fullcourtdefense-cli 1.34.16 → 1.34.18

package/dist/actionIdentity.d.ts

@@ -0,0 +1,8 @@
+/** Correlation metadata only. Never grants authority or changes a verdict. */
+export interface ActionIdentity {
+    sessionId?: string;
+    runId?: string;
+    instanceId?: string;
+}
+export declare function identityPart(value: unknown): string | undefined;
+export declare function captureActionIdentity(payload?: Record<string, unknown>, env?: NodeJS.ProcessEnv): ActionIdentity;

package/dist/actionIdentity.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityPart = identityPart;
+exports.captureActionIdentity = captureActionIdentity;
+function identityPart(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_.:@/-]{1,200}$/.test(value) ? value : undefined;
+}
+function captureActionIdentity(payload = {}, env = process.env) {
+    return {
+        sessionId: identityPart(payload.conversation_id || payload.conversationId || payload.session_id || payload.sessionId
+            || env.FCD_SESSION_ID || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID),
+        runId: identityPart(env.FCD_RUN_ID || env.GITHUB_RUN_ID || env.CI_PIPELINE_ID),
+        instanceId: identityPart(env.FCD_WORKLOAD_INSTANCE_ID),
+    };
+}

package/dist/actionPolicyEngine.js

@@ -5739,10 +5739,11 @@ function parse3(input, options) {
 }
 
 // src/actionPolicyEngine.ts
+var import_detectionData = require("./detectionData");
 function isFirestoreQueryUrl(target) {
   try {
     const url = new URL(target);
-    return url.origin === "https://firestore.googleapis.com" && !url.username && !url.password && !url.search && !url.hash && /^\/v1\/projects\/[^/]+\/databases\/[^/]+\/documents(?:\/[^/]+)*:runQuery$/.test(url.pathname);
+    return (0, import_detectionData.getDetectionData)().firestoreQueryOrigins.includes(url.origin) && !url.username && !url.password && !url.search && !url.hash && /^\/v1\/projects\/[^/]+\/databases\/[^/]+\/documents(?:\/[^/]+)*:runQuery$/.test(url.pathname);
   } catch {
     return false;
   }
@@ -5871,7 +5872,7 @@ function provenJavaScriptReadUrls(code) {
         const options = ev(node.arguments[0]);
         if (options.kind !== "object" || options.fields.size !== 1) return fail();
         const scopes = options.fields.get("scopes");
-        if (scopes?.kind !== "array" || scopes.items.length !== 1 || string(scopes.items[0]) !== "https://www.googleapis.com/auth/datastore") return fail();
+        if (scopes?.kind !== "array" || scopes.items.length !== 1 || !(0, import_detectionData.getDetectionData)().googleAuthScopes.includes(string(scopes.items[0]))) return fail();
         return object([["getClient", callable("google.getClient")]]);
       }
       case "ReturnStatement":
@@ -7007,7 +7008,45 @@ function extractUrl(args, _argsText) {
   return "";
 }
 function shellUrlActionText(command) {
-  const segments = splitShellSegments(command);
+  if (command.length > 65536) return command;
+  const originalSegments = splitShellSegments(command);
+  const localPaths = /* @__PURE__ */ new Map();
+  const pathAssignments = /* @__PURE__ */ new Set();
+  let expandedSize = command.length;
+  let expansionOverflow = false;
+  const expand = (original, value) => {
+    expandedSize += Math.max(0, value.length - original.length);
+    if (expandedSize > 65536) {
+      expansionOverflow = true;
+      return original;
+    }
+    return value;
+  };
+  const segments = originalSegments.map((segment, index) => {
+    const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(?:'([^']*)'|"([^"$`]*)")$/.exec(segment);
+    if (assignment) {
+      const name = assignment[1].toLowerCase();
+      const value = assignment[2] ?? assignment[3];
+      if (localPaths.has(name) || localPaths.size >= 32 || value.length > 4096 || !/^(?:[A-Za-z]:[\\/]|\/(?!\/))[\w ./\\-]+$/.test(value)) return segment;
+      localPaths.set(name, value);
+      pathAssignments.add(index);
+      return segment;
+    }
+    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/.exec(segment);
+    const prefix = literal2?.[0] || "";
+    const tail = segment.slice(prefix.length).replace(
+      /"\$([A-Za-z_][\w]*)([\\/][\w ./\\-]*)?"/g,
+      (match, name, suffix) => {
+        const value = localPaths.get(name.toLowerCase());
+        return value ? expand(match, `"${value}${suffix || ""}"`) : match;
+      }
+    ).replace(/(?<=\s)\$([A-Za-z_][\w]*)(?=\s|$)/g, (match, name) => {
+      const value = localPaths.get(name.toLowerCase());
+      return value ? expand(match, `"${value}"`) : match;
+    });
+    return prefix + tail;
+  });
+  if (expansionOverflow) return command;
   const filtered = segments.map((segment) => {
     const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/;
     const piped = segment.match(literal2);
@@ -7040,7 +7079,10 @@ function shellUrlActionText(command) {
     return tail;
   });
   const onlyStoredData = segments.every((segment, index) => {
+    if (pathAssignments.has(index)) return true;
     if (filtered[index] !== segment) return true;
+    const directory = /^New-Item\s+-ItemType\s+Directory\s+(?:-Force\s+)?-(?:LiteralPath|Path)\s+(?:'([^']*)'|"([^"$`]*)")\s*(?:\|\s*Out-Null)?$/i.exec(segment);
+    if (directory && /^(?:[A-Za-z]:[\\/]|\/(?!\/))[\w ./\\-]+$/.test(directory[1] ?? directory[2])) return true;
     const words = maskQuotedSpans(segment);
     if (!/[$`|;&(){}<>]/.test(segment) && /^(?:(?:cd|pushd|set-location)\s+[^\r\n]+|(?:pwd|popd|get-location)|git\s+status(?:\s+[^\r\n]+)?)$/i.test(segment)) return true;
     return !/[$`]/.test(segment) && /^\(Get-Content\s+(?:[A-Za-z]:[\\/])?[\w./\\-]+\s+-Raw\)\.Replace\("",\s*""\)\s*\|\s*Set-Content\s+(?:[A-Za-z]:[\\/])?[\w./\\-]+\s+-Encoding\s+utf8\s*$/i.test(words);
@@ -7371,12 +7413,14 @@ function classifyShellWords(masked, raw, lead) {
   return "SHELL";
 }
 function classifyShellCommandOperation(command, depth = 0) {
+  if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
   const segments = splitShellSegments(command);
   if (segments.length === 0) return "SHELL";
   return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
 }
 function provenCompoundDownload(command, detectedUrl) {
+  if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
   if (!segments.length || !command.includes(detectedUrl)) return false;
   return segments.every((segment) => {
@@ -7414,6 +7458,41 @@ function provenCompoundDownload(command, detectedUrl) {
     return urls === 1;
   });
 }
+function provenPowerShellReadSequence(command) {
+  if (command.length > 65536 || !/(?:^|[;&\n])\s*\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(command)) return false;
+  const segments = splitShellSegments(command);
+  if (segments.length > 32 || /[`{}]/.test(command)) return false;
+  const responses = /* @__PURE__ */ new Set();
+  let requests = 0;
+  for (let segment of segments) {
+    let binding;
+    const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(.+)$/s.exec(segment);
+    if (assignment) {
+      binding = assignment[1].toLowerCase();
+      if (binding.startsWith("ps") || responses.has(binding)) return false;
+      segment = assignment[2];
+    }
+    const property = /^\((Get-Content\s+.+\|\s*ConvertFrom-Json)\)\.[A-Za-z_][\w]*$/i.exec(segment);
+    if (property) segment = property[1];
+    const pipeline = splitShellSegments(segment, true);
+    const lead = pipeline.shift() || "";
+    if (pipeline.some((part) => !/^(?:ConvertTo-Json(?:\s+-Compress)?(?:\s+-Depth\s+\d{1,2})?|ConvertFrom-Json|Select-Object\s+[\w., -]+|Format-List|Format-Table|Out-Null)$/i.test(part))) return false;
+    if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
+      const url = lead.match(/https?:\/\/[^\s"'<>]+/i)?.[0];
+      if (!url || !provenCompoundDownload(lead, url)) return false;
+      requests++;
+    } else if (/^\$[A-Za-z_][\w]*$/.test(lead)) {
+      if (binding || !responses.has(lead.slice(1).toLowerCase())) return false;
+    } else {
+      if (binding) return false;
+      if (pipeline.length === 0 && /^(?:git\s+status(?:\s+--short)?|cd\s+(?:[A-Za-z]:[\\/][\w./\\-]+|'[A-Za-z]:[\\/][^'$`\r\n]+'))$/i.test(lead)) continue;
+      const file = /^Get-Content\s+(?:'([^'\r\n]+)'|"([^"$`\r\n]+)")((?:\s+-(?:Raw|Tail\s+\d+|TotalCount\s+\d+))*)$/i.exec(lead);
+      if (!file || !/^[A-Za-z]:[\\/]/.test(file[1] || file[2]) || /[?*]/.test(file[1] || file[2])) return false;
+    }
+    if (binding) responses.add(binding);
+  }
+  return requests > 0;
+}
 function isInternalHost(hostname) {
   const host = hostname.toLowerCase();
   if (!host || host === "localhost" || host === "::1" || host.endsWith(".local") || host.endsWith(".internal")) return true;

