fullcourtdefense-cli 1.25.3 → 1.25.4

package/dist/commands/cmdGuard.js

@@ -118,7 +118,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `const NODE_PATH=${JSON.stringify(nodePath)};`,
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): commit messages, issue/PR bodies, and`,
+        `// here-strings/heredocs are DATA — inert unless the line can feed an interpreter or the region interpolates.`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]*\`/;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');o=o.replace(/((?:^|\\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\\s*)("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*')/gi,(w,f,q)=>q[0]==="'"?f+' fcd_inert_data ':K.test(q)?w:f+' fcd_inert_data ');return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){spawnSync(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{stdio:'ignore',windowsHide:true});}}catch{}}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,

package/dist/commands/deterministicGuard.d.ts

@@ -55,6 +55,7 @@ export interface LocalSafetyScanOptions {
      */
     trustedScriptPaths?: string[];
 }
+export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
@@ -615,10 +616,12 @@ function credentialCommandReason(value) {
 function destructiveCommandReason(value) {
     return matchCommand(value, (text, lower) => {
         // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`), and the target
-        // may be the root `/`, the root wildcard `/*`, or a bare `*`.
-        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        // may be the root `/`, the root wildcard `/*`, or a bare `*`. Terminators
+        // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
+        // outer command — is caught too.
+        if (/\brm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        if (/\bsudo\s+rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+(?:["']?\/\*?["']?|\*)(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
@@ -779,13 +782,55 @@ function isSensitivePathContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return /(?:path|file|filename|dir|directory|target|source|src|dest|location|glob|pattern|uri|url)/i.test(lastKey);
 }
-function scanTextValue(toolName, value, options) {
-    const honeypot = honeypotTouch(value, options);
+// ---- execution view: message/document DATA inside a command is inert ---------
+// Kills the "wrote ABOUT a dangerous command" FP class: commit messages,
+// issue/PR bodies, here-strings, doc heredocs quoting `terraform destroy` or
+// `rm -rf /` are data, not execution. Safety invariants:
+//   1. NOTHING is stripped when the text can feed an interpreter (| sh, iex,
+//      eval, xargs, base64 -d, -EncodedCommand, FromBase64String) — data that
+//      flows into an interpreter IS execution.
+//   2. A region containing $( ) or `…` pairs is kept — interpolation executes
+//      BEFORE the outer command.
+//   3. Secret-literal rules and honeypot/custom rules never use this view —
+//      a token pasted into a commit message still leaks.
+const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b/i;
+const INTERPOLATES = /\$\(|`[^`]*`/;
+const INERT_DATA = ' fcd_inert_data ';
+const TEXT_SINK_FLAG_ARG = /((?:^|\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/gi;
+function stripInertDataSegments(text) {
+    if (DATA_TO_INTERPRETER.test(text))
+        return text;
+    let out = text;
+    // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
+    out = out.replace(/@'[\s\S]*?'@/g, INERT_DATA);
+    out = out.replace(/@"[\s\S]*?"@/g, m => (m.includes('$(') ? m : INERT_DATA));
+    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
+    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
+    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
+    // Quoted message/text-flag arguments (commit messages, issue/PR bodies…).
+    out = out.replace(TEXT_SINK_FLAG_ARG, (whole, flag, quoted) => {
+        if (quoted.startsWith("'"))
+            return flag + INERT_DATA;
+        return INTERPOLATES.test(quoted) ? whole : flag + INERT_DATA;
+    });
+    return out;
+}
+function scanTextValue(toolName, rawValue, options) {
+    // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
+    // even inside message data is exfiltration staging, and custom rules define
+    // their own scope.
+    const honeypot = honeypotTouch(rawValue, options);
     if (honeypot)
         return honeypot;
-    const custom = customBlock(value, options);
+    const custom = customBlock(rawValue, options);
     if (custom)
         return custom;
+    // Every rule below asks "can this text ACT?" — so it sees the execution
+    // view: quoted message/document data (commit -m, issue --body, here-strings,
+    // heredocs) is inert unless it can flow into an interpreter (see
+    // stripInertDataSegments invariants). This is the generic FP guard for
+    // "wrote ABOUT a dangerous command" vs "ran one".
+    const value = stripInertDataSegments(rawValue);
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.

package/dist/commands/posixShellGuard.js

@@ -104,7 +104,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `const CLI_ENTRY=${JSON.stringify(cliEntry)};`,
         `const BLOCK_CODE=${BLOCK_CODE};`,
         `function loadRules(){try{const raw=JSON.parse(fs.readFileSync(RULES_PATH,'utf8'));const rules=(raw.rules||[]).map(r=>{try{return{id:r.id,category:r.category,severity:r.severity,reason:r.reason,source:r.source,action:r.action==='warn'?'warn':'block',re:new RegExp(r.pattern,'i')};}catch{return null;}}).filter(Boolean);return{mode:raw.mode==='block'?'block':'monitor',rules};}catch{return{mode:'monitor',rules:[]};}}`,
-        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{if(r.re.test(n)||r.re.test(line)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
+        `// Execution view (aligned with the CLI's stripInertDataSegments): commit messages, issue/PR bodies, and`,
+        `// here-strings/heredocs are DATA — inert unless the line can feed an interpreter or the region interpolates.`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]*\`/;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');o=o.replace(/((?:^|\\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\\s*)("(?:[^"\\\\]|\\\\.)*"|'(?:[^'\\\\]|\\\\.)*')/gi,(w,f,q)=>q[0]==="'"?f+' fcd_inert_data ':K.test(q)?w:f+' fcd_inert_data ');return o;}`,
+        `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action!=='warn')return r;if(!warnHit)warnHit=r;}}catch{}}return warnHit;}`,
         `function triggerFlush(){try{if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore'});c.unref();}}catch{}}`,
         `function spoolEvent(rule,line,decision){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'shell_terminal',operation:'shell_command',reason:'Shell guard: '+rule.reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});triggerFlush();}catch{}}`,
         `let argv=process.argv.slice(2);if(argv[0]==='--')argv=argv.slice(1);const line=argv.join(' ');`,

package/dist/commands/shellGuard.js

@@ -485,14 +485,42 @@ function buildGuardPs1(nodePath, cliEntry) {
         `  }`,
         `} catch { $global:FcdGuardRules = @() }`,
         ``,
+        `# Execution view (aligned with the CLI's stripInertDataSegments): message/`,
+        `# document DATA inside a command is inert — commit messages, issue/PR bodies,`,
+        `# here-strings. Never strips when the line can feed an interpreter (| sh,`,
+        `# iex, eval, xargs, base64 -d, -EncodedCommand) and keeps any region that`,
+        `# interpolates $( ) or backtick pairs — those execute BEFORE the command.`,
+        `function global:Get-FcdExecView {`,
+        `  param([string]$CommandLine)`,
+        String.raw `  if ($CommandLine -match '(?i)\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b') { return $CommandLine }`,
+        `  $out = $CommandLine`,
+        "  $keepIfInterpolates = [System.Text.RegularExpressions.MatchEvaluator]{ param($m) if ($m.Value -match '\\$\\(|" + '`[^`]*`' + "') { $m.Value } else { ' fcd_inert_data ' } }",
+        String.raw `  $out = [regex]::Replace($out, "@'[\s\S]*?'@", ' fcd_inert_data ')`,
+        `  $out = [regex]::Replace($out, '@"[\\s\\S]*?"@', $keepIfInterpolates)`,
+        String.raw `  $out = [regex]::Replace($out, "<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)", ' fcd_inert_data ')`,
+        String.raw `  $out = [regex]::Replace($out, '<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)', $keepIfInterpolates)`,
+        String.raw `  $flagArg = '((?:^|\s)(?:-m|-b|--message|--body|--title|--description|--notes?|--comment|--caption|--summary|--subject|-value|-message)[= ]\s*)("(?:[^"\\]|\\.)*"|''(?:[^''\\]|\\.)*'')'`,
+        "  $out = [regex]::Replace($out, $flagArg, [System.Text.RegularExpressions.MatchEvaluator]{ param($m) if ($m.Groups[2].Value.StartsWith(\"'\")) { $m.Groups[1].Value + ' fcd_inert_data ' } elseif ($m.Groups[2].Value -match '\\$\\(|" + '`[^`]*`' + "') { $m.Value } else { $m.Groups[1].Value + ' fcd_inert_data ' } }, 'IgnoreCase')",
+        `  return $out`,
+        `}`,
+        ``,
         `function global:Test-FcdShellGuard {`,
         `  param([string]$CommandLine)`,
         `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
         `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
+        `  $execView = $CommandLine`,
+        `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
+        `  $execNormalized = ($execView -replace '\\s+', ' ').Trim()`,
         `  $warnHit = $null`,
         `  foreach ($rule in $global:FcdGuardRules) {`,
         `    try {`,
-        `      if ($rule.Regex.IsMatch($normalized) -or $rule.Regex.IsMatch($CommandLine)) {`,
+        `      # Built-in rules ask "can this text ACT?" — they see the execution`,
+        `      # view, so a commit message quoting a dangerous command is inert.`,
+        `      # Console custom rules define their own scope — they see the raw line.`,
+        `      $isCustom = ([string]$rule.Source -eq 'custom')`,
+        `      $target = if ($isCustom) { $CommandLine } else { $execView }`,
+        `      $targetNorm = if ($isCustom) { $normalized } else { $execNormalized }`,
+        `      if ($rule.Regex.IsMatch($targetNorm) -or $rule.Regex.IsMatch($target)) {`,
         `        # A block rule always outranks a warn rule matching the same line.`,
         `        if ($rule.Action -ne 'warn') { return $rule }`,
         `        if ($null -eq $warnHit) { $warnHit = $rule }`,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.25.3"
+  "version": "1.25.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.25.3",
+  "version": "1.25.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {