": ${violation.description}.`;
+                    if (machineRole.stage === 'monitor' || reportOnlyMode) {
+                        (0, telemetry_1.spoolEvent)({ decision: 'warn', toolName, operation, reason: `[monitor] ${reason}`, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
+                        (0, telemetry_1.triggerFlush)(false);
+                        process.stderr.write(`AgentGuard (monitor): ${reason}\n`);
+                    }
+                    else {
+                        (0, telemetry_1.spoolEvent)({ decision: 'block', toolName, operation, reason, ruleId: `machine-role-limit:${violation.limit}`, offlineEnforced: true });
+                        (0, telemetry_1.triggerFlush)(true);
+                        (0, notify_1.notifyOs)({ title: 'FullCourtDefense — session data limit reached', message: `${toolName} response withheld: ${violation.description}.` });
+                        throw new Error(`FullCourtDefense withheld the ${toolName} response — ${reason} The session already pulled its data budget; an admin can raise the limit or change this machine's role in the console → AI Fleet → Roles.`);
+                    }
+                }
+            }
             const finalResult = this.gatewayConfig.scanResponse
                 ? await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult })
                 : rawResult;

package/dist/envDiagnostics.d.ts

@@ -37,6 +37,13 @@ export declare function collectEnvironmentDiagnostics(options?: {
 }): Promise<EnvironmentDiagnostics>;
 /** One-line human summary for the onboarding journal / MSI screen / daemon log. */
 export declare function summarizeEnvironmentDiagnostics(diag: EnvironmentDiagnostics): string;
+/**
+ * The silent updater stops the old daemon FORCEFULLY, so an upgrade always
+ * leaves an "unclean death" post-mortem — of the OLD version. When the dead
+ * daemon's version differs from the CLI running now, that death was the
+ * upgrade replacing it: routine, expected, and not a health problem.
+ */
+export declare function crashLooksLikeUpgradeRestart(crash: DaemonPostmortem): boolean;
 /**
  * Verdict for the onboarding journal: healthy unless something on this
  * machine is actively interfering (daemon killed, PowerShell blocked, or a

package/dist/envDiagnostics.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectEnvironmentDiagnostics = collectEnvironmentDiagnostics;
 exports.summarizeEnvironmentDiagnostics = summarizeEnvironmentDiagnostics;
+exports.crashLooksLikeUpgradeRestart = crashLooksLikeUpgradeRestart;
 exports.environmentLooksHealthy = environmentLooksHealthy;
 const config_1 = require("./config");
 const daemon_1 = require("./commands/daemon");
@@ -77,10 +78,23 @@ function summarizeEnvironmentDiagnostics(diag) {
         parts.push(diag.daemonAlive ? 'daemon alive' : 'daemon not running');
     }
     parts.push(diag.watchdogTaskInstalled ? 'watchdog installed' : 'watchdog task missing');
-    if (diag.lastCrash)
-        parts.push(`previous daemon died uncleanly at ${diag.lastCrash.lastAliveAt || 'unknown time'}`);
+    if (diag.lastCrash) {
+        parts.push(crashLooksLikeUpgradeRestart(diag.lastCrash)
+            ? `previous daemon (v${diag.lastCrash.version}) was replaced by a CLI upgrade — routine, not a crash`
+            : `previous daemon died uncleanly at ${diag.lastCrash.lastAliveAt || 'unknown time'}`);
+    }
     return parts.join('; ');
 }
+/**
+ * The silent updater stops the old daemon FORCEFULLY, so an upgrade always
+ * leaves an "unclean death" post-mortem — of the OLD version. When the dead
+ * daemon's version differs from the CLI running now, that death was the
+ * upgrade replacing it: routine, expected, and not a health problem.
+ */
+function crashLooksLikeUpgradeRestart(crash) {
+    const current = (0, daemon_1.cliVersion)();
+    return Boolean(crash.version && current && crash.version !== current);
+}
 /**
  * Verdict for the onboarding journal: healthy unless something on this
  * machine is actively interfering (daemon killed, PowerShell blocked, or a
@@ -92,7 +106,9 @@ function environmentLooksHealthy(diag) {
         return false;
     if (diag.powershellSpawnOk === false)
         return false;
-    if (diag.lastCrash)
+    // Upgrade restarts are not crashes — only a same-version unclean death
+    // (something actually killed the daemon) marks the environment unhealthy.
+    if (diag.lastCrash && !crashLooksLikeUpgradeRestart(diag.lastCrash))
         return false;
     return true;
 }

package/dist/runtimeConfig.d.ts

@@ -45,6 +45,20 @@ export interface RuntimeBundle {
      * covers policy edits, so console changes refresh this within one poll.
      */
     actionPolicies?: EngineActionPolicy[];
+    /**
+     * This machine's role profile (least-privilege preset assigned in the console).
+     * Verb rules already ride `actionPolicies` as compiled policies; this block
+     * carries the per-session AMOUNT limits enforced by local session counters
+     * (hooks + MCP gateway). `null` limit = unlimited.
+     */
+    machineRole?: {
+        roleId: string;
+        name: string;
+        summary?: string;
+        stage?: 'monitor' | 'enforce';
+        /** Split by target (db / file / overall); legacy pre-split keys are normalized on read. */
+        limits: import('./sessionLimits').SessionRoleLimits;
+    };
     /** One constrained, auditable action queued for the resident daemon. */
     machineAction?: {
         id: string;

package/dist/runtimeConfig.js

@@ -41,6 +41,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const distress_1 = require("./distress");
+const sessionLimits_1 = require("./sessionLimits");
 const CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
 const DEFAULT_TTL_MS = 60_000;
 const REFRESH_TIMEOUT_MS = 1_500; // tight: the hook must stay fast
@@ -63,6 +64,27 @@ function writeCacheFile(data) {
 function isMode(value) {
     return value === 'block' || value === 'monitor' || value === 'shadow';
 }
+/** A cached entry as an EffectiveBundle — single place that decides which fields survive the cache. */
+function cachedToEffective(cached) {
+    const { fetchedAt: _fetchedAt, ...bundle } = cached;
+    return { ...bundle, source: 'cache' };
+}
+/** Keep only a well-formed machine-role block (limits must be numbers or null; legacy keys normalized). */
+function sanitizeMachineRole(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const role = value;
+    if (typeof role.roleId !== 'string' || typeof role.name !== 'string')
+        return undefined;
+    const rawLimits = (role.limits && typeof role.limits === 'object' ? role.limits : {});
+    return {
+        roleId: role.roleId,
+        name: role.name,
+        summary: typeof role.summary === 'string' ? role.summary : undefined,
+        stage: role.stage === 'monitor' ? 'monitor' : 'enforce',
+        limits: (0, sessionLimits_1.normalizeSessionLimits)(rawLimits),
+    };
+}
 /** Keep only well-formed policies — a malformed server payload must never poison the offline cache. */
 function sanitizeBundlePolicies(value) {
     if (!Array.isArray(value))
@@ -85,7 +107,7 @@ async function getRuntimeBundle(input) {
     const cached = cache[input.shieldId];
     const fresh = cached && Date.now() - cached.fetchedAt < ttl;
     if (cached && fresh && !input.force) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, disabledScanRoots: cached.disabledScanRoots, autoUpdate: cached.autoUpdate, honeypot: cached.honeypot, machineAction: cached.machineAction, actionPolicies: cached.actionPolicies, source: 'cache' };
+        return cachedToEffective(cached);
     }
     try {
         const headers = { 'Content-Type': 'application/json' };
@@ -105,7 +127,7 @@ async function getRuntimeBundle(input) {
         if (resp.status === 304 && cached) {
             cache[input.shieldId] = { ...cached, fetchedAt: Date.now() };
             writeCacheFile(cache);
