fullcourtdefense-cli 1.34.19 → 1.34.20

package/dist/actionPolicyEngine.js

@@ -6985,6 +6985,48 @@ function explicitGitHubWriteRepository(command) {
   } else if (positional && !/^[1-9][0-9]*$/.test(positional)) return void 0;
   return repository;
 }
+function withoutUnattributedJavaScriptUrls(segment) {
+  if (segment.length > 32768) return segment;
+  const inline = /^\s*node(?:\.exe)?\s+(?:-e|--eval)\s+(?:"([^"$`\\]*)"|'([^']*)')\s*$/i.exec(segment);
+  if (!inline) return segment;
+  const code = inline[1] ?? inline[2];
+  let budget = 4e3;
+  try {
+    const tree = parse3(code, { ecmaVersion: "latest", sourceType: "script", allowAwaitOutsideFunction: true });
+    const data2 = (node, names) => {
+      if (!node || --budget < 0) return false;
+      if (node.type === "Literal") return !node.regex;
+      if (node.type === "Identifier") return names.has(node.name);
+      return node.type === "ArrayExpression" && node.elements.every((item) => data2(item, names));
+    };
+    const statement = (node, names) => {
+      if (!node || --budget < 0) return false;
+      if (node.type === "Program" || node.type === "BlockStatement") {
+        const scope = new Set(names);
+        return node.body.every((item) => statement(item, scope));
+      }
+      if (node.type === "EmptyStatement") return true;
+      if (node.type === "VariableDeclaration" && node.kind === "const") {
+        return node.declarations.every((item) => {
+          if (item.id?.type !== "Identifier" || item.id.name === "console" || names.has(item.id.name) || !data2(item.init, names)) return false;
+          names.add(item.id.name);
+          return true;
+        });
+      }
+      if (node.type === "ForOfStatement" && !node.await && data2(node.right, names)) {
+        const binding = node.left;
+        const id = binding?.declarations?.[0]?.id;
+        if (binding?.type !== "VariableDeclaration" || binding.kind !== "const" || binding.declarations.length !== 1 || binding.declarations[0].init || id?.type !== "Identifier" || id.name === "console" || names.has(id.name)) return false;
+        return statement(node.body, /* @__PURE__ */ new Set([...names, id.name]));
+      }
+      const call = node.type === "ExpressionStatement" ? node.expression : void 0;
+      return call?.type === "CallExpression" && !call.optional && call.callee?.type === "MemberExpression" && !call.callee.computed && !call.callee.optional && call.callee.object?.type === "Identifier" && call.callee.object.name === "console" && call.callee.property?.name === "log" && call.arguments.every((item) => data2(item, names));
+    };
+    return statement(tree, /* @__PURE__ */ new Set()) ? "node -e fcd_literal_console_output" : segment;
+  } catch {
+    return segment;
+  }
+}
 function extractUrl(args, _argsText) {
   const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href || args.link;
   if (typeof direct === "string" && direct.trim()) return direct.trim();
@@ -6992,7 +7034,7 @@ function extractUrl(args, _argsText) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
-    const value = shellField ? shellUrlActionText(raw) : raw;
+    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).join("\n") : raw;
     const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>]+/i)?.[0];
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {

package/dist/commands/taintLedger.d.ts

@@ -35,7 +35,7 @@ export interface TaintFinding {
  */
 export declare function taintEnabled(): boolean;
 export declare function loadLedger(sessionId: string): TaintLedger;
-/** Record the developer's prompt text so sink actions can be checked against it. */
+/** Retained API for old hook callers. Prose is not an authorization grant. */
 export declare function recordUserPrompt(sessionId: string, text: string): void;
 /** Mark the session as having ingested untrusted content. Reading is never blocked. */
 export declare function markTaint(sessionId: string, source: TaintSource): void;
@@ -56,7 +56,7 @@ export declare function detectSink(event: EventKind, toolName: string, toolArgs:
  * The deterministic 3-rule check, evaluated against the CURRENT ledger state
  * (call this BEFORE recording any ingress for the same event):
  *
- *   block IF  session.tainted  AND  is_sensitive_sink  AND  NOT user_authorized
+ *   require approval IF session.tainted AND is_sensitive_sink
  */
 export declare function checkTaintedSink(sessionId: string, event: EventKind, toolName: string, toolArgs: Record<string, unknown>): TaintFinding | undefined;
 /** Record ingress for an event if applicable. Safe to call on every event. */

package/dist/commands/taintLedger.js

@@ -51,6 +51,8 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const actionPolicyEngine_1 = require("../actionPolicyEngine");
+const deterministicGuard_1 = require("./deterministicGuard");
 /**
  * Deterministic taint tracking for local IDE coding agents.
  *
@@ -60,19 +62,17 @@ const path = __importStar(require("path"));
  *   1. INGRESS  — when the agent reads UNTRUSTED content (web fetch, MCP tool
  *                 output, a file outside the workspace), the session is marked
  *                 "tainted". Reading is NEVER blocked.
- *   2. SINK     — when the agent later performs a SENSITIVE action (network
- *                 command, git push, new remote) that the USER never asked for,
- *                 AND the session is tainted, the action is blocked.
+ *   2. SINK     — an outbound action after untrusted input requires an explicit
+ *                 one-time decision when this optional guard is enabled.
  *
- * Trust is "min-trust" (Tessera): one untrusted source drags the whole session
- * to the floor, after which the agent may only do what the human explicitly
- * authorized in their prompt — not what the ingested data suggests.
+ * This is a session-level precaution, not proof of data flow or injection.
+ * Prompt/domain mentions never grant permission. Policy checks still run after
+ * one-time approval, and plain reads are classified by the shared action engine.
  *
  * Everything here is pure local logic over a per-session JSON file under
  * ~/.fullcourtdefense/taint/<sessionId>.json. No model, no network call.
  */
 const LEDGER_TTL_MS = 24 * 60 * 60 * 1000; // sessions older than 24h are pruned
-const MAX_PROMPTS = 30;
 const MAX_SOURCES = 50;
 /**
  * Whether taint tracking is enabled. OPT-IN for now (FCD_TAINT_ENFORCED=1):
@@ -90,7 +90,7 @@ function taintDir() {
     return path.join(os.homedir(), '.fullcourtdefense', 'taint');
 }
 function ledgerPath(sessionId) {
-    return path.join(taintDir(), `${safeSessionFile(sessionId)}.json`);
+    return path.join(taintDir(), `${crypto.createHash('sha256').update(sessionId).digest('hex')}.json`);
 }
 /** Make a session id safe to use as a filename. */
 function safeSessionFile(sessionId) {
@@ -124,19 +124,28 @@ function pruneStale() {
     catch { /* ignore */ }
 }
 function loadLedger(sessionId) {
-    const file = ledgerPath(sessionId);
+    let file = ledgerPath(sessionId);
     try {
+        // Read old installations only after verifying the embedded session identity.
+        if (!fs.existsSync(file))
+            file = path.join(taintDir(), `${safeSessionFile(sessionId)}.json`);
         if (!fs.existsSync(file))
             return emptyLedger(sessionId);
         const stat = fs.statSync(file);
         if (Date.now() - stat.mtimeMs > LEDGER_TTL_MS)
             return emptyLedger(sessionId);
         const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (parsed.sessionId !== sessionId)
+            return emptyLedger(sessionId);
+        const sources = Array.isArray(parsed.sources) ? parsed.sources.filter(source => source
+            && ['mcp_output', 'web_fetch', 'external_file', 'remote_pull'].includes(source.type)
+            && typeof source.detail === 'string' && Number.isFinite(Date.parse(source.at))
+            && Date.parse(source.at) <= Date.now() && Date.parse(source.at) > Date.now() - LEDGER_TTL_MS).slice(-MAX_SOURCES) : [];
         return {
             sessionId,
-            tainted: Boolean(parsed.tainted),
-            sources: Array.isArray(parsed.sources) ? parsed.sources.slice(-MAX_SOURCES) : [],
-            userPrompts: Array.isArray(parsed.userPrompts) ? parsed.userPrompts.slice(-MAX_PROMPTS) : [],
+            tainted: Boolean(parsed.tainted) && sources.length > 0,
+            sources,
+            userPrompts: [],
             createdAt: typeof parsed.createdAt === 'string' ? parsed.createdAt : nowIso(),
             updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : nowIso(),
         };
@@ -155,18 +164,11 @@ function saveLedger(ledger) {
     }
     catch { /* best effort — never break the hook on disk errors */ }
 }
-/** Record the developer's prompt text so sink actions can be checked against it. */
+/** Retained API for old hook callers. Prose is not an authorization grant. */
 function recordUserPrompt(sessionId, text) {
-    if (!taintEnabled())
-        return;
-    const trimmed = (text || '').trim();
-    if (!trimmed)
-        return;
-    const ledger = loadLedger(sessionId);
-    ledger.userPrompts.push(trimmed.slice(0, 4000));
-    if (ledger.userPrompts.length > MAX_PROMPTS)
-        ledger.userPrompts = ledger.userPrompts.slice(-MAX_PROMPTS);
-    saveLedger(ledger);
+    // Do not retain raw business prompts or infer consent from mentioned domains.
+    void sessionId;
+    void text;
 }
 /** Mark the session as having ingested untrusted content. Reading is never blocked. */
 function markTaint(sessionId, source) {
@@ -237,13 +239,6 @@ function isLocalHost(host) {
         || host === '0.0.0.0'
         || host.endsWith('.local');
 }
-/** Strip a host to its registrable-ish tail (last two labels) for loose matching. */
-function registrableDomain(host) {
-    const parts = host.split('.').filter(Boolean);
-    if (parts.length <= 2)
-        return host;
-    return parts.slice(-2).join('.');
-}
 function workspaceRoot(workspacePath) {
     return workspacePath || process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd();
 }
@@ -258,6 +253,20 @@ function isExternalFile(filePath, workspacePath) {
         return false;
     }
 }
+function provenPlainRead(inferred, targets) {
+    return (['read', 'GET', 'HEAD'].includes(inferred.operation) || inferred.context['source.type'] === 'external')
+        && inferred.context['destination.type'] !== 'external'
+        && inferred.context['toolArgs.containsSecret'] !== 'true'
+        && targets.length > 0 && targets.every(value => {
+        try {
+            const u = new URL(value);
+            return !u.search && !u.username && !u.password;
+        }
+        catch {
+            return false;
+        }
+    });
+}
 /**
  * Classify an event as untrusted INGRESS. Returns the source to record, or
  * undefined if this event does not ingest untrusted content.
@@ -295,7 +304,8 @@ function classifyIngress(event, toolName, toolArgs, workspacePath) {
  */
 function detectSink(event, toolName, toolArgs) {
     if (event === 'shell') {
-        const command = typeof toolArgs.command === 'string' ? toolArgs.command : collectStringValues(toolArgs).join(' ');
+        const raw = String(toolArgs.command || toolArgs.cmd || toolArgs.script || toolArgs.input || '');
+        const command = (0, deterministicGuard_1.stripInertDataSegments)(raw);
         if (/\bgit\s+remote\s+add\b/i.test(command)) {
             return { kind: 'git_remote_add', targets: extractHosts(command), detail: command.slice(0, 200) };
         }
@@ -304,6 +314,12 @@ function detectSink(event, toolName, toolArgs) {
         }
         if (NETWORK_CMD_HINT.test(command)) {
             const targets = extractHosts(command);
+            const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, { command });
+            // Reuse the policy engine's structural read proof. A query, userinfo or
+            // credential-bearing request still carries outbound data; keep those guarded.
+            const urls = command.match(/https?:\/\/[^\s'"<>]+/gi) || [];
+            if (provenPlainRead(inferred, urls))
+                return undefined;
             if (targets.length > 0)
                 return { kind: 'network', targets, detail: command.slice(0, 200) };
         }
@@ -313,33 +329,25 @@ function detectSink(event, toolName, toolArgs) {
         const outboundTool = /(?:http|fetch|request|curl|wget|webhook|upload|send|email|mail|slack|discord|teams|post|put|publish|notify|sms|message)/i.test(toolName);
         if (!outboundTool)
             return undefined;
-        const strings = collectStringValues(toolArgs);
-        const targets = strings.flatMap(extractHosts);
+        const inferred = (0, actionPolicyEngine_1.inferToolContext)(toolName, toolArgs);
+        // Content fields are not destinations. Only explicit request targets qualify.
+        const targetValues = ['url', 'uri', 'endpoint', 'webhookUrl', 'callbackUrl', 'destination', 'host']
+            .flatMap(key => typeof toolArgs[key] === 'string' ? [toolArgs[key]] : []);
+        const targets = targetValues.flatMap(extractHosts);
+        const carriesData = ['body', 'data', 'payload', 'json', 'headers', 'query', 'params'].some(key => toolArgs[key] !== undefined);
+        if (!carriesData && provenPlainRead(inferred, targetValues))
+            return undefined;
         if (targets.length > 0)
             return { kind: 'mcp_outbound', targets, detail: `${toolName} -> ${targets.join(', ')}`.slice(0, 200) };
         return undefined;
     }
     return undefined;
 }
-/** Did the developer's prompt authorize reaching this target host? */
-function authorizedByPrompt(ledger, targets) {
-    if (targets.length === 0)
-        return true; // no external target to authorize
-    const haystack = ledger.userPrompts.join('\n').toLowerCase();
-    if (!haystack)
-        return false;
-    // Authorized only if EVERY external target the action contacts was mentioned
-    // by the user (host or its registrable domain appears in some prompt).
-    return targets.every(host => {
-        const h = host.toLowerCase();
-        return haystack.includes(h) || haystack.includes(registrableDomain(h));
-    });
-}
 /**
  * The deterministic 3-rule check, evaluated against the CURRENT ledger state
  * (call this BEFORE recording any ingress for the same event):
  *
- *   block IF  session.tainted  AND  is_sensitive_sink  AND  NOT user_authorized
+ *   require approval IF session.tainted AND is_sensitive_sink
  */
 function checkTaintedSink(sessionId, event, toolName, toolArgs) {
     if (!taintEnabled())
@@ -350,15 +358,14 @@ function checkTaintedSink(sessionId, event, toolName, toolArgs) {
     const ledger = loadLedger(sessionId);
     if (!ledger.tainted)
         return undefined;
-    if (authorizedByPrompt(ledger, sink.targets))
-        return undefined;
     const source = ledger.sources[ledger.sources.length - 1] || { type: 'mcp_output', detail: 'untrusted content', at: nowIso() };
     const targetText = sink.targets.join(', ') || 'an external destination';
     return {
         blocked: true,
         ruleId: 'local-taint-unrequested-sink',
-        reason: `Blocked ${describeSink(sink)} to ${targetText} that you did not request, after the agent `
-            + `ingested untrusted content (${source.type}: ${source.detail}). Likely indirect prompt injection.`,
+        reason: `Review ${describeSink(sink)} to ${targetText} after this session accessed untrusted content `
+            + `(${source.type}). The opt-in session guard requires approval for this action. `
+            + 'This sequence alone does not prove prompt injection or data theft.',
         evidence: sink.detail,
         source,
         sink,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.19"
+  "version": "1.34.20"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.19",
+  "version": "1.34.20",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {