fullcourtdefense-cli 1.34.17 → 1.34.18

package/dist/actionIdentity.d.ts

@@ -0,0 +1,8 @@
+/** Correlation metadata only. Never grants authority or changes a verdict. */
+export interface ActionIdentity {
+    sessionId?: string;
+    runId?: string;
+    instanceId?: string;
+}
+export declare function identityPart(value: unknown): string | undefined;
+export declare function captureActionIdentity(payload?: Record<string, unknown>, env?: NodeJS.ProcessEnv): ActionIdentity;

package/dist/actionIdentity.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityPart = identityPart;
+exports.captureActionIdentity = captureActionIdentity;
+function identityPart(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_.:@/-]{1,200}$/.test(value) ? value : undefined;
+}
+function captureActionIdentity(payload = {}, env = process.env) {
+    return {
+        sessionId: identityPart(payload.conversation_id || payload.conversationId || payload.session_id || payload.sessionId
+            || env.FCD_SESSION_ID || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID),
+        runId: identityPart(env.FCD_RUN_ID || env.GITHUB_RUN_ID || env.CI_PIPELINE_ID),
+        instanceId: identityPart(env.FCD_WORKLOAD_INSTANCE_ID),
+    };
+}

package/dist/actionPolicyEngine.js

@@ -7413,12 +7413,14 @@ function classifyShellWords(masked, raw, lead) {
   return "SHELL";
 }
 function classifyShellCommandOperation(command, depth = 0) {
+  if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
   const segments = splitShellSegments(command);
   if (segments.length === 0) return "SHELL";
   return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
 }
 function provenCompoundDownload(command, detectedUrl) {
+  if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
   if (!segments.length || !command.includes(detectedUrl)) return false;
   return segments.every((segment) => {
@@ -7456,6 +7458,41 @@ function provenCompoundDownload(command, detectedUrl) {
     return urls === 1;
   });
 }
+function provenPowerShellReadSequence(command) {
+  if (command.length > 65536 || !/(?:^|[;&\n])\s*\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(command)) return false;
+  const segments = splitShellSegments(command);
+  if (segments.length > 32 || /[`{}]/.test(command)) return false;
+  const responses = /* @__PURE__ */ new Set();
+  let requests = 0;
+  for (let segment of segments) {
+    let binding;
+    const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(.+)$/s.exec(segment);
+    if (assignment) {
+      binding = assignment[1].toLowerCase();
+      if (binding.startsWith("ps") || responses.has(binding)) return false;
+      segment = assignment[2];
+    }
+    const property = /^\((Get-Content\s+.+\|\s*ConvertFrom-Json)\)\.[A-Za-z_][\w]*$/i.exec(segment);
+    if (property) segment = property[1];
+    const pipeline = splitShellSegments(segment, true);
+    const lead = pipeline.shift() || "";
+    if (pipeline.some((part) => !/^(?:ConvertTo-Json(?:\s+-Compress)?(?:\s+-Depth\s+\d{1,2})?|ConvertFrom-Json|Select-Object\s+[\w., -]+|Format-List|Format-Table|Out-Null)$/i.test(part))) return false;
+    if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
+      const url = lead.match(/https?:\/\/[^\s"'<>]+/i)?.[0];
+      if (!url || !provenCompoundDownload(lead, url)) return false;
+      requests++;
+    } else if (/^\$[A-Za-z_][\w]*$/.test(lead)) {
+      if (binding || !responses.has(lead.slice(1).toLowerCase())) return false;
+    } else {
+      if (binding) return false;
+      if (pipeline.length === 0 && /^(?:git\s+status(?:\s+--short)?|cd\s+(?:[A-Za-z]:[\\/][\w./\\-]+|'[A-Za-z]:[\\/][^'$`\r\n]+'))$/i.test(lead)) continue;
+      const file = /^Get-Content\s+(?:'([^'\r\n]+)'|"([^"$`\r\n]+)")((?:\s+-(?:Raw|Tail\s+\d+|TotalCount\s+\d+))*)$/i.exec(lead);
+      if (!file || !/^[A-Za-z]:[\\/]/.test(file[1] || file[2]) || /[?*]/.test(file[1] || file[2])) return false;
+    }
+    if (binding) responses.add(binding);
+  }
+  return requests > 0;
+}
 function isInternalHost(hostname) {
   const host = hostname.toLowerCase();
   if (!host || host === "localhost" || host === "::1" || host.endsWith(".local") || host.endsWith(".internal")) return true;