-            return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, disabledScanRoots: cached.disabledScanRoots, autoUpdate: cached.autoUpdate, honeypot: cached.honeypot, machineAction: cached.machineAction, actionPolicies: cached.actionPolicies, source: 'cache' };
+            return cachedToEffective(cached);
         }
         if (resp.status === 401 || resp.status === 403) {
             // The backend REACHED us and rejected the key — a credential problem,
@@ -140,6 +162,7 @@ async function getRuntimeBundle(input) {
                         : undefined,
                     machineAction: body.data.machineAction,
                     actionPolicies: sanitizeBundlePolicies(body.data.actionPolicies),
+                    machineRole: sanitizeMachineRole(body.data.machineRole),
                     fetchedAt: Date.now(),
                 };
                 cache[input.shieldId] = entry;
@@ -154,7 +177,7 @@ async function getRuntimeBundle(input) {
         /* fall through to cache / default */
     }
     if (cached) {
-        return { mode: cached.mode, version: cached.version, policyHash: cached.policyHash, policyCount: cached.policyCount, pollIntervalMs: cached.pollIntervalMs, failClosed: cached.failClosed, suspended: cached.suspended, extraScanRoots: cached.extraScanRoots, disabledScanRoots: cached.disabledScanRoots, autoUpdate: cached.autoUpdate, honeypot: cached.honeypot, machineAction: cached.machineAction, actionPolicies: cached.actionPolicies, source: 'cache' };
+        return cachedToEffective(cached);
     }
     return { mode: 'block', version: '', source: 'default' };
 }

package/dist/sessionLimits.d.ts

@@ -0,0 +1,76 @@
+export interface SessionRoleLimits {
+    maxDbReadsPerSession: number | null;
+    maxDbWritesPerSession: number | null;
+    maxDbDeletesPerSession: number | null;
+    maxDbRowsPerSession: number | null;
+    maxFileReadsPerSession: number | null;
+    maxFileWritesPerSession: number | null;
+    maxFileDeletesPerSession: number | null;
+    maxFileMbPerSession: number | null;
+    maxResponseMbPerSession: number | null;
+}
+/** Normalize a raw bundle limits object (new or legacy keys) into the split shape. */
+export declare function normalizeSessionLimits(raw: Record<string, unknown> | undefined | null): SessionRoleLimits;
+export interface SessionUsage {
+    sessionId: string;
+    dbReads: number;
+    dbWrites: number;
+    dbDeletes: number;
+    /** Cumulative rows returned by database tools. */
+    dbRows: number;
+    fileReads: number;
+    fileWrites: number;
+    fileDeletes: number;
+    /** Cumulative bytes moved by file tools. */
+    fileBytes: number;
+    /** Cumulative bytes of ALL tool responses, any target. */
+    responseBytes: number;
+    updatedAt: string;
+}
+export interface SessionLimitViolation {
+    limit: keyof SessionRoleLimits;
+    configured: number;
+    actual: number;
+    /** Human sentence for block messages and console events. */
+    description: string;
+}
+export type SessionOpClass = 'read' | 'write' | 'delete';
+export type SessionOpTarget = 'db' | 'file' | 'other';
+export declare function getSessionUsage(sessionId: string): SessionUsage;
+/** Record one classified operation against its target; returns the updated running totals. */
+export declare function recordSessionOp(sessionId: string, target: SessionOpTarget, opClass: SessionOpClass): SessionUsage;
+/**
+ * Record tool-response volume (MCP gateway). Bytes always count toward the
+ * overall cap; rows count toward the DB budget only for DB-target calls, and
+ * bytes toward the file budget only for file-target calls.
+ */
+export declare function recordSessionResponse(sessionId: string, input: {
+    bytes: number;
+    rows: number;
+    target: SessionOpTarget;
+}): SessionUsage;
+/**
+ * Classify an engine-inferred operation into a counter class AND target.
+ * The engine's context is the discriminator: SQL detection sets `query`,
+ * file-path detection sets `path`. Without context, provenance decides
+ * (SQL-only verbs are uppercase, file/shell verbs lowercase); HTTP methods
+ * land in 'other' (covered only by the overall response-volume cap).
+ * MUST mirror backend/src/modules/policies/roles.ts `classifyOpForLimits` —
+ * the two sides count the same ops or the console's numbers lie.
+ */
+export declare function classifyOpForLimits(operation: string, context?: Record<string, string>): {
+    target: SessionOpTarget;
+    opClass: SessionOpClass;
+} | undefined;
+/** Limits that meter RESPONSE volume (checked after the tool ran, response withheld). */
+export declare const RESPONSE_VOLUME_LIMITS: ReadonlySet<keyof SessionRoleLimits>;
+/** First exceeded limit for the given usage, or undefined when within bounds. */
+export declare function checkSessionLimits(usage: SessionUsage, limits: SessionRoleLimits): SessionLimitViolation | undefined;
+/**
+ * Estimate how many rows/records a tool response text carries.
+ * JSON: total element count across arrays (a page of DB rows = its length).
+ * Non-JSON: non-empty line count (CSV / table / psql output ≈ one row per line).
+ * Deterministic heuristic — used only for cumulative volume limits, never
+ * for per-item decisions, so approximate is fine.
+ */
+export declare function countResponseRows(text: string): number;

package/dist/sessionLimits.js

@@ -0,0 +1,330 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESPONSE_VOLUME_LIMITS = void 0;
+exports.normalizeSessionLimits = normalizeSessionLimits;
+exports.getSessionUsage = getSessionUsage;
+exports.recordSessionOp = recordSessionOp;
+exports.recordSessionResponse = recordSessionResponse;
+exports.classifyOpForLimits = classifyOpForLimits;
+exports.checkSessionLimits = checkSessionLimits;
+exports.countResponseRows = countResponseRows;
+/**
+ * Session amount limits — local counters enforcing a machine role's
+ * per-session data limits (from the runtime bundle's `machineRole.limits`).
+ *
+ * The role's VERB rules (read/write/delete/...) ride the bundle as compiled
+ * Action Policies and are enforced by the shared engine. This module enforces
+ * the AMOUNTS, split by TARGET: database operations (queries + rows returned)
+ * and file operations (ops + MB moved) are metered separately, plus one
+ * overall response-volume cap covering every tool regardless of target.
+ * "1,000 file reads is a normal build; 1,000 SELECTs is an exfiltration" —
+ * different judgments need different budgets.
+ *
+ * Counters are per agent session, persisted as small JSON files under
+ * ~/.fullcourtdefense/sessions/ so every short-lived hook invocation and the
+ * long-running MCP gateway see the same running totals. Purely local — works
+ * offline, no backend needed. Files older than 48h are pruned (an agent
+ * session never legitimately spans days).
+ *
+ * The Bits-of-Gold-style scenario this exists for: a compromised agent that
+ * starts bulk-reading customer data. Each individual SELECT looks benign; the
+ * VOLUME is the signal. A role limit of e.g. 10,000 DB rows/session stops the
+ * bleed mid-exfiltration, deterministically, before any AI judgment.
+ */
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Legacy (pre-split) bundle keys → the new keys they govern. An old backend
+ * may still send them; they apply to every successor not explicitly set.
+ * MUST mirror backend/src/modules/policies/roles.ts `LEGACY_LIMIT_KEY_MAP`.
