fullcourtdefense-cli 1.34.26 → 1.35.0

package/dist/actionPolicyEngine.js

@@ -7153,7 +7153,7 @@ function extractUrl(args, _argsText) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
-    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).join("\n") : raw;
+    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).map(withoutGhMetadataProse).join("\n") : raw;
     const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
@@ -7322,7 +7322,7 @@ function segmentMayReachNetwork(segment) {
     return !LOCAL_DATA_LEADS.has(lead);
   });
 }
-var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*')\s*$/;
+var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|-?\d+(?:\.\d+)?|@\((?:[\s,]|'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|-?\d+(?:\.\d+)?)*\))\s*$/;
 function segmentsThatMayReachNetwork(segments) {
   const tempRedefined = segments.some((segment) => /\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(segment)));
   const remotePath = /(?:^|[\s"'=(])[\\/]{2}[^\s\\/"']+[\\/]/;
@@ -7347,21 +7347,36 @@ function temporaryFileSyntax(text) {
 }
 var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
 function ghMetadataWriteBodyFile(segment) {
-  const ghBody = /^gh\s+(pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+(.+?)(?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?$/i.exec(segment);
+  return parseGhMetadataWrite(segment)?.bodyFile;
+}
+function parseGhMetadataWrite(segment) {
+  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)(.+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
   if (!ghBody) return void 0;
   const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
   if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
   let bodyFile;
+  let bodySeen = false;
+  const kept = [];
   for (let i2 = 0; i2 < tokens.length; i2 += 2) {
     const flag = tokens[i2];
     const value = tokens[i2 + 1];
-    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
     if (/^--body-file$/i.test(flag)) {
-      if (bodyFile !== void 0) return void 0;
+      if (bodySeen) return void 0;
+      bodySeen = true;
       bodyFile = value;
     }
+    if (/^--body$/i.test(flag)) {
+      if (bodySeen) return void 0;
+      bodySeen = true;
+    }
+    const prose = /^--(?:body|title)$/i.test(flag);
+    kept.push(flag, prose ? '"fcd-gh-metadata"' : value);
   }
-  return bodyFile;
+  return { bodyFile, masked: `${ghBody[1]}${kept.join(" ")}${ghBody[3]}` };
+}
+function withoutGhMetadataProse(segment) {
+  return parseGhMetadataWrite(segment)?.masked ?? segment;
 }
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
@@ -7507,6 +7522,22 @@ function splitShellSegments(command, alsoOnPipe = false) {
         continue;
       }
     }
+    if (ch === "@" && command[i2 + 1] === "{") {
+      const end = hashtableEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
+    if (ch === "@" && command[i2 + 1] === "(") {
+      const end = literalArrayEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
     if (ch === '"' || ch === "'") {
       quote = ch;
       cur += ch;
@@ -7547,6 +7578,47 @@ ${q}@`;
   if (idx < 0) return -1;
   return idx + close.length;
 }
+function hashtableEnd(command, start) {
+  let depth = 0;
+  let quote = null;
+  for (let i2 = start + 1; i2 < command.length; i2++) {
+    const ch = command[i2];
+    if (quote) {
+      if (ch === "\\" && quote === '"' && i2 + 1 < command.length) {
+        i2++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}" && --depth === 0) return i2 + 1;
+  }
+  return -1;
+}
+var LITERAL_ELEMENT_RE = /^(?:'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|-?\d+(?:\.\d+)?)/;
+function literalArrayEnd(command, start) {
+  let i2 = start + 2;
+  let elements = 0;
+  while (i2 < command.length) {
+    const rest = command.slice(i2);
+    const skip = /^[\s,]+/.exec(rest);
+    if (skip) {
+      i2 += skip[0].length;
+      continue;
+    }
+    if (command[i2] === ")") return elements > 0 ? i2 + 1 : -1;
+    const element = LITERAL_ELEMENT_RE.exec(rest);
+    if (!element || elements >= 256) return -1;
+    i2 += element[0].length;
+    elements++;
+  }
+  return -1;
+}
 var QUOTED_LITERAL_RE = /@'[\s\S]*?\r?\n'@|@"[\s\S]*?\r?\n"@|"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
 function quotedSpans(segment) {
   const spans = [];
@@ -7729,6 +7801,16 @@ function shellSegmentLead(segment) {
 }
 var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
 var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
+function isInertValueExpression(raw) {
+  const masked = maskQuotedSpans(raw);
+  if (/\$\(|`|&\s*[$(\w"']|[|<>]/.test(masked) || PS_VALUE_EXECUTOR_RE.test(masked)) return false;
+  if (/(?:::|\.)\s*(?:invoke|start|run|exec|create|load|download|upload|send|open)\w*\s*\(/i.test(masked)) return false;
+  for (const group of masked.matchAll(/\(\s*([A-Za-z][\w-]*)/g)) if (!LOCAL_DATA_LEADS.has(group[1].toLowerCase())) return false;
+  const body = masked.replace(/^\s*\$[\w]+\s*(?:\+|-|\*|\/)?=\s*/, "").trim();
+  if (/^\$\w+\s*(?:\+\+|--)$/.test(body)) return true;
+  if (/^(?:@\{|@\()/.test(body)) return !/[$(]/.test(body.slice(2)) && /^@[{(](?:[\s;,=]|""|-?\d+(?:\.\d+)?|[\w-]+|@\{|\}|\))*$/.test(body);
+  return /^(?:""|-?\d)/.test(body);
+}
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
 function classifyShellSegment(segment, depth = 0) {
   const raw = segment.trim();
@@ -7737,6 +7819,7 @@ function classifyShellSegment(segment, depth = 0) {
   const lead = shellSegmentLead(segment);
   if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
   if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
+  if (isInertValueExpression(raw)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
   if (sqlClient) {
@@ -7768,6 +7851,8 @@ function classifyShellWords(masked, raw, lead) {
     const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
     const hasBody = /\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file|--json|-body|-infile)\b/i.test(segment);
     if (explicitMethod || hasBody) return "write";
+    const credentialArgument = /\s(?:-h|--header|-headers|-u|--user|-token|-credential|-authentication|--oauth2-bearer|-proxycredential)(?:[\s=]|$)/i.exec(segment);
+    if (credentialArgument && /\$\(|`|\$env:|\(\s*[A-Za-z][\w-]*\s/.test(segment.slice(credentialArgument.index))) return "write";
     return pipesIntoInterpreter ? "SHELL" : "read";
   }
   if (SHELL_READ_PROGRAMS.has(lead)) {
@@ -7924,7 +8009,7 @@ function isPowerShellResponseProjection(segment, responses) {
   const object = /^\[pscustomobject\]\s*@\{([^{}]+)\}\s*(?:\|\s*(.+))?$/i.exec(segment);
   if (!object) return false;
   if (object[2] && object[2].split("|").some((part) => !isPowerShellReadFormatter(part.trim()))) return false;
-  const fields = object[1].trim().replace(/;\s*$/, "").split(";");
+  const fields = object[1].trim().replace(/[;\s]*$/, "").split(/;|\r?\n/).filter((field) => field.trim());
   if (fields.length > 32) return false;
   const labels = /* @__PURE__ */ new Set();
   return fields.every((field) => {

package/dist/approvalPrompt.d.ts

@@ -6,4 +6,6 @@ export interface ApprovalMessageOptions {
     /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
     alwaysLimitsLabel?: string;
 }
+/** Window title: the kind of action and the policy that stopped it, by name. */
+export declare function nativeApprovalTitle(reason: string): string;
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeApprovalTitle = nativeApprovalTitle;
 exports.nativeApprovalMessage = nativeApprovalMessage;
 /** Compact OS prompt. The complete decision remains in the IDE response and audit. */
 function line(value, limit) {
@@ -10,7 +11,19 @@ function line(value, limit) {
     const head = Math.ceil((limit - 3) * 0.6);
     return `${text.slice(0, head)} … ${text.slice(-(limit - head - 3))}`;
 }
-function nativeApprovalMessage(reason, options = {}) {
+const CEILING_NOTE_RE = /\s*This policy is set to Block[.;]\s*(?:Because it is not marked "Hard block", your workstation requires your approval before continuing\.|on a developer workstation it asks you instead\.)?\s*(?:An admin can (?:review the matching rule and its scope in the console|mark it "Hard block" in the console to stop this without asking)\.)?/;
+const CEILING_NOTE_SHORT = 'set to Block; on your workstation it asks you first.';
+/** Parse the `Rule:` line the block explanation writes into the name the console lists and its scope. */
+function ruleParts(rule) {
+    const policy = /^Action Policy "(.+?)" \((.+?)\)(?: — rule: (.+))?$/.exec(rule);
+    if (policy)
+        return { policy: policy[1], scope: [policy[2].replace(/^[^\w]+/, ''), policy[3]].filter(Boolean).join(' · ') };
+    const local = /^(built-in Local Safety rule|org custom rule) "(.+?)"(?: in Local Safety)?(?: \((.+)\))?$/.exec(rule);
+    if (local)
+        return { policy: local[2], localSafety: true, scope: [local[1] === 'org custom rule' ? 'Local Safety — org custom rule' : 'Local Safety — built-in rule', local[3]].filter(Boolean).join(' · ') };
+    return { policy: rule };
+}
+function promptFacts(reason) {
     const rows = reason.split(/\r?\n/).map(row => row.trim()).filter(Boolean);
     const field = (name) => rows.find(row => row.startsWith(`${name}:`))?.slice(name.length + 1).trim();
     const what = field('What');
@@ -20,20 +33,54 @@ function nativeApprovalMessage(reason, options = {}) {
     const why = field('Why');
     const agent = field('Agent')
         || (/^[a-z_ -]+:\s*\S+/i.test(rows[0] || '') && !/^(What|Rule|Why|Tool|Evidence|IDE|Developer):/.test(rows[0]) ? rows[0] : undefined);
-    const details = what || tool || rule || why ? [
-        agent ? `Agent: ${line(agent, 80)}` : '',
-        field('IDE') ? `IDE: ${line(field('IDE'), 40)}` : '',
-        what ? `Action: ${line(what, 230)}` : '',
-        tool ? `Tool: ${line([tool, evidence].filter(Boolean).join(' · '), 230)}` : '',
-        rule ? `Rule: ${line(rule, 200)}` : '',
-        why ? `Reason: ${line(why, 320)}` : '',
-    ].filter(Boolean) : [line(reason, 650)];
+    if (!(what || tool || rule || why))
+        return { fallback: reason };
+    const facts = { agent, ide: field('IDE') };
+    if (rule)
+        Object.assign(facts, ruleParts(rule));
+    if (what) {
+        // summarizeAction ends with the kind in parentheses: "… (shell command)".
+        const kind = /^(.*)\s\(([a-z][a-z /-]{2,30})\)$/i.exec(what);
+        facts.kind = kind?.[2];
+        facts.action = kind ? kind[1] : what;
+    }
+    if (tool)
+        facts.tool = [tool, evidence].filter(Boolean).join(' · ');
+    if (why) {
+        const stripped = why.replace(CEILING_NOTE_RE, ' ').replace(/\s+/g, ' ').trim();
+        if (stripped !== why.trim())
+            facts.note = CEILING_NOTE_SHORT;
+        facts.because = stripped.replace(/([^.])$/, '$1.');
+    }
+    return facts;
+}
+/** Window title: the kind of action and the policy that stopped it, by name. */
+function nativeApprovalTitle(reason) {
+    const f = promptFacts(reason);
+    const parts = ['FullCourtDefense', f.kind ? `Approval needed: ${f.kind}` : 'Approval needed', f.policy ? line(f.policy, 60) : ''].filter(Boolean);
+    return parts.join(' · ');
+}
+function nativeApprovalMessage(reason, options = {}) {
+    const f = promptFacts(reason);
+    const details = f.fallback ? [line(f.fallback, 650)] : [
+        f.policy ? `Policy:  ${line(f.policy, 160)}` : '',
+        f.scope ? `         ${line(f.scope, 200)}` : '',
+        f.action ? `Action:  ${f.kind ? `${f.kind} — ` : ''}${line(f.action, 230)}` : '',
+        f.agent ? `Agent: ${line(f.agent, 80)}` : '',
+        f.ide ? `IDE: ${line(f.ide, 40)}` : '',
+        f.tool ? `Tool: ${line(f.tool, 230)}` : '',
+        f.because ? `Because: ${line(f.because, 300)}` : '',
+        f.note ? `Note:    ${f.note}` : '',
+    ].filter(Boolean);
+    const where = f.policy && !f.fallback
+        ? `Console → Action Policies → ${f.localSafety ? 'Source: Local Safety → ' : ''}"${line(f.policy, 80)}" · this decision: your machine’s Activity.`
+        : 'Full details: the IDE message or this machine’s Activity in FullCourtDefense.';
     if (!options.allowAlways) {
         return [
             'Allow this action once?',
             '', ...details, '',
-            'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
             'Allow once permits only this action. Deny or closing keeps it stopped.',
+            where,
         ].join('\n');
     }
     return [
@@ -41,6 +88,6 @@ function nativeApprovalMessage(reason, options = {}) {
         '', ...details, '',
         ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`, ''] : []),
         'Allow once permits only this action. Deny or closing keeps it stopped.',
-        'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
+        where,
     ].join('\n');
 }

package/dist/commands/ephemeralStack.d.ts

@@ -53,8 +53,44 @@ export interface EphemeralStackOptions {
     hooks?: string;
     /** 'false' => skip wrapping MCP client configs with the gateway. */
     gateway?: string;
+    /**
+     * HTTP egress gateway (API destinations). OFF unless asked for: 'true' or a
+     * port number starts `http-gateway` detached on 127.0.0.1 and the identity
+     * env gains HTTP_PROXY / HTTPS_PROXY / NO_PROXY. Absent / 'false' => nothing
+     * changes for the workload's network path.
+     */
+    httpGateway?: string;
+    /** Agent name the HTTP gateway attributes calls to (the workload name). */
+    agentName?: string;
     sendLog?: EphemeralLogSink;
 }
+export declare const DEFAULT_HTTP_GATEWAY_PORT = 18790;
+/** Resolve `--http-gateway <true|false|port>`; undefined = off. */
+export declare function resolveHttpGatewayPort(value: string | undefined): number | undefined;
+/**
+ * Identity-env additions that route the agent's HTTP libraries through the
+ * local gateway. NO_PROXY keeps loopback and the FullCourtDefense control plane
+ * direct (the gateway would bypass them anyway). Both casings: curl/Python read
+ * lower-case, many Java/Go tools upper-case.
+ */
+export declare function httpGatewayIdentityEnv(port: number, apiUrl: string, agentName: string | undefined, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function httpGatewayLogPath(): string;
+export declare function httpGatewayReadyPath(): string;
+/**
+ * Start `http-gateway` outside our process tree (plain node, no shells) and
+ * wait until it reports its port. The workload's entrypoint runs AFTER this
+ * command returns, so the proxy must already be listening when the agent starts.
+ */
+export declare function startDetachedHttpGateway(input: {
+    port: number;
+    agentName?: string;
+    apiUrl: string;
+    waitMs?: number;
+}): Promise<{
+    port: number;
+    pid?: number;
+    log: string;
+}>;
 /**
  * Install the runtime hook + MCP gateway for an enrolled ephemeral identity.
  * Each step is best-effort and reported: a missing MCP client on the image is

package/dist/commands/ephemeralStack.js

@@ -33,16 +33,22 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.silentLogSink = void 0;
+exports.DEFAULT_HTTP_GATEWAY_PORT = exports.silentLogSink = void 0;
 exports.ephemeralIdentityMarkerPath = ephemeralIdentityMarkerPath;
 exports.assertNotEnrolledLaptop = assertNotEnrolledLaptop;
 exports.writeEphemeralIdentityMarker = writeEphemeralIdentityMarker;
+exports.resolveHttpGatewayPort = resolveHttpGatewayPort;
+exports.httpGatewayIdentityEnv = httpGatewayIdentityEnv;
+exports.httpGatewayLogPath = httpGatewayLogPath;
+exports.httpGatewayReadyPath = httpGatewayReadyPath;
+exports.startDetachedHttpGateway = startDetachedHttpGateway;
 exports.installEphemeralProtectionStack = installEphemeralProtectionStack;
 exports.exportIdentityEnv = exportIdentityEnv;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
+const child_process_1 = require("child_process");
 const installClaudeHook_1 = require("./installClaudeHook");
 const mcpGateway_1 = require("./mcpGateway");
 /**
@@ -105,6 +111,102 @@ function writeEphemeralIdentityMarker(noun, machineId, markerPath = ephemeralIde
 /** No-op sink for callers without a live log stream (workloads today). */
 const silentLogSink = async () => { };
 exports.silentLogSink = silentLogSink;
+exports.DEFAULT_HTTP_GATEWAY_PORT = 18790;
+/** Resolve `--http-gateway <true|false|port>`; undefined = off. */
+function resolveHttpGatewayPort(value) {
+    const v = (value || '').trim().toLowerCase();
+    if (!v || v === 'false' || v === '0' || v === 'off' || v === 'no')
+        return undefined;
+    if (v === 'true' || v === 'on' || v === 'yes')
+        return exports.DEFAULT_HTTP_GATEWAY_PORT;
+    const port = Number(v);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error(`--http-gateway expects true, false or a port (1–65535), got "${value}"`);
+    return port;
+}
+/**
+ * Identity-env additions that route the agent's HTTP libraries through the
+ * local gateway. NO_PROXY keeps loopback and the FullCourtDefense control plane
+ * direct (the gateway would bypass them anyway). Both casings: curl/Python read
+ * lower-case, many Java/Go tools upper-case.
+ */
+function httpGatewayIdentityEnv(port, apiUrl, agentName, env = process.env) {
+    const proxy = `http://127.0.0.1:${port}`;
+    let apiHost = '';
+    try {
+        apiHost = new URL(apiUrl).hostname;
+    }
+    catch { /* ignore */ }
+    const noProxy = ['localhost', '127.0.0.1', '::1', apiHost].filter(Boolean).join(',');
+    const out = {
+        FCD_HTTP_GATEWAY: proxy,
+        HTTP_PROXY: proxy,
+        HTTPS_PROXY: proxy,
+        http_proxy: proxy,
+        https_proxy: proxy,
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+    };
+    if (agentName && !(env.FCD_AGENT_NAME || '').trim())
+        out.FCD_AGENT_NAME = agentName;
+    return out;
+}
+function httpGatewayLogPath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'http-gateway.log');
+}
+function httpGatewayReadyPath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'http-gateway.json');
+}
+/**
+ * Start `http-gateway` outside our process tree (plain node, no shells) and
+ * wait until it reports its port. The workload's entrypoint runs AFTER this
+ * command returns, so the proxy must already be listening when the agent starts.
+ */
+async function startDetachedHttpGateway(input) {
+    const readyFile = httpGatewayReadyPath();
+    const logFile = httpGatewayLogPath();
+    fs.mkdirSync(path.dirname(logFile), { recursive: true });
+    try {
+        fs.unlinkSync(readyFile);
+    }
+    catch { /* none */ }
+    const out = fs.openSync(logFile, 'a');
+    const cliEntry = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+    // Credentials are NOT passed on the command line (visible in `ps`): the
+    // gateway reads the shield saved by workload-protect from ~/.fullcourtdefense.yml.
+    const args = [cliEntry, 'http-gateway', '--port', String(input.port), '--ready-file', readyFile,
+        '--api-url', input.apiUrl,
+        ...(input.agentName ? ['--agent-name', input.agentName] : [])];
+    const child = (0, child_process_1.spawn)(process.execPath, args, {
+        detached: true,
+        stdio: ['ignore', out, out],
+        windowsHide: true,
+        // The gateway must never route through itself, whatever the agent's env says,
+        // and a long-lived process has no business holding the org enrollment key.
+        env: Object.fromEntries(Object.entries({ ...process.env, FCD_EPHEMERAL: '1' })
+            .filter(([key]) => !/^(https?_proxy|no_proxy|FCD_API_KEY)$/i.test(key))),
+    });
+    child.unref();
+    fs.closeSync(out);
+    const deadline = Date.now() + (input.waitMs ?? 10_000);
+    while (Date.now() < deadline) {
+        try {
+            const ready = JSON.parse(fs.readFileSync(readyFile, 'utf8'));
+            if (ready.port)
+                return { port: ready.port, pid: ready.pid, log: logFile };
+        }
+        catch { /* not yet */ }
+        if (child.exitCode !== null)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 200));
+    }
+    let tail = '';
+    try {
+        tail = fs.readFileSync(logFile, 'utf8').split('\n').filter(Boolean).slice(-3).join(' | ');
+    }
+    catch { /* ignore */ }
+    throw new Error(`http-gateway did not start on port ${input.port}${tail ? ` — ${tail}` : ''} (log: ${logFile})`);
+}
 /**
  * Install the runtime hook + MCP gateway for an enrolled ephemeral identity.
  * Each step is best-effort and reported: a missing MCP client on the image is
@@ -150,6 +252,29 @@ async function installEphemeralProtectionStack(options, config) {
             await sendLog([{ level: 'warn', message: `MCP gateway wrap skipped: ${reason}` }]);
         }
     }
+    // HTTP egress gateway (API destinations) — opt-in. Nothing about the
+    // workload's network path changes unless the caller asked for it.
+    const httpPort = resolveHttpGatewayPort(options.httpGateway);
+    if (httpPort !== undefined) {
+        console.log(`\n\x1b[1mStarting the HTTP egress gateway (API destinations) on 127.0.0.1:${httpPort}…\x1b[0m`);
+        try {
+            const started = await startDetachedHttpGateway({
+                port: httpPort,
+                agentName: options.agentName,
+                apiUrl: options.apiUrl,
+            });
+            console.log(`  \x1b[32m✓\x1b[0m http-gateway listening (pid ${started.pid ?? '?'}) · log: ${started.log}`);
+            console.log('  The identity env file now carries HTTP_PROXY / HTTPS_PROXY — source it before starting the agent.');
+            console.log('  HTTPS calls are gated by destination host; plain HTTP by host, method and endpoint shape.');
+            await sendLog([{ level: 'success', message: `HTTP egress gateway started on 127.0.0.1:${started.port}` }]);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            console.log(`  \x1b[31mHTTP egress gateway failed to start:\x1b[0m ${reason}`);
+            await sendLog([{ level: 'warn', message: `HTTP egress gateway failed to start: ${reason}` }]);
+            throw error;
+        }
+    }
 }
 /**
  * Make the ephemeral identity visible to everything that runs AFTER this

package/dist/commands/httpGateway.d.ts

@@ -0,0 +1,66 @@
+import { type HttpEgressRequest } from '../httpEgress';
+export type HttpEgressVerdict = 'allow' | 'block' | 'require_approval' | 'log';
+export interface HttpEgressDecision {
+    verdict: HttpEgressVerdict;
+    /** Human-readable reason shown to the agent in the blocked response. */
+    reason?: string;
+    policyId?: string;
+    policyName?: string;
+    matchedRule?: string;
+    /** Learning / monitor: the verdict that WOULD have applied, recorded but not enforced. */
+    wouldVerdict?: HttpEgressVerdict;
+    /** Set when the decision waited on an approval (id for the record). */
+    approvalId?: string;
+}
+/** Resolves an egress request to a final, enforceable verdict (approval waits happen inside). */
+export type HttpEgressDecider = (req: HttpEgressRequest) => Promise<HttpEgressDecision>;
+export interface HttpEgressRecord {
+    req: HttpEgressRequest;
+    decision: HttpEgressDecision;
+    enforced: 'forwarded' | 'blocked' | 'tunnelled' | 'error';
+    durationMs: number;
+    statusCode?: number;
+}
+export interface HttpGatewayOptions {
+    /** Listen port; 0 = ephemeral (reported back). */
+    port: number;
+    /** Bind address — loopback by default; a container sidecar may bind 0.0.0.0. */
+    bind?: string;
+    decide: HttpEgressDecider;
+    record: (record: HttpEgressRecord) => void;
+    /** Process identity for attribution; `allowHeader` lets `x-fcd-agent` override it (off by default). */
+    agent: {
+        configured?: string;
+        workloadName?: string;
+        allowHeader?: boolean;
+    };
+    /** Hosts the gateway forwards without asking (its own backend, loopback). Lower-case. */
+    bypassHosts?: ReadonlySet<string>;
+    /** Upstream connect timeout for tunnels / forwards. */
+    upstreamTimeoutMs?: number;
+    /**
+     * Where to actually connect for a destination (`--resolve host=addr:port`,
+     * like curl). Demos and tests point real-looking hosts at local fixtures;
+     * policy is still evaluated on the ORIGINAL host.
+     */
+    resolveUpstream?: (host: string, port: number) => {
+        host: string;
+        port: number;
+    };
+    log?: (line: string) => void;
+}
+export interface RunningHttpGateway {
+    port: number;
+    address: string;
+    close: () => Promise<void>;
+    /** Live counters for the health endpoint / tests. */
+    stats: {
+        requests: number;
+        blocked: number;
+        forwarded: number;
+        tunnelled: number;
+        errors: number;
+    };
+}
+export declare function blockedResponseBody(req: HttpEgressRequest, decision: HttpEgressDecision): string;
+export declare function startHttpGateway(options: HttpGatewayOptions): Promise<RunningHttpGateway>;