fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/runtimeConfig.js

@@ -71,9 +71,13 @@ function readCacheFile() {
 }
 function writeCacheFile(data) {
     try {
-        fs.writeFileSync(CACHE_PATH, JSON.stringify(data), { encoding: 'utf-8', mode: 0o600 });
+        // Keep the last complete policy set if writing the replacement is interrupted.
+        writeFileAtomic(CACHE_PATH, JSON.stringify(data), 0o600);
+        return true;
+    }
+    catch {
+        return false;
     }
-    catch { /* cache is best-effort */ }
 }
 function isMode(value) {
     return value === 'block' || value === 'monitor' || value === 'shadow';
@@ -185,31 +189,37 @@ function cachedToEffective(cached) {
     return { ...bundle, suspended, source: 'cache', serverValidatedAt: fetchedAt };
 }
 /** Keep only a well-formed machine-role block (limits must be numbers or null; legacy keys normalized). */
-function sanitizeMachineRole(value) {
-    if (!value || typeof value !== 'object')
-        return undefined;
+function sanitizeMachineRole(value, previous) {
+    if (value === undefined && !previous)
+        return undefined; // legacy server compatibility
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid or missing machine role');
     const role = value;
-    if (typeof role.roleId !== 'string' || typeof role.name !== 'string')
-        return undefined;
-    const rawLimits = (role.limits && typeof role.limits === 'object' ? role.limits : {});
+    if (typeof role.roleId !== 'string' || !role.roleId || typeof role.name !== 'string'
+        || (role.stage !== undefined && role.stage !== 'monitor' && role.stage !== 'enforce')) {
+        throw new Error('Invalid machine role configuration');
+    }
     return {
         roleId: role.roleId,
         name: role.name,
         summary: typeof role.summary === 'string' ? role.summary : undefined,
         stage: role.stage === 'monitor' ? 'monitor' : 'enforce',
-        limits: (0, sessionLimits_1.normalizeSessionLimits)(rawLimits),
+        limits: (0, sessionLimits_1.parseDeliveredSessionLimits)(role.limits, previous?.limits),
     };
 }
-/** Keep only well-formed policies — a malformed server payload must never poison the offline cache. */
+/** Reject incomplete policy sets before any cache or suspension marker is changed. */
 function sanitizeBundlePolicies(value) {
-    if (!Array.isArray(value))
-        return undefined;
-    return value
-        .filter((policy) => Boolean(policy && typeof policy === 'object'
-        && typeof policy.id === 'string'
-        && typeof policy.name === 'string'
-        && Array.isArray(policy.rules)))
-        .slice(0, 300);
+    if (value === undefined)
+        return undefined; // pre-action-policy server compatibility
+    if (!Array.isArray(value) || value.length > 300 || value.some(policy => !policy || typeof policy !== 'object' || typeof policy.id !== 'string' || !policy.id
+        || typeof policy.name !== 'string' || !Array.isArray(policy.rules)
+        || (policy.enforcement !== undefined && !['standard', 'hard'].includes(policy.enforcement))
+        || policy.rules.some((rule) => !rule || !Array.isArray(rule.operations)
+            || !rule.operations.length || rule.operations.some((op) => typeof op !== 'string' || !op)
+            || !['allow', 'block', 'require_approval', 'log'].includes(rule.verdict)))) {
+        throw new Error('Invalid or incomplete action policy bundle');
+    }
+    return value;
 }
 /**
  * Resolve the effective runtime bundle for a Shield, using the local cache when
@@ -248,6 +258,8 @@ async function getRuntimeBundle(input) {
         }
         catch { /* best-effort */ }
     }
+    let responseReceived = false;
+    let cacheWriteFailed = false;
     try {
         const headers = { 'Content-Type': 'application/json' };
         if (input.shieldKey)
@@ -262,6 +274,7 @@ async function getRuntimeBundle(input) {
         if (input.machineId)
             params.set('machineId', input.machineId);
         const resp = await fetch(`${input.apiUrl}/api/cli/bundle?${params.toString()}`, { method: 'GET', headers, signal: AbortSignal.timeout(input.timeoutMs ?? REFRESH_TIMEOUT_MS) });
+        responseReceived = true;
         // 304 Not Modified — cache is still valid; refresh its timestamp.
         // Re-assert the marker when the cache says suspended, but NEVER clear it
         // here: a 304 validates the version string, not the (locally editable)
@@ -270,9 +283,13 @@ async function getRuntimeBundle(input) {
         if (resp.status === 304 && cached) {
             const validated = { ...cached, fetchedAt: Date.now() };
             cache[input.shieldId] = validated;
-            writeCacheFile(cache);
+            const persisted = writeCacheFile(cache);
             if (cached.suspended === true)
                 assertSuspendMarker(input.shieldId);
+            if (!persisted && input.requireServerValidation) {
+                cacheWriteFailed = true;
+                throw new Error('Runtime policy cache could not be saved');
+            }
             return cachedToEffective(validated);
         }
         if (resp.status === 401 || resp.status === 403) {
@@ -280,9 +297,23 @@ async function getRuntimeBundle(input) {
             // not a network one. The two need opposite fixes; code them apart.
             (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.AUTH_BROKEN, `bundle fetch HTTP ${resp.status}${input.shieldKey ? '' : ' (no shield key available)'}`);
         }
+        else if (!resp.ok) {
+            (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.BACKEND_REJECTED, `bundle fetch HTTP ${resp.status}`);
+        }
         if (resp.ok) {
             const body = await resp.json().catch(() => ({}));
-            if (body.success && body.data && isMode(body.data.mode)) {
+            if (body.success === true && body.data && isMode(body.data.mode) && typeof body.data.version === 'string' && body.data.version.trim()) {
+                if (cached?.actionPolicies !== undefined && body.data.actionPolicies === undefined) {
+                    throw new Error('Action policies missing from a previously supported bundle');
+                }
+                if ((body.data.suspended !== undefined && typeof body.data.suspended !== 'boolean')
+                    || (body.data.suspended === undefined && (cached?.suspended === true || hasValidSuspendMarker()))) {
+                    throw new Error('Invalid or missing suspension status');
+                }
+                if ((body.data.failClosed !== undefined && typeof body.data.failClosed !== 'boolean')
+                    || (cached?.failClosed !== undefined && body.data.failClosed === undefined)) {
+                    throw new Error('Invalid or missing offline enforcement setting');
+                }
                 const entry = {
                     mode: body.data.mode,
                     version: body.data.version,
@@ -307,27 +338,35 @@ async function getRuntimeBundle(input) {
                         ? { enabled: body.data.honeypot.enabled === true }
                         : undefined,
                     machineAction: body.data.machineAction,
+                    mcpToolTrust: body.data.mcpToolTrust,
+                    protectionProfile: body.data.protectionProfile,
                     actionPolicies: sanitizeBundlePolicies(body.data.actionPolicies),
-                    machineRole: sanitizeMachineRole(body.data.machineRole),
+                    machineRole: sanitizeMachineRole(body.data.machineRole, cached?.machineRole),
                     fetchedAt: Date.now(),
                 };
                 cache[input.shieldId] = entry;
-                writeCacheFile(cache);
+                const persisted = writeCacheFile(cache);
                 // Sync the tamper-resistant marker from the ONLY trustworthy source —
                 // a live server response. Suspended asserts it; not-suspended is the
                 // sole path that clears it.
                 if (entry.suspended)
                     assertSuspendMarker(input.shieldId);
-                else
+                else if (persisted)
                     clearSuspendMarker(input.shieldId);
+                if (!persisted && input.requireServerValidation) {
+                    cacheWriteFailed = true;
+                    throw new Error('Runtime policy cache could not be saved');
+                }
                 const { fetchedAt, revalidateAttemptAt: _attemptAt, ...bundle } = entry;
-                return { ...bundle, source: 'server', serverValidatedAt: fetchedAt };
+                return { ...bundle, suspended: bundle.suspended === true || hasValidSuspendMarker(), source: 'server', serverValidatedAt: fetchedAt };
             }
+            (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.BACKEND_REJECTED, 'Bundle response did not contain a valid mode and version');
         }
     }
     catch (error) {
-        // Fetch threw — DNS/proxy/timeout, i.e. the control plane is unreachable.
-        (0, distress_1.reportDistress)('bundle', distress_1.DISTRESS.NETWORK_DOWN, error instanceof Error ? error.message : String(error));
+        // Separate transport failure, invalid server data and local disk failure:
+        // each requires a different repair, and reaches fleet diagnostics as such.
+        (0, distress_1.reportDistress)('bundle', cacheWriteFailed ? distress_1.DISTRESS.POLICY_CACHE_WRITE_FAILED : responseReceived ? distress_1.DISTRESS.BACKEND_REJECTED : distress_1.DISTRESS.NETWORK_DOWN, error instanceof Error ? error.message : String(error));
         /* fall through to cache / default */
     }
     if (input.requireServerValidation) {

package/dist/selfTest.d.ts

@@ -1,4 +1,5 @@
 import { type ResolvedCliCredentials } from './config';
+import { type BoundaryVerification } from './boundaryVerification';
 /**
  * Deep self-test — the upgraded `health_check` remote action.
  *
@@ -33,6 +34,7 @@ export interface SelfTestReport {
     ok: boolean;
     checks: SelfTestCheck[];
     ranAt: string;
+    boundaryVerification?: BoundaryVerification;
 }
 export declare function runDeepSelfTest(input: {
     creds: ResolvedCliCredentials;

package/dist/selfTest.js

@@ -10,6 +10,7 @@ const runtimeConfig_1 = require("./runtimeConfig");
 const integrity_1 = require("./integrity");
 const selfUpdate_1 = require("./selfUpdate");
 const windowsTaskState_1 = require("./windowsTaskState");
+const boundaryVerification_1 = require("./boundaryVerification");
 /** Windows scheduled-task probe: exists + (when readable) its last result code. */
 function queryScheduledTask(taskName) {
     const query = (0, child_process_1.spawnSync)('schtasks', ['/Query', '/TN', taskName, '/V', '/FO', 'LIST'], {
@@ -175,7 +176,14 @@ async function runDeepSelfTest(input) {
     // PowerShell blocked on a hardened bank machine, or one of the redundant
     // credential stores unavailable while auth demonstrably works) used to fail
     // the whole report, training operators to ignore red self-tests entirely.
-    return { ok: checks.every(check => check.ok || check.optional === true), checks, ranAt: new Date().toISOString() };
+    let boundaryVerification;
+    try {
+        boundaryVerification = await (0, boundaryVerification_1.runBoundaryVerification)();
+    }
+    catch {
+        log('Boundary verification unavailable — checker could not complete.');
+    }
+    return { ok: checks.every(check => check.ok || check.optional === true), checks, ranAt: new Date().toISOString(), boundaryVerification };
 }
 /** FCD per-user tasks that could flash a console window on every trigger. */
 const WINDOWED_TASK_CANDIDATES = ['FullCourtDefense Daemon', 'FullCourtDefense Daemon Watchdog', 'FullCourtDefense Auto-Protect', 'FullCourtDefenseDesktopDiscover'];

package/dist/sessionLimits.d.ts

@@ -11,6 +11,8 @@ export interface SessionRoleLimits {
 }
 /** Normalize a raw bundle limits object (new or legacy keys) into the split shape. */
 export declare function normalizeSessionLimits(raw: Record<string, unknown> | undefined | null): SessionRoleLimits;
+/** Validate a delivered limit set before replacing cached enforcement state. */
+export declare function parseDeliveredSessionLimits(raw: unknown, previous?: SessionRoleLimits): SessionRoleLimits;
 export interface SessionUsage {
     sessionId: string;
     dbReads: number;

package/dist/sessionLimits.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RESPONSE_VOLUME_LIMITS = void 0;
 exports.normalizeSessionLimits = normalizeSessionLimits;
+exports.parseDeliveredSessionLimits = parseDeliveredSessionLimits;
 exports.getSessionUsage = getSessionUsage;
 exports.recordSessionOp = recordSessionOp;
 exports.recordSessionResponse = recordSessionResponse;
@@ -117,6 +118,29 @@ function normalizeSessionLimits(raw) {
     }
     return limits;
 }
+/** Validate a delivered limit set before replacing cached enforcement state. */
+function parseDeliveredSessionLimits(raw, previous) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error('Invalid machine role limits');
+    const values = raw;
+    for (const key of [...LIMIT_KEYS, ...Object.keys(LEGACY_LIMIT_KEY_MAP)]) {
+        const value = values[key];
+        if (value !== undefined && value !== null
+            && !(typeof value === 'number' && Number.isFinite(value) && value >= 0)) {
+            throw new Error(`Invalid machine role limit: ${key}`);
+        }
+    }
+    const limits = normalizeSessionLimits(values);
+    for (const key of LIMIT_KEYS) {
+        // A missing field is not a request to remove a previously finite limit.
+        // Explicit null is the supported Unlimited value. Legacy numeric keys
+        // remain valid because normalization maps them to their successors first.
+        if (typeof previous?.[key] === 'number' && limits[key] === null && values[key] !== null) {
+            throw new Error(`Machine role limit missing from bundle: ${key}`);
+        }
+    }
+    return limits;
+}
 const SESSION_FILE_TTL_MS = 48 * 60 * 60 * 1000;
 function sessionsDir() {
     return path.join(os.homedir(), '.fullcourtdefense', 'sessions');

package/dist/telemetry.d.ts

@@ -1,5 +1,10 @@
 import { type ActionIdentity } from './actionIdentity';
 export interface SpoolEvent extends ActionIdentity {
+    cliVersion?: string;
+    detectorRevision?: number;
+    detectorSha256?: string;
+    /** Loaded module state when recording, not proof this module decided the action. */
+    detectorActive?: boolean;
     agentClient?: string;
     eventId: string;
     type: 'verdict';

package/dist/telemetry.js

@@ -52,6 +52,8 @@ const path = __importStar(require("path"));
 const machineIdentity_1 = require("./machineIdentity");
 const actionIdentity_1 = require("./actionIdentity");
 const localDetectionUpdates_1 = require("./localDetectionUpdates");
+const cliVersion_1 = require("./cliVersion");
+const installedCliVersion = (0, cliVersion_1.cliVersion)();
 /**
  * Local-first telemetry: every enforcement decision is appended to an on-disk
  * spool (instant, offline-safe) and flushed to the backend in batches. Critical
@@ -194,7 +196,12 @@ function spoolEvent(event) {
         // took. Absent when a caller spools outside a hook evaluation (guards,
         // onboard) — the backend treats missing fields as "no sample".
         const timing = verdictTiming.getStore();
+        const detector = localDetectionUpdates_1.localDetectorUpdates.getDetectorStatus();
         const full = {
+            cliVersion: installedCliVersion,
+            detectorRevision: detector.revision,
+            detectorSha256: detector.sha256,
+            detectorActive: detector.active,
             ...(0, actionIdentity_1.captureActionIdentity)(),
             ...timing?.identity,
             eventId: crypto.randomUUID(),
@@ -366,6 +373,7 @@ async function flushSpoolLocked(input) {
                     ? {
                         agentVersion: input.agentVersion,
                         detectionUpdates: localDetectionUpdates_1.localDetectionUpdates.getStatus(),
+                        detectorUpdates: localDetectionUpdates_1.localDetectorUpdates.getDetectorStatus(),
                         integrityOk: input.integrityOk,
                         integrityReasons: input.integrityReasons,
                         integrityCheckedAt: input.integrityCheckedAt,

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.21"
+  "version": "1.34.25"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.21",
+  "version": "1.34.25",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -13,10 +13,13 @@
     "README.md"
   ],
   "scripts": {
+    "test:action-benchmark-report": "node scripts/test-action-benchmark-report.js && node scripts/test-action-benchmark-isolation.js",
+    "test:boundary-verification": "npm run build && node scripts/test-boundary-verification.js",
+    "test:detector-updates": "npm run build && node scripts/test-detector-artifacts.js && node scripts/test-detector-publication.js && node scripts/test-detection-updates.js && node scripts/test-detection-cache.js",
     "test:native-hooks": "npm run build && node scripts/test-codex-activation.js && node scripts/test-native-hook-launch.js && node scripts/test-native-hook-edges.js && node scripts/test-client-telemetry.js && node scripts/test-native-hook-clients.js",
     "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
     "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
-    "build": "tsc && node scripts/bundle-policy-engine.js && node scripts/copy-attack-corpus.js",
+    "build": "tsc && node scripts/bundle-policy-engine.js && node scripts/copy-attack-corpus.js && node scripts/bundle-containment-runtime.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",
     "test:msi-stop-filter": "node scripts/test-msi-stop-filter.js",
@@ -44,7 +47,7 @@
     "test:user-objective-labels": "npm run build && node scripts/test-user-objective-labels.js",
     "test:remote-mcp-gateway": "npm run build && node scripts/test-remote-mcp-gateway.js",
     "test:e2e-onboarding-personas": "npm run build && node scripts/test-e2e-onboarding-personas.js",
-    "test:onboarding-transaction": "npm run build && node scripts/test-onboarding-transaction.js",
+    "test:onboarding-transaction": "npm run build && node scripts/test-onboarding-transaction.js && node scripts/test-onboarding-summary.js",
     "test:posture-blast": "npm run build && node scripts/test-posture-blast-radius.js",
     "test:ping-e2e": "npm run build && node scripts/test-ping-e2e.js",
     "test:daemon-e2e": "npm run build && node scripts/test-daemon-e2e.js",
@@ -58,7 +61,7 @@
     "test:scan-root-compaction": "npm run build && node scripts/test-scan-root-compaction.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:distress-ledger": "npm run build && node scripts/test-distress-ledger.js",
-    "test:poll-loop": "npm run build && node scripts/test-poll-loop-resilience.js && node scripts/test-background-bundle.js",
+    "test:poll-loop": "npm run build && node scripts/test-poll-loop-resilience.js && node scripts/test-background-bundle.js && node scripts/test-policy-refresh.js",
     "test:slim-hook": "npm run build && node scripts/test-slim-hook.js",
     "test:killswitch": "npm run build && node scripts/test-killswitch-integrity.js",
     "test:restart-guarantees": "npm run build && node scripts/test-daemon-restart-guarantees.js",
@@ -80,7 +83,7 @@
     "test:failopen-killswitch": "npm run build && node scripts/test-failopen-killswitch.js",
     "test:enroll-cache-reset": "npm run build && node scripts/test-enroll-cache-reset.js",
     "test:offline-policy": "npm run build && node scripts/test-offline-policy-enforcement.js",
-    "test:developer-confirmation": "npm run build && node scripts/test-developer-confirmation.js",
+    "test:developer-confirmation": "npm run build && node scripts/test-developer-confirmation.js && node scripts/test-approval-scope.js && node scripts/test-approval-prompt.js",
     "test:local-safety-ask": "npm run build && node scripts/test-local-safety-ask.js",
     "test:terminal-mcp-ask": "npm run build && node scripts/test-terminal-mcp-ask.js",
     "test:demo-actions": "npm run build && node scripts/test-demo-actions.js",
@@ -96,7 +99,7 @@
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
-    "prepublishOnly": "npm run build && node scripts/check-detection-baseline.js && node scripts/test-detection-updates.js && node scripts/test-detection-cache.js && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
+    "prepublishOnly": "npm run build && node scripts/check-detection-baseline.js && node scripts/check-detector-baseline.js && node scripts/test-detector-artifacts.js && node scripts/test-detector-publication.js && node scripts/test-detection-updates.js && node scripts/test-detection-cache.js && node scripts/test-msi-payload-deps.js && node scripts/test-shell-parity.js && node scripts/test-terminal-mcp-ask.js"
   },
   "keywords": [
     "llm",
@@ -112,6 +115,7 @@
   ],
   "license": "MIT",
   "devDependencies": {
+    "@anthropic-ai/sandbox-runtime": "0.0.76",
     "@types/node": "^25.3.0",
     "acorn": "8.18.0",
     "esbuild": "0.28.2",