+ */
+const LEGACY_LIMIT_KEY_MAP = {
+    maxReadOpsPerSession: ['maxDbReadsPerSession', 'maxFileReadsPerSession'],
+    maxWriteOpsPerSession: ['maxDbWritesPerSession', 'maxFileWritesPerSession'],
+    maxDeleteOpsPerSession: ['maxDbDeletesPerSession', 'maxFileDeletesPerSession'],
+    maxResponseRowsPerSession: ['maxDbRowsPerSession'],
+};
+const LIMIT_KEYS = [
+    'maxDbReadsPerSession', 'maxDbWritesPerSession', 'maxDbDeletesPerSession', 'maxDbRowsPerSession',
+    'maxFileReadsPerSession', 'maxFileWritesPerSession', 'maxFileDeletesPerSession', 'maxFileMbPerSession',
+    'maxResponseMbPerSession',
+];
+/** Normalize a raw bundle limits object (new or legacy keys) into the split shape. */
+function normalizeSessionLimits(raw) {
+    const valid = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+    const limits = {
+        maxDbReadsPerSession: null,
+        maxDbWritesPerSession: null,
+        maxDbDeletesPerSession: null,
+        maxDbRowsPerSession: null,
+        maxFileReadsPerSession: null,
+        maxFileWritesPerSession: null,
+        maxFileDeletesPerSession: null,
+        maxFileMbPerSession: null,
+        maxResponseMbPerSession: null,
+    };
+    if (!raw || typeof raw !== 'object')
+        return limits;
+    for (const key of LIMIT_KEYS) {
+        const value = raw[key];
+        if (valid(value))
+            limits[key] = value;
+    }
+    for (const [legacyKey, successors] of Object.entries(LEGACY_LIMIT_KEY_MAP)) {
+        const value = raw[legacyKey];
+        if (!valid(value))
+            continue;
+        for (const successor of successors) {
+            if (limits[successor] === null && !(successor in raw && raw[successor] !== undefined && raw[successor] !== null)) {
+                limits[successor] = value;
+            }
+        }
+    }
+    return limits;
+}
+const SESSION_FILE_TTL_MS = 48 * 60 * 60 * 1000;
+function sessionsDir() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'sessions');
+}
+function usagePath(sessionId) {
+    const safe = crypto.createHash('sha1').update(sessionId || 'default').digest('hex').slice(0, 24);
+    return path.join(sessionsDir(), `${safe}.json`);
+}
+function emptyUsage(sessionId) {
+    return {
+        sessionId,
+        dbReads: 0, dbWrites: 0, dbDeletes: 0, dbRows: 0,
+        fileReads: 0, fileWrites: 0, fileDeletes: 0, fileBytes: 0,
+        responseBytes: 0,
+        updatedAt: new Date().toISOString(),
+    };
+}
+/** Best-effort removal of stale session counter files. */
+function pruneSessions() {
+    try {
+        const dir = sessionsDir();
+        if (!fs.existsSync(dir))
+            return;
+        const cutoff = Date.now() - SESSION_FILE_TTL_MS;
+        for (const name of fs.readdirSync(dir)) {
+            const file = path.join(dir, name);
+            try {
+                if (fs.statSync(file).mtimeMs < cutoff)
+                    fs.unlinkSync(file);
+            }
+            catch { /* ignore */ }
+        }
+    }
+    catch { /* ignore */ }
+}
+function getSessionUsage(sessionId) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(usagePath(sessionId), 'utf8'));
+        return {
+            sessionId,
+            // Pre-split usage files carried readOps/writeOps/deleteOps/responseRows —
+            // those counters are simply restarted under the split model (a session
+            // straddling a CLI upgrade loses at most one session's history).
+            dbReads: Number(raw.dbReads) || 0,
+            dbWrites: Number(raw.dbWrites) || 0,
+            dbDeletes: Number(raw.dbDeletes) || 0,
+            dbRows: Number(raw.dbRows) || 0,
+            fileReads: Number(raw.fileReads) || 0,
+            fileWrites: Number(raw.fileWrites) || 0,
+            fileDeletes: Number(raw.fileDeletes) || 0,
+            fileBytes: Number(raw.fileBytes) || 0,
+            responseBytes: Number(raw.responseBytes) || 0,
+            updatedAt: typeof raw.updatedAt === 'string' ? raw.updatedAt : new Date().toISOString(),
+        };
+    }
+    catch {
+        return emptyUsage(sessionId);
+    }
+}
+function saveUsage(usage) {
+    try {
+        fs.mkdirSync(sessionsDir(), { recursive: true });
+        fs.writeFileSync(usagePath(usage.sessionId), JSON.stringify({ ...usage, updatedAt: new Date().toISOString() }), 'utf8');
+    }
+    catch { /* counters are best-effort — never break the hook */ }
+}
+/** Record one classified operation against its target; returns the updated running totals. */
+function recordSessionOp(sessionId, target, opClass) {
+    pruneSessions();
+    const usage = getSessionUsage(sessionId);
+    if (target === 'db') {
+        if (opClass === 'read')
+            usage.dbReads += 1;
+        else if (opClass === 'write')
+            usage.dbWrites += 1;
+        else
+            usage.dbDeletes += 1;
+    }
+    else if (target === 'file') {
+        if (opClass === 'read')
+            usage.fileReads += 1;
+        else if (opClass === 'write')
+            usage.fileWrites += 1;
+        else
+            usage.fileDeletes += 1;
+    }
+    // target 'other' (HTTP/messaging) has no per-op budget — it is covered by
+    // the overall response-volume cap recorded in recordSessionResponse.
+    saveUsage(usage);
+    return usage;
+}
+/**
+ * Record tool-response volume (MCP gateway). Bytes always count toward the
+ * overall cap; rows count toward the DB budget only for DB-target calls, and
+ * bytes toward the file budget only for file-target calls.
+ */
+function recordSessionResponse(sessionId, input) {
+    const usage = getSessionUsage(sessionId);
+    const bytes = Math.max(0, Math.floor(input.bytes) || 0);
+    const rows = Math.max(0, Math.floor(input.rows) || 0);
+    usage.responseBytes += bytes;
+    if (input.target === 'db')
+        usage.dbRows += rows;
+    if (input.target === 'file')
+        usage.fileBytes += bytes;
+    saveUsage(usage);
+    return usage;
+}
+/** Operations that only ever come from SQL detection (context.query). */
+const DB_ONLY_OPS = new Set(['SELECT', 'INSERT', 'UPDATE', 'TRUNCATE', 'SHOW', 'DESCRIBE', 'EXPLAIN', 'ALTER']);
+/** Lowercase engine ops produced by file-tool / shell-command classification. */
+const FILE_STYLE_OPS = new Set(['read', 'write', 'create', 'delete', 'remove']);
+/**
+ * Classify an engine-inferred operation into a counter class AND target.
+ * The engine's context is the discriminator: SQL detection sets `query`,
+ * file-path detection sets `path`. Without context, provenance decides
+ * (SQL-only verbs are uppercase, file/shell verbs lowercase); HTTP methods
+ * land in 'other' (covered only by the overall response-volume cap).
+ * MUST mirror backend/src/modules/policies/roles.ts `classifyOpForLimits` —
+ * the two sides count the same ops or the console's numbers lie.
+ */
+function classifyOpForLimits(operation, context) {
+    const raw = operation || '';
+    const op = raw.toUpperCase();
+    let opClass;
+    if (['READ', 'SELECT', 'SHOW', 'DESCRIBE', 'EXPLAIN', 'GET', 'LIST'].includes(op))
+        opClass = 'read';
+    else if (['WRITE', 'CREATE', 'INSERT', 'UPDATE', 'PUT', 'PATCH', 'POST', 'UPLOAD'].includes(op))
+        opClass = 'write';
+    else if (['DELETE', 'DROP', 'TRUNCATE', 'REMOVE'].includes(op))
+        opClass = 'delete';
+    else
+        return undefined;
+    let target = 'other';
+    if (context?.query)
+        target = 'db';
+    else if (context?.path)
+        target = 'file';
+    else if (DB_ONLY_OPS.has(op) || (op === 'DROP' && raw === op))
+        target = 'db';
+    else if (FILE_STYLE_OPS.has(raw) && !context?.url)
+        target = 'file';
+    return { target, opClass };
+}
+const OP_LIMIT_CHECKS = [
+    { limit: 'maxDbReadsPerSession', counter: 'dbReads', noun: 'database read queries' },
+    { limit: 'maxDbWritesPerSession', counter: 'dbWrites', noun: 'database write statements' },
+    { limit: 'maxDbDeletesPerSession', counter: 'dbDeletes', noun: 'database delete statements' },
+    { limit: 'maxDbRowsPerSession', counter: 'dbRows', noun: 'database rows returned' },
+    { limit: 'maxFileReadsPerSession', counter: 'fileReads', noun: 'file reads' },
+    { limit: 'maxFileWritesPerSession', counter: 'fileWrites', noun: 'file writes' },
+    { limit: 'maxFileDeletesPerSession', counter: 'fileDeletes', noun: 'file deletes' },
+];
+/** Limits that meter RESPONSE volume (checked after the tool ran, response withheld). */
+exports.RESPONSE_VOLUME_LIMITS = new Set([
+    'maxDbRowsPerSession', 'maxFileMbPerSession', 'maxResponseMbPerSession',
+]);
+/** First exceeded limit for the given usage, or undefined when within bounds. */
