fullcourtdefense-cli 1.28.0 → 1.30.0

package/dist/commands/shellGuard.js

@@ -39,10 +39,14 @@ exports.guardArtifactStale = guardArtifactStale;
 exports.writeGuardArtifact = writeGuardArtifact;
 exports.guardCliEntry = guardCliEntry;
 exports.toShellGuardAction = toShellGuardAction;
+exports.builtinRuleIds = builtinRuleIds;
+exports.builtinRulesAllOn = builtinRulesAllOn;
+exports.builtinRuleCommandNames = builtinRuleCommandNames;
 exports.writeShellGuardRules = writeShellGuardRules;
 exports.activeShellGuardRules = activeShellGuardRules;
 exports.evaluateShellCommand = evaluateShellCommand;
 exports.refreshShellGuardRules = refreshShellGuardRules;
+exports.buildGuardPs1 = buildGuardPs1;
 exports.resolveDocumentsFolder = resolveDocumentsFolder;
 exports.getShellGuardStatus = getShellGuardStatus;
 exports.isShellGuardInstalled = isShellGuardInstalled;
@@ -52,6 +56,8 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const deterministicGuard_1 = require("./deterministicGuard");
+const notify_1 = require("../notify");
 /**
  * Interactive PowerShell guard — real-time blocking of dangerous commands
  * TYPED by a human in a terminal (inside or outside the IDE).
@@ -195,7 +201,10 @@ const BUILTIN_RULES = [
         command: ['rd', 'rmdir'], flags: [String.raw `/s\b`], target: [String.raw `["']?[a-z]:[\\/]?["']?\s*(?:$|[;&|])`] }),
     compileSpec({ id: 'windows_system_dir_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of a Windows system directory',
         command: ['del', 'erase', 'rd', 'rmdir'], flags: [String.raw `/s\b`], target: [T_WIN_SYSDIR] }),
-    compileSpec({ id: 'remove_item_drive', category: 'destructive_command', severity: 'critical', reason: 'recursive Remove-Item on a drive root',
+    // Same catalog item as the `del /s` form above (windows_drive_delete): ONE
+    // console toggle, two syntaxes. Duplicate ids are intended — they share a
+    // switch and an action.
+    compileSpec({ id: 'windows_drive_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive Remove-Item on a drive root',
         command: ['remove-item', 'ri'], flags: [String.raw `-recurse\w*`], target: [String.raw `["']?[a-z]:[\\/]?["']?(?:\s|$|[;&|])`] }),
     compileSpec({ id: 'chmod_root_777', category: 'destructive_command', severity: 'high', reason: 'recursive world-writable permission change on root',
         command: ['chmod'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`, String.raw `[0-7]?777`], target: [T_UNIX_ROOT] }),
@@ -243,8 +252,16 @@ const BUILTIN_RULES = [
     { id: 'php_reverse_shell', category: 'reverse_shell', severity: 'high', reason: 'php reverse shell', source: 'builtin',
         pattern: String.raw `\bphp\s+-r\b(?=.*fsockopen)` },
     // Cloud metadata / credential exfiltration
-    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to cloud metadata endpoint', source: 'builtin',
-        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*(?:169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|100\.100\.100\.200))` },
+    // One terminal rule per CONSOLE toggle (catalog ids) — a single combined rule
+    // meant switching off / asking on one endpoint changed nothing in a shell.
+    { id: 'aws_gcp_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to the AWS/GCP metadata endpoint (169.254.169.254)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*169\.254\.169\.254)` },
+    { id: 'gcp_metadata_host', category: 'metadata_ssrf', severity: 'high', reason: 'request to the GCP metadata host (metadata.google.internal)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*metadata\.google\.internal)` },
+    { id: 'azure_metadata_host', category: 'metadata_ssrf', severity: 'high', reason: 'request to the Azure metadata host (metadata.azure.com)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*metadata\.azure\.com)` },
+    { id: 'alibaba_metadata_ip', category: 'metadata_ssrf', severity: 'high', reason: 'request to the Alibaba metadata endpoint (100.100.100.200)', source: 'builtin',
+        pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|irm)\b)(?=.*100\.100\.100\.200)` },
     { id: 'credential_exfiltration', category: 'secret_exfiltration', severity: 'critical', reason: 'credential file sent to the network', source: 'builtin',
         pattern: String.raw `(?=.*\b(?:curl|wget|iwr|invoke-webrequest|invoke-restmethod|scp|nc|ncat)\b)(?=.*(?:\.ssh[\\/]id_(?:rsa|ed25519|ecdsa|dsa)|\.aws[\\/]credentials|application_default_credentials\.json|\.npmrc|\.netrc|\.kube[\\/]config))` },
     // Infra destroy — spec-compiled where flags matter (order-independent).
@@ -268,6 +285,10 @@ const BUILTIN_RULES = [
         command: ['kubectl'], extra: [String.raw `\bdelete\s+(?:pvc|persistentvolumeclaims?)\b`], flags: [String.raw `--all`] }),
     { id: 'kubectl_delete_namespace', category: 'infra_destroy', severity: 'high', reason: 'destructive kubectl namespace delete', source: 'builtin',
         pattern: String.raw `\bkubectl\s+delete\s+(?:namespace|ns)\b` },
+    // Catalog item (strict, OFF by default — DEFAULT_DISABLED_BUILT_INS): any
+    // kubectl delete. Present so the console toggle means something in a shell.
+    { id: 'generic_kubectl_delete', category: 'infra_destroy', severity: 'medium', reason: 'kubectl delete (any resource)', source: 'builtin',
+        pattern: String.raw `\bkubectl\s+delete\b` },
     { id: 'gcloud_project_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP project deletion', source: 'builtin',
         pattern: String.raw `\bgcloud\s+projects\s+delete\b` },
     { id: 'gcloud_sql_delete', category: 'infra_destroy', severity: 'high', reason: 'GCP SQL instance deletion', source: 'builtin',
@@ -287,10 +308,11 @@ const BUILTIN_RULES = [
     // Version-control footguns — imported from shellfirm / Sigma (git group).
     compileSpec({ id: 'git_force_push', category: 'vcs_danger', severity: 'high', reason: 'git force push (overwrites remote history)',
         command: ['git'], extra: [String.raw `\bpush\b`], flags: [String.raw `--force|-f\b`], neg: [String.raw `\s--force-with-lease`] }),
-    compileSpec({ id: 'git_reset_hard', category: 'vcs_danger', severity: 'medium', reason: 'git reset --hard (discards local changes)',
-        command: ['git'], extra: [String.raw `\breset\b`], flags: [String.raw `--hard`] }),
-    compileSpec({ id: 'git_clean_force', category: 'vcs_danger', severity: 'medium', reason: 'git clean -fd (deletes untracked files)',
-        command: ['git'], extra: [String.raw `\bclean\b`], flags: [String.raw `-[a-z]*f`, String.raw `-[a-z]*d`] }),
+    // One catalog item covers both forms (console: "Git destructive clean/reset",
+    // OFF by default) — same id + regex as the IDE guard, so the console toggle
+    // means the same thing in a terminal as it does for an agent.
+    { id: 'git_clean_force', category: 'vcs_danger', severity: 'medium', reason: 'destructive git clean/reset (discards local work)', source: 'builtin',
+        pattern: String.raw `\bgit\s+(?:reset\s+--hard|clean\s+-f(?:d|x|dx)?\b)` },
     { id: 'git_branch_delete_force', category: 'vcs_danger', severity: 'low', reason: 'git force-delete branch', source: 'builtin',
         pattern: String.raw `\bgit\s+branch\b(?=[^;&|]*\s-D\b)` },
     // Anti-forensics / tamper
@@ -321,7 +343,38 @@ const BUILTIN_RULES = [
         pattern: String.raw `\btruncate\s+table\b` },
     { id: 'drop_table', category: 'destructive_sql', severity: 'medium', reason: 'DROP TABLE', source: 'builtin',
         pattern: String.raw `\bdrop\s+table\b` },
+    // Credential-revealing commands — the SAME table the IDE/agent guard
+    // evaluates (deterministicGuard.CREDENTIAL_COMMAND_RULES). One definition,
+    // every surface: a rule the console shows as "asks the developer" must ask
+    // the human typing `gh auth token` in PowerShell exactly as it asks an agent.
+    ...deterministicGuard_1.CREDENTIAL_COMMAND_RULES.map((rule) => ({
+        id: rule.itemId,
+        category: rule.categoryId,
+        severity: rule.severity,
+        reason: rule.reason,
+        source: 'builtin',
+        pattern: rule.pattern,
+    })),
 ];
+/**
+ * Leading command names that anchor a built-in rule — what a first-token hook
+ * (cmd.exe doskey) can key on. Derived from the shared tables so a new rule
+ * cannot be added without its command name reaching the cmd guard's index.
+ */
+/** Every built-in terminal rule id, ignoring console toggles (parity tests, docs). */
+function builtinRuleIds() {
+    return BUILTIN_RULES.map(rule => rule.id);
+}
+/** Every built-in terminal rule, all switched ON with default action (parity tests). */
+function builtinRulesAllOn() {
+    return BUILTIN_RULES.map(rule => ({ ...rule, action: 'block' }));
+}
+function builtinRuleCommandNames() {
+    const names = new Set();
+    for (const rule of deterministicGuard_1.CREDENTIAL_COMMAND_RULES)
+        rule.commands.forEach(name => names.add(name));
+    return Array.from(names).sort();
+}
 function escapeDotNetRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -348,6 +401,7 @@ function cachedMode() {
  */
 function cachedDisabledItemIds() {
     const disabled = new Set();
+    let snapshots = 0;
     try {
         for (const file of fs.readdirSync(SNAPSHOT_CACHE_DIR)) {
             if (!file.startsWith('local-safety-') || !file.endsWith('.json'))
@@ -356,6 +410,7 @@ function cachedDisabledItemIds() {
                 const parsed = JSON.parse(fs.readFileSync(path.join(SNAPSHOT_CACHE_DIR, file), 'utf8'));
                 const ids = parsed?.snapshot?.disabledBuiltInItemIds;
                 if (Array.isArray(ids)) {
+                    snapshots++;
                     for (const id of ids) {
                         if (typeof id === 'string' && id)
                             disabled.add(id);
@@ -366,6 +421,14 @@ function cachedDisabledItemIds() {
         }
     }
     catch { /* no snapshot cache yet */ }
+    // No console snapshot on this machine yet (fresh install, wiped cache): fall
+    // back to the catalog's own default-off set — the same set the IDE/agent
+    // guard applies offline — so a shell never enforces MORE than the IDE does.
+    // The moment a snapshot exists it is authoritative (it lists every off item).
+    if (snapshots === 0) {
+        for (const id of deterministicGuard_1.DEFAULT_DISABLED_BUILT_INS)
+            disabled.add(id);
+    }
     return disabled;
 }
 /**
@@ -563,12 +626,31 @@ function buildGuardPs1(nodePath, cliEntry) {
         `if ($null -eq $global:FcdAskRemembered) { $global:FcdAskRemembered = @{} }`,
         `$global:FcdAskTimeoutSeconds = ${exports.SHELL_ASK_TIMEOUT_SECONDS}`,
         `$global:FcdAskRememberHours = ${exports.SHELL_ASK_REMEMBER_HOURS}`,
+        `# Console page that controls shell rules — printed on every block/ask so the`,
+        `# developer knows exactly which rule (by id) stopped them and where it is changed.`,
+        `$global:FcdRulesUrl = ${psQuote((0, notify_1.shellRulesConsoleUrl)())}`,
+        `function global:Write-FcdUnblockHint {`,
+        `  param($Rule)`,
+        `  try {`,
+        `    $origin = if ([string]$Rule.Source -eq 'custom') { 'org custom rule' } else { 'built-in Local Safety rule' }`,
+        `    Write-Host ('Rule: "' + $Rule.Reason + '" (' + $origin + ', id ' + $Rule.Id + '). To remove this block an admin can set it to Ask / Warn only / Off here: ' + $global:FcdRulesUrl + '&rule=' + $Rule.Id) -ForegroundColor DarkGray`,
+        `  } catch { }`,
+        `}`,
         ``,
-        `try {`,
-        `  if (Test-Path $global:FcdRulesPath) {`,
+        `# Rules + mode are (re)loaded whenever the rules file changes on disk, so a`,
+        `# console change (rule -> Block, machine -> Protected) reaches THIS open`,
+        `# window as soon as the daemon syncs it — same as cmd.exe and bash/zsh,`,
+        `# which re-read on every command. Cost: one file-stat per command.`,
+        `$global:FcdRulesStamp = ''`,
+        `function global:Sync-FcdGuardRules {`,
+        `  try {`,
+        `    if (-not (Test-Path $global:FcdRulesPath)) { return }`,
+        `    $fcdItem = Get-Item -LiteralPath $global:FcdRulesPath`,
+        `    $stamp = [string]$fcdItem.LastWriteTimeUtc.Ticks + ':' + [string]$fcdItem.Length`,
+        `    if ($stamp -eq $global:FcdRulesStamp) { return }`,
         `    $fcdRaw = Get-Content -Raw -Path $global:FcdRulesPath | ConvertFrom-Json`,
-        `    if ($fcdRaw.mode -eq 'block') { $global:FcdGuardMode = 'block' }`,
-        `    $global:FcdGuardRules = @($fcdRaw.rules | ForEach-Object {`,
+        `    $mode = if ($fcdRaw.mode -eq 'block') { 'block' } else { 'monitor' }`,
+        `    $rules = @($fcdRaw.rules | ForEach-Object {`,
         `      try {`,
         `        [pscustomobject]@{`,
         `          Id       = [string]$_.id`,
@@ -581,8 +663,12 @@ function buildGuardPs1(nodePath, cliEntry) {
         `        }`,
         `      } catch { $null }`,
         `    } | Where-Object { $null -ne $_ })`,
-        `  }`,
-        `} catch { $global:FcdGuardRules = @() }`,
+        `    $global:FcdGuardMode = $mode`,
+        `    $global:FcdGuardRules = $rules`,
+        `    $global:FcdRulesStamp = $stamp`,
+        `  } catch { <# keep the last good rules; a half-written file must not disarm the guard #> }`,
+        `}`,
+        `Sync-FcdGuardRules`,
         ``,
         `# Execution view (aligned with the CLI's stripInertDataSegments): quoted`,
         `# spans containing whitespace are prose — inert BY DEFAULT — unless in a`,
@@ -612,6 +698,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `function global:Test-FcdShellGuard {`,
         `  param([string]$CommandLine)`,
         `  if ([string]::IsNullOrWhiteSpace($CommandLine)) { return $null }`,
+        `  try { Sync-FcdGuardRules } catch { }`,
         `  $normalized = ($CommandLine -replace '\\s+', ' ').Trim()`,
         `  $execView = $CommandLine`,
         `  try { $execView = Get-FcdExecView -CommandLine $CommandLine } catch { }`,
@@ -756,6 +843,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `        }`,
         `        Write-Host ''`,
         `        Write-Host ('[FullCourtDefense] ASK [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Yellow`,
+        `        Write-FcdUnblockHint -Rule $hit`,
         `        Write-Host ('Run anyway?  [y] yes   [s] yes, remember for this shell   [N] no   (' + $global:FcdAskTimeoutSeconds + 's): ') -NoNewline`,
         `        $answer = Read-FcdAskAnswer -TimeoutSeconds $global:FcdAskTimeoutSeconds`,
         `        if ($answer -eq 'y' -or $answer -eq 's') {`,
@@ -792,6 +880,7 @@ function buildGuardPs1(nodePath, cliEntry) {
         `      Write-Host ''`,
         `      Write-Host ('[FullCourtDefense] BLOCKED [' + $hit.Severity + ']: ' + $hit.Reason + ' (rule ' + $hit.Id + ')') -ForegroundColor Red`,
         `      Write-Host 'This command was not executed. Reported to your security dashboard.' -ForegroundColor DarkGray`,
+        `      Write-FcdUnblockHint -Rule $hit`,
         `      try { [Microsoft.PowerShell.PSConsoleReadLine]::InvokePrompt() } catch { }`,
         `      Write-FcdGuardEvent -Rule $hit -CommandLine $line -Decision 'block'`,
         `      [Microsoft.PowerShell.PSConsoleReadLine]::AcceptLine()`,

package/dist/notify.d.ts

@@ -28,3 +28,5 @@ export declare function notifyOs(n: OsNotification): void;
 export declare function consoleUrl(pathname?: string): string;
 /** Deep link to the approvals queue in the console. */
 export declare function approvalsConsoleUrl(): string;
+/** Console page that controls shell-command (Local Safety) rules; append `&rule=<id>` to focus one. */
+export declare function shellRulesConsoleUrl(): string;

package/dist/notify.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.notifyOs = notifyOs;
 exports.consoleUrl = consoleUrl;
 exports.approvalsConsoleUrl = approvalsConsoleUrl;
+exports.shellRulesConsoleUrl = shellRulesConsoleUrl;
 const child_process_1 = require("child_process");
 function spawnDetached(command, args, opts) {
     try {
@@ -137,3 +138,7 @@ function consoleUrl(pathname = '') {
 function approvalsConsoleUrl() {
     return consoleUrl('/agent-security/reports?tab=approvals');
 }
+/** Console page that controls shell-command (Local Safety) rules; append `&rule=<id>` to focus one. */
+function shellRulesConsoleUrl() {
+    return consoleUrl('/agent-security/users?view=policies&rules=shell');
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.28.0"
+  "version": "1.30.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.28.0",
+  "version": "1.30.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -32,6 +32,7 @@
     "test:cmd-guard": "npm run build && node scripts/test-cmd-guard.js",
     "test:cmd-guard-perf": "npm run build && node scripts/test-cmd-guard-perf.js",
     "test:posix-guard": "npm run build && node scripts/test-posix-guard.js",
+    "test:shell-parity": "npm run build && node scripts/test-shell-parity.js",
     "test:secret-posture": "npm run build && node scripts/test-secret-posture-fixtures.js",
     "test:agent-file-posture": "npm run build && node scripts/test-agent-file-posture.js",
     "test:realworld-posture": "npm run build && node scripts/test-realworld-posture-fixtures.js",
@@ -85,8 +86,11 @@
     "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "test:no-script-host": "npm run build && node scripts/test-no-script-host.js",
     "test:s4u-migration": "npm run build && node scripts/test-s4u-task-migration.js",
+    "test:block-explanation": "npm run build && node scripts/test-block-explanation.js",
+    "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
+    "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",