package/dist/commands/ciProtect.js

@@ -4,6 +4,7 @@ exports.detectCiContext = detectCiContext;
 exports.ciProtectCommand = ciProtectCommand;
 const config_1 = require("../config");
 const cliVersion_1 = require("../cliVersion");
+const actionIdentity_1 = require("../actionIdentity");
 const ephemeralStack_1 = require("./ephemeralStack");
 const hostRuntime_1 = require("../hostRuntime");
 /** Detect the pipeline from standard CI env vars (GitHub Actions, GitLab CI). */
@@ -111,6 +112,7 @@ async function ciProtectCommand(args, config) {
     // (where the AI agent actually runs).
     (0, ephemeralStack_1.exportIdentityEnv)({
         FCD_MACHINE_ID: result.machineId,
+        FCD_RUN_ID: (0, actionIdentity_1.identityPart)(runId) || '',
         FCD_DEVELOPER_NAME: `ci@${repo.toLowerCase()}`,
         FCD_MACHINE_HOSTNAME: result.pipeline.key,
         // No human at this keyboard: developer-scoped approvals route to the org

package/dist/commands/daemon.js

@@ -75,6 +75,7 @@ const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
+const localDetectionUpdates_1 = require("../localDetectionUpdates");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
 const cmdGuard_1 = require("./cmdGuard");
@@ -1204,6 +1205,7 @@ async function runDaemon(args, config) {
     const pollBundle = async () => {
         if (!creds.shieldId)
             return;
+        void localDetectionUpdates_1.localDetectionUpdates.refresh();
         if (!creds.shieldKey) {
             // Credential-broken machine: stay reachable via the key-less signed-
             // action channel while credential recovery keeps retrying.

package/dist/commands/hook.js

@@ -50,6 +50,7 @@ const os = __importStar(require("os"));
 const config_1 = require("../config");
 const runtimeConfig_1 = require("../runtimeConfig");
 const telemetry_1 = require("../telemetry");
+const actionIdentity_1 = require("../actionIdentity");
 const deterministicGuard_1 = require("./deterministicGuard");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const taintLedger_1 = require("./taintLedger");
@@ -1461,6 +1462,7 @@ async function hookCommandInner(args, config, io) {
     const hookFormat = claudeNormalized ? 'claude' : 'cursor';
     const client = args.agentClient || (claudeNormalized ? claudeFormatClient() : 'cursor');
     (0, telemetry_1.setVerdictClient)(client);
+    (0, telemetry_1.setVerdictIdentity)(payload);
     let event;
     let ignoreEvent = false;
     if (claudeNormalized) {
@@ -1897,7 +1899,7 @@ async function enforceActionPolicy(ctx) {
         toolName: call.toolName,
         toolArgs: call.toolArgs,
         argsSummary: call.toolArgs,
-        sessionId: sessionId(payload),
+        ...(0, actionIdentity_1.captureActionIdentity)(payload),
         source: 'cursor_hook',
         // Lets the server record the effective approval scope (developer-scoped rules degrade
         // to org where nobody can answer an IDE prompt: CI, ephemeral workloads).

package/dist/commands/mcpGateway.js

@@ -62,6 +62,7 @@ const runtimeConfig_1 = require("../runtimeConfig");
 const sessionLimits_1 = require("../sessionLimits");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
+const actionIdentity_1 = require("../actionIdentity");
 const fileWriteCanon_1 = require("../fileWriteCanon");
 const blockExplanation_1 = require("../blockExplanation");
 const distress_1 = require("../distress");
@@ -750,6 +751,7 @@ class AgentGuardApi {
     }
     async checkToolCall(input, timeoutMs) {
         const result = await this.post('/api/agent-security/runtime/check-tool-call', {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
             shieldId: this.config.shieldId,
             agentName: this.config.agentName,
             toolName: input.toolName,
@@ -772,6 +774,7 @@ class AgentGuardApi {
     }
     async recordToolCall(input) {
         await this.post('/api/agent-security/runtime/tool-call', {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
             shieldId: this.config.shieldId,
             agentName: this.config.agentName,
             toolName: input.toolName,

package/dist/commands/workloadProtect.js

@@ -41,6 +41,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const cliVersion_1 = require("../cliVersion");
+const actionIdentity_1 = require("../actionIdentity");
 const ephemeralStack_1 = require("./ephemeralStack");
 const hostRuntime_1 = require("../hostRuntime");
 /**
@@ -173,6 +174,7 @@ async function workloadProtectCommand(args, config) {
     // declare "no human here" so approvals never wait on a prompt nobody sees.
     const identityEnv = {
         FCD_MACHINE_ID: result.machineId,
+        FCD_WORKLOAD_INSTANCE_ID: (0, actionIdentity_1.identityPart)(instanceId) || '',
         FCD_DEVELOPER_NAME: `workload@${result.workload.name.toLowerCase()}`,
         FCD_MACHINE_HOSTNAME: result.workload.key,
         FCD_EPHEMERAL: '1',

package/dist/detectionData.d.ts

@@ -0,0 +1,21 @@
+export declare const DETECTION_SCHEMA = 1;
+export declare const MAX_DETECTION_BYTES = 16384;
+export declare const DETECTION_SIGNATURE_DOMAIN = "fullcourtdefense/detection-data/v1\n";
+export declare const DETECTION_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEALTPVDAPBFn0XNHo+y3GFHQ8Inr/OM7z1vqUixWL8R00=\n-----END PUBLIC KEY-----";
+export interface DetectionData {
+    schema: 1;
+    revision: number;
+    /** These capabilities never execute data, and never contain a policy verdict. */
+    googleAuthScopes: string[];
+    firestoreQueryOrigins: string[];
+}
+export declare const BUNDLED_DETECTION_DATA: Readonly<DetectionData>;
+export declare function getDetectionData(): Readonly<DetectionData>;
+export declare function validateDetectionData(value: unknown): DetectionData;
+export interface DetectionEnvelope {
+    payload: string;
+    signature: string;
+}
+export declare function verifyDetectionEnvelope(raw: string, now?: number, publicKey?: string): DetectionData;
+/** Callers must authenticate envelopes before activation; always copy/freeze to avoid mutation. */
+export declare function activateDetectionData(data: DetectionData): boolean;

package/dist/detectionData.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUNDLED_DETECTION_DATA = exports.DETECTION_PUBLIC_KEY = exports.DETECTION_SIGNATURE_DOMAIN = exports.MAX_DETECTION_BYTES = exports.DETECTION_SCHEMA = void 0;
+exports.getDetectionData = getDetectionData;
+exports.validateDetectionData = validateDetectionData;
+exports.verifyDetectionEnvelope = verifyDetectionEnvelope;
+exports.activateDetectionData = activateDetectionData;
+/** Pure, bounded detection vocabulary. Vendored with the policy engine into CLI/demo. */
+const crypto_1 = require("crypto");
+exports.DETECTION_SCHEMA = 1;
+exports.MAX_DETECTION_BYTES = 16_384;
+exports.DETECTION_SIGNATURE_DOMAIN = 'fullcourtdefense/detection-data/v1\n';
+exports.DETECTION_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEALTPVDAPBFn0XNHo+y3GFHQ8Inr/OM7z1vqUixWL8R00=
+-----END PUBLIC KEY-----`;
+exports.BUNDLED_DETECTION_DATA = Object.freeze({
+    schema: 1, revision: 1,
+    googleAuthScopes: Object.freeze(['https://www.googleapis.com/auth/datastore']),
+    firestoreQueryOrigins: Object.freeze(['https://firestore.googleapis.com']),
+});
+let active = exports.BUNDLED_DETECTION_DATA;
+function getDetectionData() { return active; }
+function exactKeys(value, keys) {
+    return !!value && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).length === keys.length && keys.every(key => Object.prototype.hasOwnProperty.call(value, key));
+}
+function validateDetectionData(value) {
+    const data = value;
+    if (!exactKeys(data, ['schema', 'revision', 'googleAuthScopes', 'firestoreQueryOrigins'])
+        || data.schema !== exports.DETECTION_SCHEMA || !Number.isSafeInteger(data.revision) || data.revision < 1)
+        throw new Error('Unsupported detection schema/revision');
+    const list = (items, valid) => {
+        if (!Array.isArray(items) || items.length < 1 || items.length > 32
+            || items.some(item => typeof item !== 'string' || item.length > 200 || !valid(item))
+            || new Set(items).size !== items.length)
+            throw new Error('Invalid detection vocabulary');
+        return [...items];
+    };
+    // Scope URLs are authorization metadata, not destinations. Restrict to the provider namespace.
+    const scopes = list(data.googleAuthScopes, s => /^https:\/\/www\.googleapis\.com\/auth\/[a-z][a-z0-9._-]*$/.test(s));
+    // Only Firestore service origins can use the fixed structuredQuery body/path proof.
+    // No wildcard host, arbitrary URL, regex, flag, verdict, or shell pattern is supported.
+    const origins = list(data.firestoreQueryOrigins, s => /^https:\/\/firestore(?:\.[a-z][a-z0-9-]{0,40})?\.googleapis\.com$/.test(s));
+    return { schema: 1, revision: data.revision, googleAuthScopes: scopes, firestoreQueryOrigins: origins };
+}
+function verifyDetectionEnvelope(raw, now = Date.now(), publicKey = exports.DETECTION_PUBLIC_KEY) {
+    if (Buffer.byteLength(raw) > exports.MAX_DETECTION_BYTES)
+        throw new Error('Detection update too large');
+    const envelope = JSON.parse(raw);
+    if (!exactKeys(envelope, ['payload', 'signature']) || typeof envelope.payload !== 'string'
+        || typeof envelope.signature !== 'string' || !/^[A-Za-z0-9+/]{86}==$/.test(envelope.signature))
+        throw new Error('Invalid detection envelope');
+    if (!(0, crypto_1.verify)(null, Buffer.from(exports.DETECTION_SIGNATURE_DOMAIN + envelope.payload), (0, crypto_1.createPublicKey)(publicKey), Buffer.from(envelope.signature, 'base64')))
+        throw new Error('Invalid detection signature');
+    const payload = JSON.parse(envelope.payload);
+    if (!exactKeys(payload, ['issuedAt', 'expiresAt', 'data']) || !Number.isSafeInteger(payload.issuedAt)
+        || !Number.isSafeInteger(payload.expiresAt) || payload.issuedAt > now + 60_000
+        || payload.expiresAt <= now || payload.expiresAt <= payload.issuedAt
+        || payload.expiresAt - payload.issuedAt > 90 * 86400_000)
+        throw new Error('Detection update outside validity window');
+    return validateDetectionData(payload.data);
+}
+/** Callers must authenticate envelopes before activation; always copy/freeze to avoid mutation. */
+function activateDetectionData(data) {
+    const valid = validateDetectionData(data);
+    if (valid.revision <= active.revision)
+        return false;
+    active = Object.freeze({ ...valid, googleAuthScopes: Object.freeze(valid.googleAuthScopes),
+        firestoreQueryOrigins: Object.freeze(valid.firestoreQueryOrigins) });
+    return true;
+}

package/dist/detectionUpdates.d.ts

@@ -0,0 +1,25 @@
+export declare const DETECTION_UPDATE_URL = "https://storage.googleapis.com/fullcourtdefense-cli-releases/detection/stable.json";
+export interface DetectionUpdateStatus {
+    revision: number;
+    bundledRevision: number;
+    source: 'bundled' | 'update';
+    lastCheckedAt?: string;
+    state: 'bundled' | 'current' | 'unavailable' | 'rejected';
+}
+export declare class DetectionUpdates {
+    private readonly cachePath;
+    private readonly publicKey;
+    private readonly channel;
+    private nextCheck;
+    private nextLocalRead;
+    private pending?;
+    private status;
+    constructor(cachePath: string, publicKey?: string, channel?: 'stable' | 'staging');
+    getStatus(): DetectionUpdateStatus;
+    private readCache;
+    private cachedData;
+    loadLocal(): void;
+    /** Call only from a background worker. Coalesces concurrent calls and backs off on failure. */
+    refresh(): Promise<void>;
+    private download;
+}

package/dist/detectionUpdates.js

@@ -0,0 +1,209 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DetectionUpdates = exports.DETECTION_UPDATE_URL = void 0;
+/** Background-only transport. Commands use authenticated local data; never fetch here on a verdict path. */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const detectionData_1 = require("./detectionData");
+exports.DETECTION_UPDATE_URL = 'https://storage.googleapis.com/fullcourtdefense-cli-releases/detection/stable.json';
+class DetectionUpdates {
+    cachePath;
+    publicKey;
+    channel;
+    nextCheck = 0;
+    nextLocalRead = 0;
+    pending;
+    status = { revision: detectionData_1.BUNDLED_DETECTION_DATA.revision,
+        bundledRevision: detectionData_1.BUNDLED_DETECTION_DATA.revision, source: 'bundled', state: 'bundled' };
+    constructor(cachePath, publicKey = detectionData_1.DETECTION_PUBLIC_KEY, channel = 'stable') {
+        this.cachePath = cachePath;
+        this.publicKey = publicKey;
+        this.channel = channel;
+    }
+    getStatus() {
+        const revision = (0, detectionData_1.getDetectionData)().revision;
+        return { ...this.status, revision, source: revision > detectionData_1.BUNDLED_DETECTION_DATA.revision ? 'update' : 'bundled' };
+    }
+    readCache() {
+        try {
+            if (fs.statSync(this.cachePath).size > detectionData_1.MAX_DETECTION_BYTES)
+                return undefined;
+            return fs.readFileSync(this.cachePath, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    }
+    cachedData(raw) {
+        // Expiration gates first acceptance, not continued offline use. Authenticate
+        // the signed validity period before using the last verified cache after restart.
+        const payload = JSON.parse(JSON.parse(raw).payload);
+        return (0, detectionData_1.verifyDetectionEnvelope)(raw, Math.min(Date.now(), payload.issuedAt), this.publicKey);
+    }
+    loadLocal() {
+        if (Date.now() < this.nextLocalRead)
+            return;
+        this.nextLocalRead = Date.now() + 30_000;
+        const raw = this.readCache();
+        if (!raw)
+            return;
+        try {
+            (0, detectionData_1.activateDetectionData)(this.cachedData(raw));
+        }
+        catch {
+            this.status.state = 'rejected';
+        }
+    }
+    /** Call only from a background worker. Coalesces concurrent calls and backs off on failure. */
+    refresh() {
+        if (this.pending)
+            return this.pending;
+        if (Date.now() < this.nextCheck)
+            return Promise.resolve();
+        this.nextCheck = Date.now() + 60_000 + Math.floor(Math.random() * 15_000);
+        this.pending = this.download().finally(() => { this.pending = undefined; });
+        return this.pending;
+    }
+    async download() {
+        this.status.lastCheckedAt = new Date().toISOString();
+        let raw;
+        try {
+            const response = await fetch(this.channel === 'staging' ? exports.DETECTION_UPDATE_URL.replace('/stable.json', '/staging.json') : exports.DETECTION_UPDATE_URL, { redirect: 'error', signal: AbortSignal.timeout(3000) });
+            if (!response.ok || !response.body)
+                throw new Error('Unavailable');
+            const reader = response.body.getReader();
+            const chunks = [];
+            let size = 0;
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > detectionData_1.MAX_DETECTION_BYTES)