+function checkSessionLimits(usage, limits) {
+    for (const check of OP_LIMIT_CHECKS) {
+        const configured = limits[check.limit];
+        const actual = usage[check.counter];
+        if (configured !== null && actual > configured) {
+            return { limit: check.limit, configured, actual, description: `${check.noun} this session (${actual}) exceeded the machine role limit of ${configured}` };
+        }
+    }
+    const fileMb = usage.fileBytes / (1024 * 1024);
+    if (limits.maxFileMbPerSession !== null && fileMb > limits.maxFileMbPerSession) {
+        return { limit: 'maxFileMbPerSession', configured: limits.maxFileMbPerSession, actual: Math.round(fileMb * 100) / 100, description: `file data volume this session (${fileMb.toFixed(1)} MB) exceeded the machine role limit of ${limits.maxFileMbPerSession} MB` };
+    }
+    const mb = usage.responseBytes / (1024 * 1024);
+    if (limits.maxResponseMbPerSession !== null && mb > limits.maxResponseMbPerSession) {
+        return { limit: 'maxResponseMbPerSession', configured: limits.maxResponseMbPerSession, actual: Math.round(mb * 100) / 100, description: `tool response volume this session (${mb.toFixed(1)} MB) exceeded the machine role limit of ${limits.maxResponseMbPerSession} MB` };
+    }
+    return undefined;
+}
+/**
+ * Estimate how many rows/records a tool response text carries.
+ * JSON: total element count across arrays (a page of DB rows = its length).
+ * Non-JSON: non-empty line count (CSV / table / psql output ≈ one row per line).
+ * Deterministic heuristic — used only for cumulative volume limits, never
+ * for per-item decisions, so approximate is fine.
+ */
+function countResponseRows(text) {
+    const trimmed = (text || '').trim();
+    if (!trimmed)
+        return 0;
+    if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            let count = 0;
+            const walk = (value, depth) => {
+                if (depth > 4 || count > 1_000_000)
+                    return;
+                if (Array.isArray(value)) {
+                    count += value.length;
+                    for (const item of value)
+                        walk(item, depth + 1);
+                }
+                else if (value && typeof value === 'object') {
+                    for (const item of Object.values(value))
+                        walk(item, depth + 1);
+                }
+            };
+            walk(parsed, 0);
+            return count;
+        }
+        catch { /* fall through to line counting */ }
+    }
+    return trimmed.split('\n').filter(line => line.trim().length > 0).length;
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.24.0"
+  "version": "1.24.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.24.0",
+  "version": "1.24.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -22,6 +22,7 @@
     "test:catalog-toggles": "npm run build && node scripts/test-catalog-toggles.js",
     "test:honeypot": "npm run build && node scripts/test-honeypot.js",
     "test:browser-credentials-rule": "npm run build && node scripts/test-browser-credentials-rule.js",
+    "test:session-limits": "npm run build && node scripts/test-session-limits.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:taint-approvals": "npm run build && node scripts/test-taint-approvals.js",
     "test:taint-approve-once": "npm run build && node scripts/test-taint-approve-once.js",