package/dist/commands/ciProtect.js

@@ -4,6 +4,7 @@ exports.detectCiContext = detectCiContext;
 exports.ciProtectCommand = ciProtectCommand;
 const config_1 = require("../config");
 const cliVersion_1 = require("../cliVersion");
+const actionIdentity_1 = require("../actionIdentity");
 const ephemeralStack_1 = require("./ephemeralStack");
 const hostRuntime_1 = require("../hostRuntime");
 /** Detect the pipeline from standard CI env vars (GitHub Actions, GitLab CI). */
@@ -111,6 +112,7 @@ async function ciProtectCommand(args, config) {
     // (where the AI agent actually runs).
     (0, ephemeralStack_1.exportIdentityEnv)({
         FCD_MACHINE_ID: result.machineId,
+        FCD_RUN_ID: (0, actionIdentity_1.identityPart)(runId) || '',
         FCD_DEVELOPER_NAME: `ci@${repo.toLowerCase()}`,
         FCD_MACHINE_HOSTNAME: result.pipeline.key,
         // No human at this keyboard: developer-scoped approvals route to the org

package/dist/commands/hook.js

@@ -50,6 +50,7 @@ const os = __importStar(require("os"));
 const config_1 = require("../config");
 const runtimeConfig_1 = require("../runtimeConfig");
 const telemetry_1 = require("../telemetry");
+const actionIdentity_1 = require("../actionIdentity");
 const deterministicGuard_1 = require("./deterministicGuard");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const taintLedger_1 = require("./taintLedger");
@@ -1461,6 +1462,7 @@ async function hookCommandInner(args, config, io) {
     const hookFormat = claudeNormalized ? 'claude' : 'cursor';
     const client = args.agentClient || (claudeNormalized ? claudeFormatClient() : 'cursor');
     (0, telemetry_1.setVerdictClient)(client);
+    (0, telemetry_1.setVerdictIdentity)(payload);
     let event;
     let ignoreEvent = false;
     if (claudeNormalized) {
@@ -1897,7 +1899,7 @@ async function enforceActionPolicy(ctx) {
         toolName: call.toolName,
         toolArgs: call.toolArgs,
         argsSummary: call.toolArgs,
-        sessionId: sessionId(payload),
+        ...(0, actionIdentity_1.captureActionIdentity)(payload),
         source: 'cursor_hook',
         // Lets the server record the effective approval scope (developer-scoped rules degrade
         // to org where nobody can answer an IDE prompt: CI, ephemeral workloads).

package/dist/commands/mcpGateway.js

@@ -62,6 +62,7 @@ const runtimeConfig_1 = require("../runtimeConfig");
 const sessionLimits_1 = require("../sessionLimits");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
+const actionIdentity_1 = require("../actionIdentity");
 const fileWriteCanon_1 = require("../fileWriteCanon");
 const blockExplanation_1 = require("../blockExplanation");
 const distress_1 = require("../distress");
@@ -750,6 +751,7 @@ class AgentGuardApi {
     }
     async checkToolCall(input, timeoutMs) {
         const result = await this.post('/api/agent-security/runtime/check-tool-call', {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
             shieldId: this.config.shieldId,
             agentName: this.config.agentName,
             toolName: input.toolName,
@@ -772,6 +774,7 @@ class AgentGuardApi {
     }
     async recordToolCall(input) {
         await this.post('/api/agent-security/runtime/tool-call', {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
             shieldId: this.config.shieldId,
             agentName: this.config.agentName,
             toolName: input.toolName,

package/dist/commands/workloadProtect.js

@@ -41,6 +41,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const cliVersion_1 = require("../cliVersion");
+const actionIdentity_1 = require("../actionIdentity");
 const ephemeralStack_1 = require("./ephemeralStack");
 const hostRuntime_1 = require("../hostRuntime");
 /**
@@ -173,6 +174,7 @@ async function workloadProtectCommand(args, config) {
     // declare "no human here" so approvals never wait on a prompt nobody sees.
     const identityEnv = {
         FCD_MACHINE_ID: result.machineId,
+        FCD_WORKLOAD_INSTANCE_ID: (0, actionIdentity_1.identityPart)(instanceId) || '',
         FCD_DEVELOPER_NAME: `workload@${result.workload.name.toLowerCase()}`,
         FCD_MACHINE_HOSTNAME: result.workload.key,
         FCD_EPHEMERAL: '1',

package/dist/telemetry.d.ts

@@ -1,4 +1,5 @@
-export interface SpoolEvent {
+import { type ActionIdentity } from './actionIdentity';
+export interface SpoolEvent extends ActionIdentity {
     agentClient?: string;
     eventId: string;
     type: 'verdict';
@@ -53,6 +54,7 @@ export type VerdictPath = 'ipc' | 'local' | 'fail_open' | 'gateway';
  */
 export declare function evidenceFromToolArgs(toolArgs: Record<string, unknown> | undefined): string | undefined;
 interface VerdictTiming {
+    identity?: ActionIdentity;
     agentClient?: string;
     startedAt: number;
     path: VerdictPath;
@@ -67,6 +69,7 @@ export declare function markVerdictTiming<T>(timing: VerdictTiming, fn: () => T)
  */
 export declare function setVerdictPath(path: VerdictPath): void;
 export declare function setVerdictClient(client: string): void;
+export declare function setVerdictIdentity(payload: Record<string, unknown>): void;
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 export declare function setVerdictToolArgs(toolArgs: Record<string, unknown>): void;
 /**

package/dist/telemetry.js

@@ -37,6 +37,7 @@ exports.evidenceFromToolArgs = evidenceFromToolArgs;
 exports.markVerdictTiming = markVerdictTiming;
 exports.setVerdictPath = setVerdictPath;
 exports.setVerdictClient = setVerdictClient;
+exports.setVerdictIdentity = setVerdictIdentity;
 exports.setVerdictToolArgs = setVerdictToolArgs;
 exports.restartVerdictTiming = restartVerdictTiming;
 exports.spoolEvent = spoolEvent;
@@ -49,6 +50,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
+const actionIdentity_1 = require("./actionIdentity");
 const localDetectionUpdates_1 = require("./localDetectionUpdates");
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
@@ -163,6 +165,11 @@ function setVerdictClient(client) {
     if (store)
         store.agentClient = client;
 }
+function setVerdictIdentity(payload) {
+    const store = verdictTiming.getStore();
+    if (store)
+        store.identity = (0, actionIdentity_1.captureActionIdentity)(payload);
+}
 /** Attach the current tool call's args so every spool in this evaluation carries the command. */
 function setVerdictToolArgs(toolArgs) {
     const store = verdictTiming.getStore();
@@ -188,6 +195,8 @@ function spoolEvent(event) {
         // onboard) — the backend treats missing fields as "no sample".
         const timing = verdictTiming.getStore();
         const full = {
+            ...(0, actionIdentity_1.captureActionIdentity)(),
+            ...timing?.identity,
             eventId: crypto.randomUUID(),
             occurredAt: event.occurredAt || new Date().toISOString(),
             type: 'verdict',

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.17"
+  "version": "1.34.18"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.17",
+  "version": "1.34.18",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {