fullcourtdefense-cli 1.34.21 → 1.34.25

package/dist/containment-runtime/vendor/java-proxy-agent/build.ts

@@ -0,0 +1,95 @@
+/**
+ * Build the JVM proxy agent (vendor/java-proxy-agent-src) into
+ * vendor/java-proxy-agent/srt-proxy-agent.jar.
+ *
+ * Same model as the seccomp / srt-win helpers: only the source is in git,
+ * the artifact is built by the release workflow and shipped in the npm
+ * package, and consumers that bundle srt point at their own copy via the
+ * `javaAgentJarPath` config key. The jar is reproducible: `jar --date`
+ * pins entry timestamps, and STORED entries in a fixed order.
+ *
+ *   npm run build:java-agent        (needs a JDK >= 17 on PATH or JAVA_HOME)
+ */
+import { spawnSync } from 'node:child_process'
+import {
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { run } from '../build-common.js'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const SRC = join(here, '..', 'java-proxy-agent-src')
+const OUT = join(here, 'srt-proxy-agent.jar')
+const AGENT_CLASS = 'com.anthropic.srt.ProxyAgent'
+
+const bin = (tool: string) =>
+  process.env.JAVA_HOME ? join(process.env.JAVA_HOME, 'bin', tool) : tool
+const javac = bin('javac')
+const jar = bin('jar')
+const version = spawnSync(javac, ['-version'], { encoding: 'utf8' })
+if (version.error) {
+  console.error(
+    `java-proxy-agent build: cannot run ${javac}: ${version.error.message}`,
+  )
+  process.exit(1)
+}
+
+function walk(dir: string): string[] {
+  const out: string[] = []
+  for (const name of readdirSync(dir).sort()) {
+    const p = join(dir, name)
+    if (statSync(p).isDirectory()) out.push(...walk(p))
+    else out.push(p)
+  }
+  return out
+}
+
+const work = mkdtempSync(join(tmpdir(), 'srt-java-agent-'))
+try {
+  const classes = join(work, 'classes')
+  const sources = walk(SRC).filter(f => f.endsWith('.java'))
+  // --release 8: the agent runs inside whatever JVM the sandboxed tool
+  // brings, and Java 8 is still common in build tooling.
+  run([
+    javac,
+    '--release',
+    '8',
+    '-Xlint:all,-options',
+    '-Werror',
+    '-g:none',
+    '-d',
+    classes,
+    ...sources,
+  ])
+
+  const manifest = join(work, 'MANIFEST.MF')
+  writeFileSync(
+    manifest,
+    `Premain-Class: ${AGENT_CLASS}\nAgent-Class: ${AGENT_CLASS}\n`,
+  )
+  // -0: STORED (no compression). --date: fixed entry timestamps. Entries
+  // are added in a fixed order (walk() sorts) so the bytes are reproducible.
+  const entries = walk(classes).map(f => f.slice(classes.length + 1))
+  run([
+    jar,
+    '--create',
+    '--file',
+    OUT,
+    '--manifest',
+    manifest,
+    '--no-compress',
+    '--date',
+    '1980-01-01T00:00:02Z',
+    // -C applies to the single following file, so repeat it per entry.
+    ...entries.flatMap(e => ['-C', classes, e]),
+  ])
+  console.log(`built ${OUT} (${statSync(OUT).size} bytes)`)
+} finally {
+  rmSync(work, { recursive: true, force: true })
+}

package/dist/containment-runtime/vendor/seccomp/build.ts

@@ -0,0 +1,69 @@
+import { readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { run, setup } from '../build-common.js'
+
+const { SRC, OUT } = setup({
+  importMetaUrl: import.meta.url,
+  requirePlatform: 'linux',
+  srcDirName: 'seccomp-src',
+})
+
+function toCArray(bytes: Buffer): string {
+  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
+  const lines: string[] = []
+  for (let i = 0; i < hex.length; i += 8) {
+    lines.push('    ' + hex.slice(i, i + 8).join(', ') + ',')
+  }
+  return lines.join('\n')
+}
+
+const cflags = ['-static', '-O2', '-Wall', '-Wextra']
+
+const gen = join(OUT, 'seccomp-unix-block')
+run([
+  'gcc',
+  ...cflags,
+  '-o',
+  gen,
+  join(SRC, 'seccomp-unix-block.c'),
+  '-lseccomp',
+])
+
+const bpf: Record<string, Buffer> = {}
+for (const target of ['x86_64', 'aarch64']) {
+  const tmp = join(OUT, target + '.bpf')
+  run([gen, tmp, target])
+  bpf[target] = readFileSync(tmp)
+  rmSync(tmp)
+}
+rmSync(gen)
+
+const header = join(OUT, 'unix-block-bpf.h')
+writeFileSync(
+  header,
+  '#if defined(__x86_64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.x86_64) +
+    '\n};\n' +
+    '#elif defined(__aarch64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.aarch64) +
+    '\n};\n' +
+    '#else\n' +
+    '#error "unsupported architecture for unix-block BPF filter"\n' +
+    '#endif\n',
+)
+
+run([
+  'gcc',
+  ...cflags,
+  '-I',
+  OUT,
+  '-o',
+  join(OUT, 'apply-seccomp'),
+  join(SRC, 'apply-seccomp.c'),
+])
+run(['strip', join(OUT, 'apply-seccomp')])
+rmSync(header)
+
+console.log('built ' + join(OUT, 'apply-seccomp'))

package/dist/containment-runtime/vendor/srt-win/build.ts

@@ -0,0 +1,21 @@
+import { copyFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { run, setup } from '../build-common.js'
+
+const { SRC, OUT } = setup({
+  importMetaUrl: import.meta.url,
+  requirePlatform: 'win32',
+  srcDirName: 'srt-win-src',
+})
+
+run(['cargo', 'build', '--release', '--manifest-path', join(SRC, 'Cargo.toml')])
+
+const built = join(SRC, 'target', 'release', 'srt-win.exe')
+if (!existsSync(built)) {
+  console.error('srt-win build: expected output not found at ' + built)
+  process.exit(1)
+}
+
+const dest = join(OUT, 'srt-win.exe')
+copyFileSync(built, dest)
+console.log('built ' + dest)

package/dist/containmentLease.d.ts

@@ -0,0 +1,5 @@
+/** Windows uses a shared sandbox SID: never overlap FCD profile sessions. */
+export declare function acquireContainmentLease(): Promise<{
+    release: () => Promise<void>;
+    lost: Promise<void>;
+}>;

package/dist/containmentLease.js

@@ -0,0 +1,72 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acquireContainmentLease = acquireContainmentLease;
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+/** Windows uses a shared sandbox SID: never overlap FCD profile sessions. */
+async function acquireContainmentLease() {
+    if (process.platform !== 'win32')
+        return { release: async () => { }, lost: new Promise(() => { }) };
+    const script = "$m = $null; $held = $false; try { $m = [Threading.Mutex]::new($false, 'Global\\FullCourtDefenseContainedExecution'); try { $held = $m.WaitOne(0) } catch [Threading.AbandonedMutexException] { $held = $true }; if (-not $held) { exit 2 }; [Console]::Out.WriteLine('LOCKED'); [Console]::Out.Flush(); [Console]::In.ReadLine() | Out-Null } finally { if ($held) { $m.ReleaseMutex() }; if ($m) { $m.Dispose() } }";
+    const executable = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const child = (0, child_process_1.spawn)(executable, ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], { windowsHide: true, stdio: ['pipe', 'pipe', 'ignore'] });
+    let ended = false;
+    let signalLoss;
+    const lost = new Promise(resolve => { signalLoss = resolve; });
+    child.stdin.on('error', () => { child.kill(); });
+    child.once('close', () => { ended = true; signalLoss(); });
+    await new Promise((resolve, reject) => {
+        let text = '';
+        const timer = setTimeout(() => { child.kill(); reject(new Error('Could not obtain the Windows containment lock.')); }, 10000);
+        child.once('error', () => { clearTimeout(timer); reject(new Error('Windows containment lock is unavailable.')); });
+        child.once('close', () => { clearTimeout(timer); reject(new Error('Another protected session is running, or the Windows containment lock is unavailable.')); });
+        child.stdout.on('data', data => { text += data; if (text.includes('LOCKED\r\n') || text.includes('LOCKED\n')) {
+            clearTimeout(timer);
+            resolve();
+        } });
+    });
+    let releasing;
+    return { lost, release: () => {
+            if (!releasing)
+                releasing = (async () => {
+                    if (ended)
+                        return;
+                    child.stdin.end('\n');
+                    await lost;
+                })();
+            return releasing;
+        } };
+}

package/dist/detectionUpdates.d.ts

@@ -1,12 +1,31 @@
+import { verifyDetectionEnvelope } from './detectionData';
+export interface SignedUpdateAdapter<T extends {
+    revision: number;
+}> {
+    url: string;
+    maxBytes: number;
+    bundledRevision: number;
+    current(): Readonly<T>;
+    verify(raw: string, now: number, key: string): T;
+    activate(data: T): boolean;
+    eligible?(data: T): boolean;
+    /** Runs only for eligible, newer content, before it replaces the cache. */
+    prepare?(data: T): {
+        activate(): boolean;
+        dispose(): void;
+    };
+}
 export declare const DETECTION_UPDATE_URL = "https://storage.googleapis.com/fullcourtdefense-cli-releases/detection/stable.json";
 export interface DetectionUpdateStatus {
     revision: number;
     bundledRevision: number;
     source: 'bundled' | 'update';
     lastCheckedAt?: string;
-    state: 'bundled' | 'current' | 'unavailable' | 'rejected';
+    state: 'bundled' | 'current' | 'unavailable' | 'rejected' | 'not_targeted';
 }
-export declare class DetectionUpdates {
+export declare class DetectionUpdates<T extends {
+    revision: number;
+} = ReturnType<typeof verifyDetectionEnvelope>> {
     private readonly cachePath;
     private readonly publicKey;
     private readonly channel;
@@ -14,7 +33,8 @@ export declare class DetectionUpdates {
     private nextLocalRead;
     private pending?;
     private status;
-    constructor(cachePath: string, publicKey?: string, channel?: 'stable' | 'staging');
+    private readonly adapter;
+    constructor(cachePath: string, publicKey?: string, channel?: 'stable' | 'staging', adapter?: SignedUpdateAdapter<T>);
     getStatus(): DetectionUpdateStatus;
     private readCache;
     private cachedData;

package/dist/detectionUpdates.js

@@ -49,18 +49,23 @@ class DetectionUpdates {
     pending;
     status = { revision: detectionData_1.BUNDLED_DETECTION_DATA.revision,
         bundledRevision: detectionData_1.BUNDLED_DETECTION_DATA.revision, source: 'bundled', state: 'bundled' };
-    constructor(cachePath, publicKey = detectionData_1.DETECTION_PUBLIC_KEY, channel = 'stable') {
+    adapter;
+    constructor(cachePath, publicKey = detectionData_1.DETECTION_PUBLIC_KEY, channel = 'stable', adapter) {
         this.cachePath = cachePath;
         this.publicKey = publicKey;
         this.channel = channel;
+        this.adapter = adapter || { url: exports.DETECTION_UPDATE_URL, maxBytes: detectionData_1.MAX_DETECTION_BYTES,
+            bundledRevision: detectionData_1.BUNDLED_DETECTION_DATA.revision, current: detectionData_1.getDetectionData,
+            verify: detectionData_1.verifyDetectionEnvelope, activate: detectionData_1.activateDetectionData };
+        this.status.revision = this.status.bundledRevision = this.adapter.bundledRevision;
     }
     getStatus() {
-        const revision = (0, detectionData_1.getDetectionData)().revision;
-        return { ...this.status, revision, source: revision > detectionData_1.BUNDLED_DETECTION_DATA.revision ? 'update' : 'bundled' };
+        const revision = this.adapter.current().revision;
+        return { ...this.status, revision, source: revision > this.adapter.bundledRevision ? 'update' : 'bundled' };
     }
     readCache() {
         try {
-            if (fs.statSync(this.cachePath).size > detectionData_1.MAX_DETECTION_BYTES)
+            if (fs.statSync(this.cachePath).size > this.adapter.maxBytes)
                 return undefined;
             return fs.readFileSync(this.cachePath, 'utf8');
         }
@@ -72,7 +77,7 @@ class DetectionUpdates {
         // Expiration gates first acceptance, not continued offline use. Authenticate
         // the signed validity period before using the last verified cache after restart.
         const payload = JSON.parse(JSON.parse(raw).payload);
-        return (0, detectionData_1.verifyDetectionEnvelope)(raw, Math.min(Date.now(), payload.issuedAt), this.publicKey);
+        return this.adapter.verify(raw, Math.min(Date.now(), payload.issuedAt), this.publicKey);
     }
     loadLocal() {
         if (Date.now() < this.nextLocalRead)
@@ -82,7 +87,24 @@ class DetectionUpdates {
         if (!raw)
             return;
         try {
-            (0, detectionData_1.activateDetectionData)(this.cachedData(raw));
+            const data = this.cachedData(raw);
+            if (this.adapter.eligible && !this.adapter.eligible(data)) {
+                this.status.state = 'not_targeted';
+                return;
+            }
+            if (data.revision === this.adapter.current().revision && JSON.stringify(data) !== JSON.stringify(this.adapter.current()))
+                throw new Error('Cached revision reused for different content');
+            if (data.revision > this.adapter.current().revision) {
+                const prepared = this.adapter.prepare?.(data);
+                try {
+                    prepared ? prepared.activate() : this.adapter.activate(data);
+                }
+                finally {
+                    prepared?.dispose();
+                }
+            }
+            if (data.revision === this.adapter.current().revision)
+                this.status.state = 'current';
         }
         catch {
             this.status.state = 'rejected';
@@ -102,7 +124,7 @@ class DetectionUpdates {
         this.status.lastCheckedAt = new Date().toISOString();
         let raw;
         try {
-            const response = await fetch(this.channel === 'staging' ? exports.DETECTION_UPDATE_URL.replace('/stable.json', '/staging.json') : exports.DETECTION_UPDATE_URL, { redirect: 'error', signal: AbortSignal.timeout(3000) });
+            const response = await fetch(this.channel === 'staging' ? this.adapter.url.replace('/stable.json', '/staging.json') : this.adapter.url, { redirect: 'error', signal: AbortSignal.timeout(3000) });
             if (!response.ok || !response.body)
                 throw new Error('Unavailable');
             const reader = response.body.getReader();
@@ -114,7 +136,7 @@ class DetectionUpdates {
                     if (done)
                         break;
                     size += value.byteLength;
-                    if (size > detectionData_1.MAX_DETECTION_BYTES)
+                    if (size > this.adapter.maxBytes)
                         throw new Error('Oversized');
                     chunks.push(value);
                 }
@@ -131,8 +153,13 @@ class DetectionUpdates {
         }
         let lock;
         let temporary;
+        let prepared;
         try {
-            const data = (0, detectionData_1.verifyDetectionEnvelope)(raw, Date.now(), this.publicKey);
+            const data = this.adapter.verify(raw, Date.now(), this.publicKey);
+            if (this.adapter.eligible && !this.adapter.eligible(data)) {
+                this.status.state = 'not_targeted';
+                return;
+            }
             fs.mkdirSync(path.dirname(this.cachePath), { recursive: true });
             const lockPath = this.cachePath + '.lock';
             try {
@@ -160,14 +187,15 @@ class DetectionUpdates {
             }
             catch { /* recover corrupt cache */ }
             const cachedRevision = cached?.revision ?? 0;
-            const currentRevision = Math.max(cachedRevision, (0, detectionData_1.getDetectionData)().revision);
+            const currentRevision = Math.max(cachedRevision, this.adapter.current().revision);
             if (data.revision < currentRevision)
                 throw new Error('Revision downgrade');
             if (cached && data.revision === cached.revision && JSON.stringify(data) !== JSON.stringify(cached))
                 throw new Error('Cached revision reused for different content');
-            if (data.revision === (0, detectionData_1.getDetectionData)().revision && JSON.stringify(data) !== JSON.stringify((0, detectionData_1.getDetectionData)()))
+            if (data.revision === this.adapter.current().revision && JSON.stringify(data) !== JSON.stringify(this.adapter.current()))
                 throw new Error('Revision reused for different content');
             if (data.revision > currentRevision) {
+                prepared = this.adapter.prepare?.(data);
                 temporary = this.cachePath + '.' + (0, crypto_1.randomUUID)() + '.tmp';
                 const fd = fs.openSync(temporary, 'wx', 0o600);
                 try {
@@ -179,10 +207,12 @@ class DetectionUpdates {
                 }
                 fs.renameSync(temporary, this.cachePath);
                 temporary = undefined;
-                (0, detectionData_1.activateDetectionData)(data);
+                prepared ? prepared.activate() : this.adapter.activate(data);
+            }
+            else if (cached && cached.revision > this.adapter.current().revision) {
+                prepared = this.adapter.prepare?.(cached);
+                prepared ? prepared.activate() : this.adapter.activate(cached);
             }
-            else if (cached)
-                (0, detectionData_1.activateDetectionData)(cached);
             this.status.state = 'current';
         }
         catch {
@@ -190,6 +220,7 @@ class DetectionUpdates {
             this.nextCheck = Date.now() + 5 * 60_000;
         }
         finally {
+            prepared?.dispose();
             if (temporary) {
                 try {
                     fs.unlinkSync(temporary);

package/dist/detectorArtifact.d.ts

@@ -0,0 +1,17 @@
+export declare const DETECTOR_ABI = 1;
+export declare const MAX_DETECTOR_BYTES: number;
+export declare const DETECTOR_DOMAIN = "fullcourtdefense/reviewed-detector/v1\n";
+export interface DetectorArtifact {
+    abi: 1;
+    revision: number;
+    issuedAt: number;
+    expiresAt: number;
+    sourceCommit: string;
+    issueNumber: number;
+    sha256: string;
+    code: string;
+    /** null = approved fleet-wide rollout; otherwise explicit enrolled machine IDs. */
+    machineIds: string[] | null;
+}
+/** Official reviewed code, not user-supplied rules or tool content. */
+export declare function verifyDetectorArtifact(raw: string, now?: number, publicKey?: string): DetectorArtifact;

package/dist/detectorArtifact.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DETECTOR_DOMAIN = exports.MAX_DETECTOR_BYTES = exports.DETECTOR_ABI = void 0;
+exports.verifyDetectorArtifact = verifyDetectorArtifact;
+const crypto_1 = require("crypto");
+const detectionData_1 = require("./detectionData");
+exports.DETECTOR_ABI = 1;
+exports.MAX_DETECTOR_BYTES = 2 * 1024 * 1024;
+exports.DETECTOR_DOMAIN = 'fullcourtdefense/reviewed-detector/v1\n';
+/** Official reviewed code, not user-supplied rules or tool content. */
+function verifyDetectorArtifact(raw, now = Date.now(), publicKey = detectionData_1.DETECTION_PUBLIC_KEY) {
+    if (Buffer.byteLength(raw) > exports.MAX_DETECTOR_BYTES)
+        throw new Error('Detector artifact oversized');
+    const envelope = JSON.parse(raw);
+    if (!envelope || Object.keys(envelope).sort().join(',') !== 'payload,signature' || typeof envelope.payload !== 'string'
+        || typeof envelope.signature !== 'string' || !/^[A-Za-z0-9+/]{86}==$/.test(envelope.signature))
+        throw new Error('Invalid detector envelope');
+    if (!(0, crypto_1.verify)(null, Buffer.from(exports.DETECTOR_DOMAIN + envelope.payload), (0, crypto_1.createPublicKey)(publicKey), Buffer.from(envelope.signature, 'base64')))
+        throw new Error('Invalid detector signature');
+    const data = JSON.parse(envelope.payload);
+    if (!data || Object.keys(data).sort().join(',') !== 'abi,code,expiresAt,issueNumber,issuedAt,machineIds,revision,sha256,sourceCommit'
+        || data.abi !== exports.DETECTOR_ABI || !Number.isSafeInteger(data.revision) || data.revision < 1
+        || !Number.isSafeInteger(data.issueNumber) || data.issueNumber < 1
+        || typeof data.sourceCommit !== 'string' || !/^[a-f0-9]{40}$/.test(data.sourceCommit) || typeof data.code !== 'string' || !data.code
+        || typeof data.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(data.sha256)
+        || (0, crypto_1.createHash)('sha256').update(data.code).digest('hex') !== data.sha256
+        || !Number.isSafeInteger(data.issuedAt) || !Number.isSafeInteger(data.expiresAt)
+        || data.issuedAt > now + 60_000 || data.expiresAt <= now || data.expiresAt <= data.issuedAt
+        || data.expiresAt - data.issuedAt > 90 * 86400_000)
+        throw new Error('Invalid detector artifact or compatibility');
+    if (data.machineIds !== null && (!Array.isArray(data.machineIds) || data.machineIds.length < 1 || data.machineIds.length > 64
+        || data.machineIds.some(id => typeof id !== 'string' || !/^[a-zA-Z0-9_.:-]{1,64}$/.test(id)) || new Set(data.machineIds).size !== data.machineIds.length))
+        throw new Error('Invalid detector rollout cohort');
+    return data;
+}