+                        throw new Error('Oversized');
+                    chunks.push(value);
+                }
+            }
+            finally {
+                await reader.cancel().catch(() => { });
+            }
+            raw = Buffer.concat(chunks).toString('utf8');
+        }
+        catch {
+            this.status.state = 'unavailable';
+            this.nextCheck = Date.now() + 5 * 60_000;
+            return;
+        }
+        let lock;
+        let temporary;
+        try {
+            const data = (0, detectionData_1.verifyDetectionEnvelope)(raw, Date.now(), this.publicKey);
+            fs.mkdirSync(path.dirname(this.cachePath), { recursive: true });
+            const lockPath = this.cachePath + '.lock';
+            try {
+                const stat = fs.statSync(lockPath);
+                const pid = stat.size <= 30 ? Number(fs.readFileSync(lockPath, 'utf8')) : NaN;
+                if (Number.isSafeInteger(pid) && pid > 0) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch (error) {
+                        if (error.code === 'ESRCH')
+                            fs.unlinkSync(lockPath);
+                    }
+                }
+                else if (Date.now() - stat.mtimeMs > 10 * 60_000)
+                    fs.unlinkSync(lockPath);
+            }
+            catch { /* absent lock or another writer; exclusive creation decides */ }
+            lock = fs.openSync(lockPath, 'wx', 0o600);
+            fs.writeFileSync(lock, String(process.pid));
+            const currentRaw = this.readCache();
+            let cached;
+            try {
+                cached = currentRaw ? this.cachedData(currentRaw) : undefined;
+            }
+            catch { /* recover corrupt cache */ }
+            const cachedRevision = cached?.revision ?? 0;
+            const currentRevision = Math.max(cachedRevision, (0, detectionData_1.getDetectionData)().revision);
+            if (data.revision < currentRevision)
+                throw new Error('Revision downgrade');
+            if (cached && data.revision === cached.revision && JSON.stringify(data) !== JSON.stringify(cached))
+                throw new Error('Cached revision reused for different content');
+            if (data.revision === (0, detectionData_1.getDetectionData)().revision && JSON.stringify(data) !== JSON.stringify((0, detectionData_1.getDetectionData)()))
+                throw new Error('Revision reused for different content');
+            if (data.revision > currentRevision) {
+                temporary = this.cachePath + '.' + (0, crypto_1.randomUUID)() + '.tmp';
+                const fd = fs.openSync(temporary, 'wx', 0o600);
+                try {
+                    fs.writeFileSync(fd, raw);
+                    fs.fsyncSync(fd);
+                }
+                finally {
+                    fs.closeSync(fd);
+                }
+                fs.renameSync(temporary, this.cachePath);
+                temporary = undefined;
+                (0, detectionData_1.activateDetectionData)(data);
+            }
+            else if (cached)
+                (0, detectionData_1.activateDetectionData)(cached);
+            this.status.state = 'current';
+        }
+        catch {
+            this.status.state = 'rejected';
+            this.nextCheck = Date.now() + 5 * 60_000;
+        }
+        finally {
+            if (temporary) {
+                try {
+                    fs.unlinkSync(temporary);
+                }
+                catch { }
+            }
+            if (lock !== undefined) {
+                fs.closeSync(lock);
+                try {
+                    fs.unlinkSync(this.cachePath + '.lock');
+                }
+                catch { }
+            }
+        }
+    }
+}
+exports.DetectionUpdates = DetectionUpdates;

package/dist/localDetectionUpdates.d.ts

@@ -0,0 +1,2 @@
+import { DetectionUpdates } from './detectionUpdates';
+export declare const localDetectionUpdates: DetectionUpdates;

package/dist/localDetectionUpdates.js

@@ -0,0 +1,41 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.localDetectionUpdates = void 0;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const detectionUpdates_1 = require("./detectionUpdates");
+exports.localDetectionUpdates = new detectionUpdates_1.DetectionUpdates(path.join(os.homedir(), '.fullcourtdefense', 'detection-update.json'));
+exports.localDetectionUpdates.loadLocal();

package/dist/runtimeConfig.js

@@ -46,6 +46,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const distress_1 = require("./distress");
 const sessionLimits_1 = require("./sessionLimits");
+const localDetectionUpdates_1 = require("./localDetectionUpdates");
 const CACHE_PATH = path.join(os.homedir(), '.fullcourtdefense-runtime.json');
 const DEFAULT_TTL_MS = 60_000;
 const REFRESH_TIMEOUT_MS = 1_500; // tight: the hook must stay fast
@@ -216,6 +217,7 @@ function sanitizeBundlePolicies(value) {
  * or a 'default' marker so the caller can apply its local fallback.
  */
 async function getRuntimeBundle(input) {
+    localDetectionUpdates_1.localDetectionUpdates.loadLocal();
     const ttl = input.ttlMs ?? DEFAULT_TTL_MS;
     const cache = readCacheFile();
     const cached = cache[input.shieldId];

package/dist/telemetry.d.ts

@@ -1,4 +1,5 @@
-export interface SpoolEvent {
+import { type ActionIdentity } from './actionIdentity';
+export interface SpoolEvent extends ActionIdentity {
     agentClient?: string;
     eventId: string;
     type: 'verdict';
@@ -53,6 +54,7 @@ export type VerdictPath = 'ipc' | 'local' | 'fail_open' | 'gateway';
  */
 export declare function evidenceFromToolArgs(toolArgs: Record<string, unknown> | undefined): string | undefined;
 interface VerdictTiming {
+    identity?: ActionIdentity;
     agentClient?: string;
     startedAt: number;
     path: VerdictPath;
@@ -67,6 +69,7 @@ export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T)
  */
 export declare function setVerdictPath(path: VerdictPath): void;
 export declare function setVerdictClient(client: string): void;
+export declare function setVerdictIdentity(payload: Record<string, unknown>): void;
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 export declare function setVerdictToolArgs(toolArgs: Record<string, unknown>): void;
 /**

package/dist/telemetry.js

@@ -37,6 +37,7 @@ exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
 exports.setVerdictPath = setVerdictPath;
 exports.setVerdictClient = setVerdictClient;
+exports.setVerdictIdentity = setVerdictIdentity;
 exports.setVerdictToolArgs = setVerdictToolArgs;
 exports.restartVerdictTiming = restartVerdictTiming;
 exports.spoolEvent = spoolEvent;
@@ -49,6 +50,8 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
+const actionIdentity_1 = require("./actionIdentity");
+const localDetectionUpdates_1 = require("./localDetectionUpdates");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -162,6 +165,11 @@ function setVerdictClient(client) {
     if (store)
         store.agentClient = client;
 }
+function setVerdictIdentity(payload) {
+    const store = verdictTiming.getStore();
+    if (store)
+        store.identity = (0, actionIdentity_1.captureActionIdentity)(payload);
+}
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 function setVerdictToolArgs(toolArgs) {
     const store = verdictTiming.getStore();
@@ -187,6 +195,8 @@ function spoolEvent(event) {
         // onboard) — the backend treats missing fields as "no sample".
         const timing = verdictTiming.getStore();
         const full = {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
+            ...timing?.identity,
             eventId: crypto.randomUUID(),
             occurredAt: event.occurredAt || new Date().toISOString(),
             type: 'verdict',
@@ -355,6 +365,7 @@ async function flushSpoolLocked(input) {
                 heartbeat: input.heartbeat
                     ? {
                         agentVersion: input.agentVersion,
+                        detectionUpdates: localDetectionUpdates_1.localDetectionUpdates.getStatus(),
                         integrityOk: input.integrityOk,
                         integrityReasons: input.integrityReasons,
                         integrityCheckedAt: input.integrityCheckedAt,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.16"
+  "version": "1.34.18"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.16",
+  "version": "1.34.18",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -96,7 +96,7 @@
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
+    "prepublishOnly": "npm run build && node scripts/check-detection-baseline.js && node scripts/test-detection-updates.js && node scripts/test-detection-cache.js && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",