fullcourtdefense-cli 1.30.0 → 1.32.0

package/dist/agentTerminal.d.ts

@@ -0,0 +1,47 @@
+export interface AgentTerminalMarker {
+    /** Environment variable name. */
+    name: string;
+    /** When set, the variable must equal this value; otherwise any non-empty value counts. */
+    equals?: string;
+    /** Which agent sets it (for messages / docs). */
+    agent: string;
+}
+/** Environment markers that an AI agent, not a person, is driving this terminal. */
+export declare const AGENT_TERMINAL_MARKERS: readonly AgentTerminalMarker[];
+export declare function isAgentDrivenTerminal(env?: NodeJS.ProcessEnv): boolean;
+/** Shown (with the rule name) when an ask lands in an agent-driven terminal with no IDE answer behind it. */
+export declare const AGENT_TERMINAL_ASK_BLOCKED: string;
+/** Shown when the IDE prompt already answered for this exact command. */
+export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed \u2014 the developer confirmed this exact command in the IDE prompt.";
+/** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
+export declare function ideShellPendingKey(command: string): string;
+/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
+export declare function ideLocalSafetyRememberKey(ruleId: string): string;
+/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+export declare const IDE_CONFIRMATION_WINDOW_MS: number;
+/**
+ * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
+ * answer for this command / rule? Used by the in-process tests and mirrored
+ * by the generated guard code below.
+ */
+export declare function ideConfirmedFor(ledger: {
+    pending?: Array<{
+        key?: string;
+        raisedAt?: string;
+    }>;
+    remembered?: Array<{
+        key?: string;
+        expiresAt?: string;
+    }>;
+} | undefined, command: string, ruleId: string, now?: number): boolean;
+/**
+ * Node snippet for the cmd.exe guard and the POSIX checker. Defines
+ * `agentTerminal()` and `ideConfirmed(line, ruleId)`; expects `fs`, `crypto`,
+ * `os` and `path` to be in scope.
+ */
+export declare function buildAgentTerminalJs(): string;
+/**
+ * PowerShell snippet for the PSReadLine guard. Defines
+ * `Test-FcdAgentTerminal` and `Test-FcdIdeConfirmed -Line -RuleId`.
+ */
+export declare function buildAgentTerminalPs(): string;

package/dist/agentTerminal.js

@@ -0,0 +1,187 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDE_CONFIRMATION_WINDOW_MS = exports.AGENT_TERMINAL_IDE_CONFIRMED = exports.AGENT_TERMINAL_ASK_BLOCKED = exports.AGENT_TERMINAL_MARKERS = void 0;
+exports.isAgentDrivenTerminal = isAgentDrivenTerminal;
+exports.ideShellPendingKey = ideShellPendingKey;
+exports.ideLocalSafetyRememberKey = ideLocalSafetyRememberKey;
+exports.ideConfirmedFor = ideConfirmedFor;
+exports.buildAgentTerminalJs = buildAgentTerminalJs;
+exports.buildAgentTerminalPs = buildAgentTerminalPs;
+/**
+ * Agent-driven terminals — ONE definition for the three shell guards.
+ *
+ * The terminal "ask" (`Run anyway? [y] / [s] / [N]`) exists for a HUMAN at a
+ * keyboard. When an AI agent drives the terminal (Cursor's agent-exec shell,
+ * Claude Code's Bash tool, ...) the agent is the one that would type the
+ * answer — so an ask there is not a control at all. Rule: in an agent-driven
+ * terminal the guard never offers y/N. It honors the answer the developer
+ * already gave in the IDE prompt for this exact command (the hook raised it a
+ * moment ago and the IDE only runs the command after "Allow"), and otherwise
+ * blocks with a message that says where the question is answered.
+ *
+ * Pure: no I/O. The guards render these markers + keys into their generated
+ * PowerShell / Node code, and `scripts/test-agent-terminal-ask.js` pins that
+ * the rendered code and this module agree.
+ */
+const crypto = __importStar(require("crypto"));
+/** Environment markers that an AI agent, not a person, is driving this terminal. */
+exports.AGENT_TERMINAL_MARKERS = [
+    { name: 'FCD_AGENT_TERMINAL', equals: '1', agent: 'explicit (org / wrapper opt-in)' },
+    { name: 'CURSOR_AGENT', equals: '1', agent: 'Cursor agent' },
+    { name: 'CURSOR_EXTENSION_HOST_ROLE', equals: 'agent-exec', agent: 'Cursor agent' },
+    { name: 'CLAUDECODE', equals: '1', agent: 'Claude Code' },
+    { name: 'CLAUDE_CODE_SESSION_ID', agent: 'Claude Code' },
+    { name: 'CODEX_SANDBOX', agent: 'Codex CLI' },
+    { name: 'CODEX_THREAD_ID', agent: 'Codex CLI' },
+    { name: 'GEMINI_CLI', equals: '1', agent: 'Gemini CLI' },
+    { name: 'COPILOT_AGENT', agent: 'GitHub Copilot agent' },
+];
+function isAgentDrivenTerminal(env = process.env) {
+    return exports.AGENT_TERMINAL_MARKERS.some(marker => {
+        const value = env[marker.name];
+        if (marker.equals !== undefined)
+            return value === marker.equals;
+        return typeof value === 'string' && value.length > 0;
+    });
+}
+/** Shown (with the rule name) when an ask lands in an agent-driven terminal with no IDE answer behind it. */
+exports.AGENT_TERMINAL_ASK_BLOCKED = 'an AI agent is driving this terminal, so nobody can answer this Ask here. Not executed. ' +
+    'The developer answers Allow / Deny in the IDE prompt (the agent must run the command through the IDE hook), ' +
+    'or runs it in their own terminal.';
+/** Shown when the IDE prompt already answered for this exact command. */
+exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed — the developer confirmed this exact command in the IDE prompt.';
+// ---------------------------------------------------------------------------
+// IDE-answer lookup keys. These MUST match devConfirm.ts: the hook raises a
+// pending marker keyed by sha256(`${event}|${tool}|${sha256('cmd:'+command)}`)
+// with event 'shell' and tool 'shell', and a remembered entry keyed by
+// sha256(`shell|local-safety:${ruleId}|${ruleId}`) for Local Safety ask rules.
+// ---------------------------------------------------------------------------
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+/** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
+function ideShellPendingKey(command) {
+    return sha256(`shell|shell|${sha256(`cmd:${command.trim()}`)}`);
+}
+/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
+function ideLocalSafetyRememberKey(ruleId) {
+    return sha256(`shell|local-safety:${ruleId}|${ruleId}`);
+}
+/** How long a pending IDE marker counts as "the developer just allowed this" (mirrors CONFIRM_PENDING_TTL_MS). */
+exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
+/**
+ * Pure decision over a parsed dev-confirm ledger: did the IDE prompt already
+ * answer for this command / rule? Used by the in-process tests and mirrored
+ * by the generated guard code below.
+ */
+function ideConfirmedFor(ledger, command, ruleId, now = Date.now()) {
+    if (!ledger)
+        return false;
+    const pendingKey = ideShellPendingKey(command);
+    if ((ledger.pending || []).some(p => p?.key === pendingKey && typeof p.raisedAt === 'string' && now - Date.parse(p.raisedAt) < exports.IDE_CONFIRMATION_WINDOW_MS))
+        return true;
+    const rememberKey = ideLocalSafetyRememberKey(ruleId);
+    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now);
+}
+// ---------------------------------------------------------------------------
+// Rendered snippets for the generated guards (single source of truth).
+// ---------------------------------------------------------------------------
+/**
+ * Node snippet for the cmd.exe guard and the POSIX checker. Defines
+ * `agentTerminal()` and `ideConfirmed(line, ruleId)`; expects `fs`, `crypto`,
+ * `os` and `path` to be in scope.
+ */
+function buildAgentTerminalJs() {
+    const markers = JSON.stringify(exports.AGENT_TERMINAL_MARKERS.map(m => ({ n: m.name, v: m.equals })));
+    return [
+        `// Agent-driven terminal: never offer y/N to an AI agent (it would answer itself). Honor the IDE prompt's answer for this exact command, else block.`,
+        `const AGENT_MARKERS=${markers};`,
+        `function agentTerminal(){const e=process.env;return AGENT_MARKERS.some(m=>m.v!==undefined?e[m.n]===m.v:(typeof e[m.n]==='string'&&e[m.n].length>0));}`,
+        `const IDE_WINDOW_MS=${exports.IDE_CONFIRMATION_WINDOW_MS};`,
+        `function sha(s){return crypto.createHash('sha256').update(s).digest('hex');}`,
+        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.key===pk&&typeof p.raisedAt==='string'&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now);}catch{return false;}}`,
+        `const AGENT_ASK_BLOCKED=${JSON.stringify(exports.AGENT_TERMINAL_ASK_BLOCKED)};`,
+        `const AGENT_IDE_CONFIRMED=${JSON.stringify(exports.AGENT_TERMINAL_IDE_CONFIRMED)};`,
+    ].join('\n');
+}
+/**
+ * PowerShell snippet for the PSReadLine guard. Defines
+ * `Test-FcdAgentTerminal` and `Test-FcdIdeConfirmed -Line -RuleId`.
+ */
+function buildAgentTerminalPs() {
+    const markers = exports.AGENT_TERMINAL_MARKERS
+        .map(m => `@{ n = '${m.name}'; v = ${m.equals === undefined ? '$null' : `'${m.equals}'`} }`)
+        .join(', ');
+    return [
+        `# Agent-driven terminal: never offer y/N to an AI agent (it would answer itself).`,
+        `# Honor the IDE prompt's answer for this exact command, else block.`,
+        `$global:FcdAgentMarkers = @(${markers})`,
+        `$global:FcdAgentAskBlocked = '${exports.AGENT_TERMINAL_ASK_BLOCKED.replace(/'/g, "''")}'`,
+        `$global:FcdAgentIdeConfirmed = '${exports.AGENT_TERMINAL_IDE_CONFIRMED.replace(/'/g, "''")}'`,
+        `function global:Test-FcdAgentTerminal {`,
+        `  foreach ($m in $global:FcdAgentMarkers) {`,
+        `    $val = [Environment]::GetEnvironmentVariable($m.n)`,
+        `    if ($null -ne $m.v) { if ($val -eq $m.v) { return $true } }`,
+        `    elseif (-not [string]::IsNullOrEmpty($val)) { return $true }`,
+        `  }`,
+        `  return $false`,
+        `}`,
+        `function global:Get-FcdSha256 { param([string]$Text)`,
+        `  $sha = [System.Security.Cryptography.SHA256]::Create()`,
+        `  try { return (($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Text)) | ForEach-Object { $_.ToString('x2') }) -join '') } finally { $sha.Dispose() }`,
+        `}`,
+        `function global:Test-FcdIdeConfirmed { param([string]$Line, [string]$RuleId)`,
+        `  try {`,
+        `    $ledgerPath = Join-Path $HOME '.fullcourtdefense\\dev-confirm.json'`,
+        `    if (-not (Test-Path -LiteralPath $ledgerPath)) { return $false }`,
+        `    $ledger = Get-Content -LiteralPath $ledgerPath -Raw | ConvertFrom-Json`,
+        `    $now = [DateTimeOffset]::UtcNow`,
+        `    $pk = Get-FcdSha256 ('shell|shell|' + (Get-FcdSha256 ('cmd:' + $Line.Trim())))`,
+        `    foreach ($p in @($ledger.pending)) {`,
+        `      if ($null -ne $p -and $p.key -eq $pk -and $p.raisedAt) {`,
+        `        $age = $now - [DateTimeOffset]::Parse($p.raisedAt, [Globalization.CultureInfo]::InvariantCulture)`,
+        `        if ($age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
+        `      }`,
+        `    }`,
+        `    $rk = Get-FcdSha256 ('shell|local-safety:' + $RuleId + '|' + $RuleId)`,
+        `    foreach ($r in @($ledger.remembered)) {`,
+        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt) {`,
+        `        if ([DateTimeOffset]::Parse($r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) -gt $now) { return $true }`,
+        `      }`,
+        `    }`,
+        `  } catch { }`,
+        `  return $false`,
+        `}`,
+    ].join('\n');
+}

package/dist/commands/agentCi.d.ts

@@ -12,4 +12,6 @@ export interface AgentCiArgs {
     apiKey?: string;
     apiUrl?: string;
 }
+/** True when the path lives under the repository being gated (not the runner's home / system dirs). */
+export declare function isInsideRepo(cwd: string, filePath?: string): boolean;
 export declare function agentCiCommand(args: AgentCiArgs, config: BotGuardConfig): Promise<void>;

package/dist/commands/agentCi.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInsideRepo = isInsideRepo;
 exports.agentCiCommand = agentCiCommand;
 const crypto = __importStar(require("crypto"));
 const child_process_1 = require("child_process");
@@ -201,6 +202,13 @@ function resolveChangedFiles(cwd, args) {
         return null;
     return new Set(files.map(file => normalizeRelativePath(cwd, file)));
 }
+/** True when the path lives under the repository being gated (not the runner's home / system dirs). */
+function isInsideRepo(cwd, filePath) {
+    if (!filePath)
+        return false;
+    const rel = path.relative(path.resolve(cwd), path.resolve(cwd, filePath));
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
 function isChangedFile(cwd, changedFiles, filePath) {
     if (!changedFiles)
         return true;
@@ -234,7 +242,13 @@ function evaluateAgentGate(args) {
     const agentFiles = (0, discoverAgentFiles_1.scanAgentFiles)({ cwd })
         .filter(file => isChangedFile(cwd, changedFiles, file.filePath));
     const secrets = (0, discoverSecrets_1.scanSecrets)({ cwd, maxEnvDepth: 3 });
+    // agent-ci is a gate on the REPOSITORY. The secrets scanner also inspects the
+    // host's credential stores (~/.docker/config.json, ~/.kube/config, ~/.aws, …);
+    // on a CI runner those belong to the runner image, not to the code under
+    // review, and the developer cannot fix them from the PR. Host posture is the
+    // `discover` command's job — here only findings inside the repo count.
     const secretFindings = secrets.findings
+        .filter(item => isInsideRepo(cwd, item.filePath))
         .filter(item => isChangedFile(cwd, changedFiles, item.filePath));
     const requireGateway = args.requireGateway !== 'false';
     const requiredControls = parseRequiredControls(args.requireApprovalFor);

package/dist/commands/cmdGuard.js

@@ -46,6 +46,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const shellGuard_1 = require("./shellGuard");
+const agentTerminal_1 = require("../agentTerminal");
 const notify_1 = require("../notify");
 /**
  * Interactive cmd.exe guard — blocks dangerous commands TYPED in Command Prompt.
@@ -163,11 +164,12 @@ function buildGuardJs(nodePath, cliEntry) {
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,
         `// made the user's terminal wait for a full CLI process INCLUDING the network`,
         `// flush after every finding. Monitor mode must never add synchronous latency.`,
-        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' — the terminal "ask" answer, reported with the same facts as an IDE prompt.`,
-        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
+        `// developer: '' | 'confirmed' | 'remembered' | 'declined' | 'timeout' | 'ide' | 'agent-terminal' — the "ask" outcome, reported with the same facts as an IDE prompt.`,
+        `function spoolEvent(rule,line,decision,developer){try{const ev=line.trim();const evidence=ev.length>180?ev.slice(0,180)+'...':ev;let reason='Shell guard: '+rule.reason;if(developer==='confirmed')reason='developer confirmed in terminal prompt — '+reason;else if(developer==='remembered')reason='developer confirmed earlier in this cmd window (session memory) — '+reason;else if(developer==='declined')reason='developer declined in terminal prompt — '+reason;else if(developer==='timeout')reason='developer confirmation not given (terminal prompt timed out) — '+reason;else if(developer==='ide')reason='developer confirmed in the IDE prompt (agent-driven terminal) — '+reason;else if(developer==='agent-terminal')reason='ask cannot be answered in an agent-driven terminal (no IDE confirmation) — '+reason;const event={eventId:crypto.randomUUID(),type:'verdict',decision,toolName:'cmd_terminal',operation:'shell_command',reason,ruleId:rule.id,category:rule.category,severity:rule.severity,source:rule.source,evidence,occurredAt:new Date().toISOString()};if(developer){event.approvalScope='developer';if(developer==='confirmed'||developer==='remembered'||developer==='ide')event.approvedBy='developer';}fs.appendFileSync(SPOOL_PATH,JSON.stringify(event)+'\\n',{encoding:'utf8',mode:0o600});if(fs.existsSync(NODE_PATH)&&fs.existsSync(CLI_ENTRY)){const c=spawn(NODE_PATH,[CLI_ENTRY,'flush-spool','--heartbeat','true'],{detached:true,stdio:'ignore',windowsHide:true});c.unref();}}catch{}}`,
         `function askRemembered(ruleId){try{const m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'));const until=m&&m[ruleId];return typeof until==='number'&&until>Date.now();}catch{return false;}}`,
         `function rememberAsk(ruleId){try{let m={};try{m=JSON.parse(fs.readFileSync(ASK_MEMORY_PATH,'utf8'))||{};}catch{}m[ruleId]=Date.now()+ASK_REMEMBER_MS;fs.mkdirSync(path.dirname(ASK_MEMORY_PATH),{recursive:true});fs.writeFileSync(ASK_MEMORY_PATH,JSON.stringify(m),{encoding:'utf8',mode:0o600});}catch{}}`,
-        `// One key via choice.exe (ships with Windows): Y run once, S run + remember for this window, N / timeout not executed. FCD_ASK_TEST_ANSWER overrides for the drill.`,
+        (0, agentTerminal_1.buildAgentTerminalJs)(),
+        `// One key via choice.exe (ships with Windows): Y run once, S run + remember for this window, N / timeout not executed. FCD_ASK_TEST_ANSWER overrides for the drill (a human-only terminal — agent terminals never reach this).`,
         `function askDeveloper(hit){const forced=process.env.FCD_ASK_TEST_ANSWER;if(forced)return forced;try{const r=spawnSync('choice',['/c','YSN','/n','/t',String(ASK_TIMEOUT_S),'/d','N','/m','Run anyway?  [Y] yes   [S] yes, remember for this cmd window   [N] no   ('+ASK_TIMEOUT_S+'s):'],{stdio:'inherit',windowsHide:true});if(r.status===1)return 'y';if(r.status===2)return 's';if(r.status===3)return 'n';}catch{}return 'n';}`,
         `function delegate(args){const r=spawnSync(process.env.ComSpec||'cmd.exe',['/d','/c',...args],{stdio:'inherit',windowsHide:true});process.exit(typeof r.status==='number'?r.status:1);}`,
         `const args=process.argv.slice(2);if(!args.length)process.exit(0);if(process.env.FCD_CMD_GUARD==='off')delegate(args);`,
@@ -179,6 +181,10 @@ function buildGuardJs(nodePath, cliEntry) {
         `if(mode==='monitor'){console.error('[FullCourtDefense] monitor: '+(hit.action==='ask'?'would ask you to confirm':'would block')+' ['+(hit.severity||'')+'] '+hit.reason+' (rule '+hit.id+')');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='warn'){console.error('[FullCourtDefense] warning ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — allowed by org policy, reported to your security dashboard.');spoolEvent(hit,line,'warn');delegate(args);}`,
         `if(hit.action==='ask'){`,
+        `  if(agentTerminal()){`,
+        `    if(ideConfirmed(line,hit.id)){console.error('[FullCourtDefense] '+AGENT_IDE_CONFIRMED+' (rule '+hit.id+')');spoolEvent(hit,line,'allow','ide');delegate(args);}`,
+        `    console.error('[FullCourtDefense] ASK ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+') — '+AGENT_ASK_BLOCKED);console.error(unblockHint(hit));spoolEvent(hit,line,'block','agent-terminal');process.exit(1);`,
+        `  }`,
         `  if(askRemembered(hit.id)){console.error('[FullCourtDefense] allowed — you confirmed rule '+hit.id+' earlier in this cmd window.');spoolEvent(hit,line,'allow','remembered');delegate(args);}`,
         `  console.error('[FullCourtDefense] ASK ['+(hit.severity||'')+']: '+hit.reason+' (rule '+hit.id+')');`,
         `  console.error(unblockHint(hit));`,

package/dist/commands/deterministicGuard.d.ts

@@ -107,6 +107,22 @@ export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
+/**
+ * Prompt (chat text) scan. A prompt is TEXT, not an action: the only thing that
+ * can leave the machine through it is what is literally in it. So the prompt
+ * path decides on exactly two things:
+ *   1. an explicit org custom block, and
+ *   2. a real secret VALUE pasted into the prompt (with send intent, or next to
+ *      credential wording — once it is in agent context it can leak anywhere).
+ *
+ * Mentioning a command (`gh auth token`, `rm -rf /`, `kubectl config view --raw`),
+ * a sensitive path or a metadata IP is NOT judged here. Those are ACTIONS and
+ * are decided when they happen — beforeShellExecution / file read / MCP call —
+ * where the developer's "Ask" answer can actually be collected and the target,
+ * cwd and actor are real. A prompt hook has no Allow / Deny to offer, so a rule
+ * set to Ask could only degrade to a block here, and a developer asking how a
+ * command works would be stopped for typing its name. (action-only decision path)
+ */
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export interface DeterministicScanOutcome {
     /** The finding that stops the action, if any. */

package/dist/commands/deterministicGuard.js

@@ -526,11 +526,35 @@ function customBlock(value, options) {
     }
     return undefined;
 }
+/**
+ * A vendor-format match whose body is a DOCUMENTED placeholder, not a credential:
+ * a random body never spells a dictionary word like EXAMPLE / SAMPLE /
+ * PLACEHOLDER / REDACTED inside it (odds ~ 1 in 36^7), and never runs one
+ * character five times. Vendors reserve exactly such bodies for docs (every
+ * AWS docs access key ends in EXAMPLE). Structural, so it holds for every format.
+ */
+// Same placeholder contract as the policy engine's `plausibleTokenBody`: a
+// documentation word, a run of one character, or a >= 3-char chunk repeated 3+
+// times back to back (`TestTokenTestTokenTestToken…` — how fixtures get padded
+// to length; odds ~ 1 in 62^6 per position in a random body).
+const SECRET_PLACEHOLDER_BODY_RE = /example|sample|placeholder|redacted|dummy|changeme|fake|xxxx|(.)\1{4}|(.{3,})\2{2,}/i;
+function isDocumentedPlaceholderSecret(match) {
+    // Private key headers and connection strings are judged as a whole elsewhere.
+    if (/^-----BEGIN /.test(match) || /:\/\//.test(match))
+        return false;
+    return SECRET_PLACEHOLDER_BODY_RE.test(match);
+}
 function findSecret(value) {
     for (const pattern of SECRET_PATTERNS) {
-        const match = value.match(pattern.re);
-        if (match?.[0])
+        const re = new RegExp(pattern.re.source, pattern.re.flags.includes('g') ? pattern.re.flags : `${pattern.re.flags}g`);
+        let match;
+        while ((match = re.exec(value)) !== null) {
+            if (!match[0])
+                break;
+            if (isDocumentedPlaceholderSecret(match[0]))
+                continue;
             return { itemId: pattern.itemId, label: pattern.label, value: match[0] };
+        }
     }
     return undefined;
 }
@@ -844,7 +868,20 @@ function isSensitivePathContext(toolName, candidate) {
 //      remote executor earlier in the same statement) are kept.
 //   5. Secret-literal rules and honeypot/custom rules never use this view —
 //      a token pasted into a commit message still leaks.
-const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+// A LANGUAGE interpreter's `-c` / `-e` argument is CODE in another language, not
+// a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
+// `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
+// shell through a process-spawning API — then (and only then) the whole line is
+// kept, exactly like `bash -c`. Structural: API names, not vocabulary.
+const LANG_INTERPRETER_CODE_BEFORE = /\b(?:node|nodejs|deno|bun|python[0-9.]*|py|perl|ruby|php|lua|tsx|ts-node)(?:\.exe)?\s+(?:-c|-e|-r|eval)[= ]\s*$/i;
+const CODE_SPAWNS_PROCESS = /\b(?:child_process|execSync|execFileSync|spawnSync|spawn|execFile|exec|fork|os\.system|os\.popen|os\.exec[lvpe]*|subprocess|Popen|system|passthru|shell_exec|proc_open|popen|Process\.Start|Deno\.run|Deno\.Command|Bun\.spawn)\b/;
+const BACKTICK_SHELL_INTERPRETER = /\b(?:perl|ruby)(?:\.exe)?\s+(?:-c|-e)[= ]\s*$/i;
+function interpreterCodeSpawnsProcess(before, code) {
+    if (CODE_SPAWNS_PROCESS.test(code))
+        return true;
+    return BACKTICK_SHELL_INTERPRETER.test(before) && /`[^`]*`|%x[\[{(]/.test(code);
+}
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
@@ -870,6 +907,9 @@ function stripInertDataSegments(text) {
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
         const before = src.slice(Math.max(0, offset - 80), offset);
+        // Language-interpreter code: data unless it spawns a process (see above).
+        if (LANG_INTERPRETER_CODE_BEFORE.test(before))
+            return interpreterCodeSpawnsProcess(before, body) ? whole : INERT_DATA;
         if (CODE_CONTEXT_BEFORE.test(before))
             return whole; // code position: executes
         if (dq !== undefined && INTERPOLATES.test(body))
@@ -1010,15 +1050,22 @@ function scanDeterministicTextResponse(text, options) {
     const finding = builtIn(secret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-secret-in-tool-response', `Blocked tool response containing ${secret.label}.`, secret.value, secret.label, options);
     return finding ? { ...finding, matchedSecret: secret.value } : undefined;
 }
-function looksLikeQuestion(value) {
-    return /^(?:what|why|how|explain|describe|is|are|can you explain)\b/i.test(value.trim());
-}
-function bareOrActionIntent(value, action) {
-    const trimmed = value.trim();
-    if (looksLikeQuestion(trimmed))
-        return false;
-    return action.test(trimmed) || /^[^\n]{1,240}$/.test(trimmed);
-}
+/**
+ * Prompt (chat text) scan. A prompt is TEXT, not an action: the only thing that
+ * can leave the machine through it is what is literally in it. So the prompt
+ * path decides on exactly two things:
+ *   1. an explicit org custom block, and
+ *   2. a real secret VALUE pasted into the prompt (with send intent, or next to
+ *      credential wording — once it is in agent context it can leak anywhere).
+ *
+ * Mentioning a command (`gh auth token`, `rm -rf /`, `kubectl config view --raw`),
+ * a sensitive path or a metadata IP is NOT judged here. Those are ACTIONS and
+ * are decided when they happen — beforeShellExecution / file read / MCP call —
+ * where the developer's "Ask" answer can actually be collected and the target,
+ * cwd and actor are real. A prompt hook has no Allow / Deny to offer, so a rule
+ * set to Ask could only degrade to a block here, and a developer asking how a
+ * command works would be stopped for typing its name. (action-only decision path)
+ */
 function scanDeterministicPrompt(text, options) {
     const trimmed = text.trim();
     if (!trimmed)
@@ -1038,43 +1085,6 @@ function scanDeterministicPrompt(text, options) {
     if (contextualSecret) {
         return builtIn(contextualSecret.itemId, 'secret_exfiltration', 'secret_exfiltration', 'local-prompt-contextual-secret', `Blocked prompt containing ${contextualSecret.label}.`, contextualSecret.value, contextualSecret.label, options);
     }
-    // Questions are benign for action-oriented rules below, but this check must
-    // happen AFTER secret detection: "is this my API secret: <value>?" still
-    // leaks a credential into agent context.
-    if (looksLikeQuestion(trimmed))
-        return undefined;
-    const sensitivePath = containsSensitiveCredentialPath(trimmed);
-    if (sensitivePath && bareOrActionIntent(trimmed, /\b(?:read|open|cat|show|print|copy|upload|send|exfiltrate)\b/i)) {
-        return builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-prompt-sensitive-credential-path', `Blocked prompt targeting ${sensitivePath.label}.`, trimmed, sensitivePath.label, options);
-    }
-    if (bareOrActionIntent(trimmed, /\b(?:run|execute|launch|start)\b/i)) {
-        const reverseShell = reverseShellReason(trimmed);
-        if (reverseShell) {
-            return builtIn(reverseShell.itemId, 'reverse_shells', 'reverse_shell', 'local-prompt-reverse-shell', `Blocked prompt containing ${reverseShell.reason}.`, trimmed, reverseShell.reason, options);
-        }
-        const credentialCmd = credentialCommandReason(trimmed);
-        if (credentialCmd) {
-            const finding = builtIn(credentialCmd.itemId, 'credential_commands', 'credential_command', 'local-prompt-credential-command', `Blocked prompt containing ${credentialCmd.reason}.`, trimmed, credentialCmd.reason, options);
-            if (finding)
-                return finding;
-        }
-        const destructive = destructiveCommandReason(trimmed);
-        if (destructive) {
-            return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-prompt-destructive-command', `Blocked prompt containing ${destructive.reason}.`, trimmed, destructive.reason, options);
-        }
-        const infraDestroy = infraDestroyReason(trimmed);
-        if (infraDestroy) {
-            return builtIn(infraDestroy.itemId, 'infra_destroy', 'infra_destroy', 'local-prompt-infra-destroy', `Blocked prompt containing ${infraDestroy.reason}.`, trimmed, infraDestroy.reason, options);
-        }
-    }
-    const destructiveSql = destructiveSqlReason(trimmed);
-    if (destructiveSql && bareOrActionIntent(trimmed, /\b(?:run|execute|query|apply)\b/i)) {
-        return builtIn(destructiveSql.itemId, 'destructive_sql', 'destructive_sql', 'local-prompt-destructive-sql', `Blocked prompt containing destructive SQL command: ${destructiveSql.reason}.`, trimmed, destructiveSql.reason, options);
-    }
-    const metadata = containsMetadataEndpoint(trimmed);
-    if (metadata && /\b(?:fetch|request|curl|open|connect|call)\b/i.test(trimmed)) {
-        return builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-prompt-cloud-metadata-ssrf', `Blocked prompt targeting ${metadata.label}.`, trimmed, metadata.value, options);
-    }
     return undefined;
 }
 function splitCommand(command) {

package/dist/commands/discover.js

@@ -668,7 +668,7 @@ function describeMissingUploadCreds(config, creds) {
         parts.push('no org API key');
     return parts.join('; ') || 'unknown';
 }
-async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName, extras) {
+async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName, extras, silent = false) {
     const payload = {
         connectorName: connectorName || `Desktop MCP · ${host.hostname}`,
         host,
@@ -736,6 +736,11 @@ async function upload(servers, host, clientCoverage, apiUrl, auth, connectorName
     // Any successful inventory upload satisfies the daemon's "initial discovery"
     // requirement — onboard-time, manual, scheduled, or remote-action sweeps all count.
     (0, discoveryMarker_1.writeDiscoveryUploadMarker)('discover_upload');
+    // Silent callers (agent-ci --format sarif|json, scheduled sweeps) own stdout:
+    // a human line here would land INSIDE the machine-readable document they are
+    // emitting and break the consumer (GitHub code scanning rejects the SARIF).
+    if (silent)
+        return;
     const postureNote = extras?.posture ? ` · machine score ${extras.posture.score}/100 (${extras.posture.grade})` : '';
     console.log(`${COLOR.green}Uploaded ${ingested} MCP server(s) from ${host.hostname} to your AI Inventory${postureNote}.${COLOR.reset}`);
 }
@@ -1017,7 +1022,7 @@ async function discoverCommand(args, config) {
             console.error(`discover --upload: missing credentials (${describeMissingUploadCreds(config, creds)}). Run \`fullcourtdefense login --token <fleet-enrollment-token>\`.`);
             process.exit(1);
         }
-        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras);
+        await upload(found, host, clientCoverage, creds.apiUrl, { apiKey: creds.apiKey, shieldId: creds.shieldId, shieldKey: creds.shieldKey, preferApiKey: !!args.apiKey }, args.connectorName, uploadExtras, silent || args.json === 'true');
     }
     if (args.json === 'true') {
         await maybeUpload();

package/dist/commands/hook.d.ts

@@ -53,6 +53,41 @@ export declare function normalizeClaudePayload(payload: Record<string, unknown>)
     event: HookEvent | 'ignore';
     payload: Record<string, unknown>;
 } | null;
+export declare function canonicalBuiltinToolName(toolName: string): string;
+/**
+ * Map a built-in IDE tool (any client) onto our event taxonomy. Returns null
+ * for a tool name this layer does not recognize so the caller keeps its own
+ * default (Claude: ignore; Cursor: treat as an MCP tool).
+ */
+export declare function mapBuiltinToolPayload(toolName: string, input: Record<string, unknown>, payload: Record<string, unknown>): {
+    event: HookEvent | 'ignore';
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Cursor delivers its OWN built-in tools (Shell / Read / Write / Grep / …)
+ * through the same execution hook as MCP servers, with `tool_use_id` + no
+ * server identity (`mcp_server_name` / `url` / `command` are MCP-only). Route
+ * them through the shared taxonomy so an IDE edit is a FILE action, a command
+ * is a SHELL action, and neither is ever judged as an unknown MCP tool.
+ *
+ * Shell is dropped here on purpose: Cursor also fires `beforeShellExecution`
+ * for the same command, which is the authoritative shell surface — evaluating
+ * it twice produced two (sometimes different) verdicts for one action.
+ */
+export declare function normalizeCursorBuiltinTool(payload: Record<string, unknown>): {
+    event: HookEvent | 'ignore';
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Cursor-format entry: infer the event from the `--event` flag / payload shape,
+ * then route Cursor built-in tools through the shared taxonomy. Exported so the
+ * IDE false-positive corpus (Layer A) evaluates exactly what the hook evaluates.
+ */
+export declare function canonicalizeCursorPayload(argEvent: string | undefined, payload: Record<string, unknown>): {
+    event: HookEvent;
+    payload: Record<string, unknown>;
+    ignore: boolean;
+};
 /**
  * Map a Cursor execution-hook payload onto an Action Policy tool call.
  * Returns null when there is nothing actionable to evaluate.