fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/detectorModule.d.ts

@@ -0,0 +1,9 @@
+import type { DetectorArtifact } from './detectorArtifact';
+import { type DetectorFacts } from './detectorRuntime';
+/** Authenticated first-party code only. This is not a hostile-code sandbox:
+ * signatures/review are the trust boundary. Separate V8 heap, bounded output
+ * and wall time contain ordinary detector bugs. Tool text remains JSON data.
+ */
+export declare function compileDetector(artifact: DetectorArtifact): ((tool: string, args: Record<string, any>) => DetectorFacts) & {
+    dispose(): void;
+};

package/dist/detectorModule.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileDetector = compileDetector;
+const worker_threads_1 = require("worker_threads");
+const detectorRuntime_1 = require("./detectorRuntime");
+const detectionData_1 = require("./detectionData");
+/** Authenticated first-party code only. This is not a hostile-code sandbox:
+ * signatures/review are the trust boundary. Separate V8 heap, bounded output
+ * and wall time contain ordinary detector bugs. Tool text remains JSON data.
+ */
+function compileDetector(artifact) {
+    const readyBuffer = new SharedArrayBuffer(8);
+    const ready = new Int32Array(readyBuffer);
+    const worker = new worker_threads_1.Worker(`
+    const {workerData,parentPort}=require('worker_threads');
+    const {Script,createContext}=require('vm');
+    const ready=new Int32Array(workerData.ready);
+    let context,evaluate;
+    try {
+      context=createContext(Object.create(null),{codeGeneration:{strings:false,wasm:false}});
+      // Expose parsed scalar fields, not Node's host URL constructor or native
+      // exceptions. The wrapper and all values visible to code belong to the VM.
+      const makeUrl=new Script('(parse => class URL { constructor(input, base) { const fields=JSON.parse(parse(String(input), base===undefined?undefined:String(base))); if(fields.error)throw new TypeError("Invalid URL"); Object.assign(this,fields); } toString(){return this.href;} })').runInContext(context,{timeout:1000});
+      context.URL=makeUrl((input,base)=>{
+        try {
+          if(typeof input!=='string'||input.length>256*1024||(base!==undefined&&(typeof base!=='string'||base.length>256*1024)))return '{"error":true}';
+          const value=new URL(input,base),fields={};
+          for(const key of ['href','origin','protocol','username','password','host','hostname','port','pathname','search','hash'])fields[key]=value[key];
+          return JSON.stringify(fields);
+        } catch { return '{"error":true}'; }
+      });
+      new Script(workerData.code).runInContext(context,{timeout:1000});
+      new Script('if(typeof FcdDetector?.inferToolContext!=="function")throw new Error("Missing export")').runInContext(context,{timeout:1000});
+      evaluate=new Script('JSON.stringify(FcdDetector.inferToolContext(...JSON.parse(inputJson)))');
+      Atomics.store(ready,0,1);
+    } catch { Atomics.store(ready,0,-1); }
+    Atomics.notify(ready,0);
+    parentPort.on('message',({input,buffer})=>{
+      const state=new Int32Array(buffer,0,2),output=new Uint8Array(buffer,8);
+      try {
+        context.inputJson=input;
+        const text=evaluate.runInContext(context,{timeout:250});
+        if(typeof text!=='string')throw new Error('Invalid output');
+        const bytes=Buffer.from(text);
+        if(bytes.length>output.length)throw new Error('Output too large');
+        output.set(bytes); Atomics.store(state,1,bytes.length); Atomics.store(state,0,1);
+      } catch { Atomics.store(state,0,-1); }
+      finally { if(context)delete context.inputJson; Atomics.notify(state,0); }
+    });
+  `, { eval: true, workerData: { code: artifact.code, ready: readyBuffer },
+        resourceLimits: { maxOldGenerationSizeMb: 48, maxYoungGenerationSizeMb: 8, stackSizeMb: 4 } });
+    let stopped = false;
+    const dispose = () => { if (!stopped) {
+        stopped = true;
+        void worker.terminate();
+    } };
+    worker.on('error', () => { stopped = true; });
+    worker.on('exit', () => { stopped = true; });
+    worker.unref();
+    Atomics.wait(ready, 0, 0, 4000);
+    if (Atomics.load(ready, 0) !== 1) {
+        dispose();
+        throw new Error('Detector initialization failed');
+    }
+    const invoke = (tool, args) => {
+        if (stopped)
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector worker unavailable');
+        const input = JSON.stringify([tool, args, (0, detectionData_1.getDetectionData)()]);
+        if (Buffer.byteLength(input) > 256 * 1024)
+            throw new Error('Detector input exceeds bound');
+        const buffer = new SharedArrayBuffer(512 * 1024 + 8);
+        const state = new Int32Array(buffer, 0, 2);
+        worker.postMessage({ input, buffer });
+        // VM deadlines count wall time, including time descheduled by Windows.
+        // Allow scheduling headroom while retaining a hard half-second fallback.
+        Atomics.wait(state, 0, 0, 500);
+        if (Atomics.load(state, 0) !== 1) {
+            dispose();
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector timed out or failed');
+        }
+        return JSON.parse(Buffer.from(new Uint8Array(buffer, 8, Atomics.load(state, 1))).toString('utf8'));
+    };
+    return Object.assign(invoke, { dispose });
+}

package/dist/detectorRuntime.d.ts

@@ -0,0 +1,21 @@
+/** In-memory detector contract. No downloads, file reads or model calls here. */
+export interface DetectorFacts {
+    operation: string;
+    context: Record<string, string>;
+}
+/** A terminated worker cannot recover on the next action. */
+export declare class DetectorWorkerUnavailable extends Error {
+}
+type Detector = ((tool: string, args: Record<string, any>) => DetectorFacts) & {
+    dispose?(): void;
+};
+export declare function detectorRuntimeStatus(): {
+    revision: number;
+    failures: number;
+    active: boolean;
+};
+export declare function installDetector(next: Detector, nextRevision: number): void;
+export declare function updatedDetectorFacts(tool: string, args: Record<string, any>): DetectorFacts | undefined;
+/** Shared validation for smoke tests and every actual inference result. */
+export declare function validateDetectorFacts(result: DetectorFacts): DetectorFacts;
+export {};

package/dist/detectorRuntime.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DetectorWorkerUnavailable = void 0;
+exports.detectorRuntimeStatus = detectorRuntimeStatus;
+exports.installDetector = installDetector;
+exports.updatedDetectorFacts = updatedDetectorFacts;
+exports.validateDetectorFacts = validateDetectorFacts;
+/** A terminated worker cannot recover on the next action. */
+class DetectorWorkerUnavailable extends Error {
+}
+exports.DetectorWorkerUnavailable = DetectorWorkerUnavailable;
+let detector;
+let revision = 0;
+let failures = 0;
+function detectorRuntimeStatus() { return { revision, failures, active: Boolean(detector) }; }
+function installDetector(next, nextRevision) {
+    if (!Number.isSafeInteger(nextRevision) || nextRevision <= revision)
+        throw new Error('Detector revision must increase');
+    detector?.dispose?.();
+    detector = next;
+    revision = nextRevision;
+    failures = 0;
+}
+function updatedDetectorFacts(tool, args) {
+    if (!detector)
+        return undefined;
+    try {
+        return validateDetectorFacts(detector(tool, args));
+    }
+    catch (error) {
+        failures++;
+        if (error instanceof DetectorWorkerUnavailable || failures >= 3) {
+            detector?.dispose?.();
+            detector = undefined;
+        }
+        return undefined;
+    }
+}
+/** Shared validation for smoke tests and every actual inference result. */
+function validateDetectorFacts(result) {
+    if (!result || typeof result.operation !== 'string' || !result.operation || result.operation.length > 100
+        || !result.context || typeof result.context !== 'object' || Array.isArray(result.context))
+        throw new Error('Invalid detector result');
+    const entries = Object.entries(result.context);
+    if (entries.length > 200 || entries.some(([key, value]) => key.length > 160 || typeof value !== 'string' || value.length > 100_000
+        || /^(?:__proto__|constructor|prototype|verdict|decision|approval)$/i.test(key)))
+        throw new Error('Invalid detector facts');
+    return { operation: result.operation, context: Object.fromEntries(entries) };
+}

package/dist/detectorUpdates.d.ts

@@ -0,0 +1,21 @@
+import { DetectionUpdates } from './detectionUpdates';
+import { type DetectorArtifact } from './detectorArtifact';
+type Snapshot = DetectorArtifact | {
+    revision: 0;
+};
+export declare class DetectorUpdates extends DetectionUpdates<Snapshot> {
+    constructor(cachePath: string, publicKey?: string, channel?: 'stable' | 'staging', machineId?: string);
+    getDetectorStatus(): {
+        active: boolean;
+        failures: number;
+        baselineRejected: boolean;
+        sha256: string | undefined;
+        sourceCommit: string | undefined;
+        revision: number;
+        bundledRevision: number;
+        source: "bundled" | "update";
+        lastCheckedAt?: string;
+        state: "bundled" | "current" | "unavailable" | "rejected" | "not_targeted";
+    };
+}
+export {};

package/dist/detectorUpdates.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DetectorUpdates = void 0;
+const detectionUpdates_1 = require("./detectionUpdates");
+const detectorArtifact_1 = require("./detectorArtifact");
+const detectorModule_1 = require("./detectorModule");
+const detectorRuntime_1 = require("./detectorRuntime");
+const detectorBaseline_1 = require("./detectorBaseline");
+let current = { revision: 0 };
+let baselineRejected = false;
+/** Compile once: the smoke-tested worker is the worker adopted after persistence. */
+function prepareDetector(data) {
+    if (!('code' in data))
+        throw new Error('Missing detector code');
+    const infer = (0, detectorModule_1.compileDetector)(data);
+    let adopted = false;
+    try {
+        (0, detectorRuntime_1.validateDetectorFacts)(infer('read_file', { path: 'sample.txt' }));
+    }
+    catch (error) {
+        infer.dispose();
+        throw error;
+    }
+    return {
+        activate() {
+            if (data.revision <= current.revision)
+                return false;
+            (0, detectorRuntime_1.installDetector)(infer, data.revision);
+            adopted = true;
+            current = Object.freeze({ ...data });
+            return true;
+        },
+        dispose() { if (!adopted)
+            infer.dispose(); },
+    };
+}
+if (detectorBaseline_1.BUNDLED_DETECTOR_ENVELOPE) {
+    try {
+        const issuedAt = JSON.parse(JSON.parse(detectorBaseline_1.BUNDLED_DETECTOR_ENVELOPE).payload).issuedAt;
+        const bundled = (0, detectorArtifact_1.verifyDetectorArtifact)(detectorBaseline_1.BUNDLED_DETECTOR_ENVELOPE, Math.min(Date.now(), issuedAt));
+        if (bundled.machineIds !== null)
+            throw new Error('CLI baseline must be approved for the full fleet');
+        const prepared = prepareDetector(bundled);
+        try {
+            prepared.activate();
+        }
+        finally {
+            prepared.dispose();
+        }
+    }
+    catch {
+        baselineRejected = true;
+    } // Preserve compiled-in inference and CLI startup.
+}
+const bundledRevision = current.revision;
+const adapter = {
+    url: 'https://storage.googleapis.com/fullcourtdefense-cli-releases/detectors/v1/stable.json',
+    maxBytes: detectorArtifact_1.MAX_DETECTOR_BYTES, bundledRevision,
+    current: () => current,
+    verify: detectorArtifact_1.verifyDetectorArtifact,
+    prepare: prepareDetector,
+    activate: data => {
+        if (data.revision <= current.revision)
+            return false;
+        const prepared = prepareDetector(data);
+        try {
+            return prepared.activate();
+        }
+        finally {
+            prepared.dispose();
+        }
+    },
+};
+class DetectorUpdates extends detectionUpdates_1.DetectionUpdates {
+    constructor(cachePath, publicKey, channel = 'stable', machineId) {
+        super(cachePath, publicKey, channel, { ...adapter,
+            eligible: data => !('machineIds' in data) || data.machineIds === null || Boolean(machineId && data.machineIds.includes(machineId)) });
+    }
+    getDetectorStatus() {
+        const { active, failures } = (0, detectorRuntime_1.detectorRuntimeStatus)();
+        return { ...this.getStatus(), active, failures, baselineRejected,
+            sha256: 'sha256' in current ? current.sha256 : undefined,
+            sourceCommit: 'sourceCommit' in current ? current.sourceCommit : undefined };
+    }
+}
+exports.DetectorUpdates = DetectorUpdates;

package/dist/devConfirm.d.ts

@@ -23,11 +23,25 @@ export declare function confirmNativeAction(reason: string, timeoutMs?: number):
  * How the OS dialog ended. `unavailable` = no dialog could be shown at all (no human,
  * no display, dialog binary missing / failed to start) — the caller may try another
  * channel. `deny` covers Deny, closing the window and the dialog's own give-up.
+ * `allow_always` = the person pressed "Always allow"; the CALLER decides what that
+ * covers (a scoped grant, see `recordDeveloperGrant`) — the dialog itself grants nothing.
  */
-export type NativeDialogOutcome = 'allow' | 'deny' | 'timeout' | 'unavailable';
+export type NativeDialogOutcome = 'allow' | 'allow_always' | 'deny' | 'timeout' | 'unavailable';
+/** Button labels — one vocabulary on every platform and in every test. */
+export declare const DIALOG_BUTTON_ALWAYS = "Always allow";
+export declare const DIALOG_BUTTON_ONCE = "Allow once";
+export declare const DIALOG_BUTTON_DENY = "Deny";
+/** Marker inside the Windows dialog script; tests recognize the spawn by it. */
+export declare const DIALOG_SCRIPT_MARKER = "FullCourtDefense.Dialog";
 /** True when this process can put a dialog in front of a person on this machine. */
 export declare function nativeDialogAvailable(): boolean;
-export declare function confirmNativeActionDetailed(reason: string, timeoutMs?: number): Promise<{
+export interface NativeDialogOptions {
+    /** Offer the third button. Off when the rule forbids memory (`remember: none`). */
+    allowAlways?: boolean;
+    /** What "Always allow" would cover, shown under the button so the click is informed. */
+    alwaysScopeLabel?: string;
+}
+export declare function confirmNativeActionDetailed(reason: string, timeoutMs?: number, options?: NativeDialogOptions): Promise<{
     outcome: NativeDialogOutcome;
     latencyMs: number;
 }>;
@@ -41,6 +55,8 @@ export interface PendingConfirmation {
     argsDigest: string;
     policyId?: string;
     policyName?: string;
+    policyHash?: string;
+    authorizationContext?: string;
     matchedRule?: string;
     sessionId?: string;
     remember: ConfirmRemember;
@@ -49,11 +65,7 @@ export interface PendingConfirmation {
     permissionHandoff?: boolean;
 }
 export interface RememberedConfirmation {
-    /**
-     * sha256(toolName|rule) — remembered per tool + the policy rule that asked (falls back to the
-     * inferred operation when the rule is anonymous). NOT per exact command: `remember: session`
-     * means "this rule, this tool, this session", exactly what the org chose.
-     */
+    /** Exact action, policy snapshot and execution context; never a broad tool grant. */
     key: string;
     toolName: string;
     operation: string;
@@ -70,17 +82,57 @@ export interface RememberedConfirmation {
  * later consumes it instead of asking a second time. Single-use, short-lived, exact-match.
  */
 export interface ConfirmedAction {
-    /** sha256(bareToolName|argsDigest). */
+    /** sha256(qualifiedToolIdentity|argsDigest). */
     key: string;
     toolName: string;
     argsDigest: string;
     confirmedAt: string;
     expiresAt: string;
 }
+/**
+ * WHAT an "Always allow" covers. Structural, parsed from the action — never the
+ * command text or a pattern over it: the programs a shell line runs (all of them,
+ * so `git push && gh pr create` and `gh pr view` are different sets), the MCP
+ * server + tool, the operation the engine derived, and the destination host when
+ * the action reaches one. A grant for `gh` writing to `github.com` never covers
+ * `curl` writing to `github.com`, nor `gh` writing to `gitlab.com`.
+ */
+export interface GrantScope {
+    /** Hook event: shell | mcp | file | read | prompt. */
+    event: string;
+    /** Shell: the IDE tool (Bash / shell). MCP: `mcp__<server>__<tool>`. Files: the tool. */
+    toolName: string;
+    /** Shell only: sorted, de-duplicated leading programs of every segment. */
+    programs?: string[];
+    /** Engine-derived operation (read / write / SHELL / DELETE / …). */
+    operation: string;
+    /** Host the action reaches (engine `destination.domain`), when any. */
+    destinationDomain?: string;
+}
+/**
+ * A developer's standing "Always allow" for one scope under one rule. Bound to the
+ * policy hash: when the org changes the rule, every grant under it is void and the
+ * developer is asked again. Expires on its own; listed and revocable on the machine.
+ */
+export interface DeveloperGrant {
+    /** sha256(scope + rule identity). */
+    key: string;
+    scope: GrantScope;
+    policyId?: string;
+    policyName?: string;
+    matchedRule?: string;
+    policyHash: string;
+    grantedAt: string;
+    expiresAt: string;
+    lastUsedAt?: string;
+    uses: number;
+}
 /** A raised confirmation that received no post-execution signal in time counts as not approved. */
 export declare const CONFIRM_PENDING_TTL_MS: number;
 /** The hook's dialog answer only carries over to the gateway call it was given for. */
 export declare const CONFIRMED_ACTION_TTL_MS: number;
+/** "Always" is long, not forever: a standing grant lapses after 30 days unless renewed by use of the dialog. */
+export declare const GRANT_TTL_MS: number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**
@@ -89,11 +141,7 @@ export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
  * developer-scoped approval must go to the org queue or block, never self-resolve.
  */
 export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;
-/**
- * Canonical digest of what the agent is about to do. Shell: the trimmed command. MCP/file: the
- * tool args with keys sorted, so the pre- and post-hook payloads (which the IDE serializes
- * independently) hash the same.
- */
+/** Canonical JSON action, including cwd and every argument. Invalid inputs cannot reuse consent. */
 export declare function actionDigest(toolArgs: Record<string, unknown>): string;
 export declare function pendingKey(event: string, toolName: string, argsDigest: string): string;
 /**
@@ -112,7 +160,10 @@ export declare function consumeConfirmedAction(toolName: string, argsDigest: str
 export interface RememberScope {
     toolName: string;
     operation: string;
+    argsDigest: string;
     policyId?: string;
+    policyHash?: string;
+    authorizationContext?: string;
     matchedRule?: string;
 }
 /** Record that the IDE was asked to confirm this action. Returns the marker (for logging). */
@@ -136,7 +187,38 @@ export declare function rejectDeveloperConfirmation(event: string, toolName: str
  */
 export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): PendingConfirmation[];
 /**
- * Is this tool + rule covered by a still-valid developer confirmation? Session memory only
- * matches the same IDE session id; 1h memory matches any session on this machine.
+ * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
+ * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
+ * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
+ * program (pure block structure like `} catch {`) contributes nothing.
+ */
+export declare function shellPrograms(command: string): string[];
+/**
+ * Does a live grant cover this action under this exact rule? Shell programs match by
+ * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
+ * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ */
+export declare function findDeveloperGrant(scope: GrantScope, rule: {
+    policyId?: string;
+    matchedRule?: string;
+    policyHash?: string;
+}, now?: Date): DeveloperGrant | undefined;
+/** The developer pressed "Always allow": store the grant (replacing any prior one for the same key). */
+export declare function recordDeveloperGrant(scope: GrantScope, rule: {
+    policyId?: string;
+    policyName?: string;
+    matchedRule?: string;
+    policyHash: string;
+}, now?: Date): DeveloperGrant | undefined;
+export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
+/** Remove one grant by key, or every grant when `key` is omitted. Returns how many were removed. */
+export declare function revokeDeveloperGrants(key?: string): number;
+/** One line a person can read on the button and in the grant list: what "Always allow" covers. */
+export declare function describeGrantScope(scope: GrantScope): string;
+/** The scope a grant would have for this action — from engine facts, never from text. */
+export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
+/**
+ * Is this exact action covered in the same session and policy context?
+ * The 1h choice is a shorter expiry, never authorization for another session.
  */
 export declare function isConfirmationRemembered(scope: RememberScope, sessionId: string | undefined, now?: Date): RememberedConfirmation | undefined;