fullcourtdefense-cli 1.34.7 → 1.34.8

package/dist/actionPolicyEngine.js

@@ -96,6 +96,15 @@ exports.CONTENT_FACT_FIELDS = new Set([
 ]);
 /** Tool / operation names that mean "a file on this machine": read_file, edit_file, write_file, create_file, append_to_file, str_replace, ... */
 const LOCAL_FILE_ACTION_RE = /(?:^|_)(?:read|write|edit|create|append|save|touch|patch|replace|insert|update)(?:_(?:to|in|into))?_?(?:file|text|lines?|contents?)s?(?:$|_)|^(?:read|write|edit)$|^str_replace$/i;
+/**
+ * Tool names that remove a FILE (delete_file, remove_file, unlink, rm_file, the
+ * IDE Delete mapped to delete_file). Deliberately narrow: `delete_directory`,
+ * `kubectl_delete`, `delete_object`, or any delete-verb tool that merely carries
+ * a `path` argument is NOT the `file` kind — those keep matching typed DELETE
+ * rules exactly as before, so an argument can never talk an action out of a
+ * destructive-scope rule.
+ */
+const FILE_REMOVAL_TOOL_RE = /(?:^|_)(?:delete|remove|rm|unlink)_?(?:file|path)s?(?:$|_)|^unlink$/i;
 /** Does this rule need a content fact to fire? (A rule with no content constraint is about the ACTION, not the content.) */
 function ruleNeedsContentFact(rule) {
     return (rule.constraints || []).some(c => exports.CONTENT_FACT_FIELDS.has(c.field));
@@ -1668,6 +1677,19 @@ function inferToolContext(toolName, args) {
     if (args.amount !== undefined || args.price !== undefined || args.total !== undefined) {
         context.amount = String(args.amount ?? args.price ?? args.total);
     }
+    // WHAT KIND of action this is — the fact a typed rule means. One verb spans
+    // four kinds: DELETE is `rm -rf /` (shell destructive scope), `DELETE FROM`
+    // (SQL), `DELETE /api/x` (HTTP) and `delete_file` (one file). Policies are not
+    // filtered by resourceType (an "ANY + containsSecret" rule filed under
+    // `database` must still catch a token leaving through Slack), so a rule that
+    // means only one kind — "Block destructive SHELL commands" — constrains on
+    // this fact. Without it, cleaning up one temp file in the IDE was paused as a
+    // destructive shell command. Derived from the branches above, never guessed.
+    context['action.kind'] = isCodeExecTool || toolNameLower === 'shell' ? 'shell'
+        : context.query !== undefined && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? 'database'
+            : ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'].includes(methodArg) ? 'http'
+                : context.path !== undefined && (operation === 'read' || operation === 'write' || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? 'file'
+                    : 'tool';
     return { operation, context };
 }
 function inferInventoryToolOperations(toolName, toolActions = []) {

package/dist/commands/hook.js

@@ -203,6 +203,17 @@ const BUILTIN_WRITE_TOOLS = new Set([
     'write', 'edit', 'multiedit', 'notebookedit', 'createfile', 'editfiles', 'writefile', 'fswrite', 'replace',
     'replacestringinfile', 'editfile', 'applypatch', 'strreplaceeditor', 'insertedittofile', 'strreplace', 'editnotebook',
 ]);
+/**
+ * Built-ins that remove ONE file (Cursor `Delete`, Copilot `deleteFile`, …).
+ * Left unmapped they fell through as an unknown MCP tool named "Delete" — no
+ * path fact, operation = the tool name — and were judged as if a destructive
+ * shell command / SQL DELETE had been issued ("Block destructive shell
+ * commands" paused the clean-up of one temp file). Mapped, they are a FILE
+ * action: `delete_file {path}` → operation `delete`, `action.kind = file`,
+ * which the machine role ("Deletes pause for approval") and filesystem
+ * policies govern, and which typed DELETE rules exclude.
+ */
+const BUILTIN_DELETE_TOOLS = new Set(['delete', 'deletefile', 'removefile', 'fsdelete', 'rmfile', 'unlink', 'deletefiles']);
 /**
  * Built-ins that never touch a file, a command, a server or the outside world —
  * nothing to enforce. Web fetch / web search are deliberately NOT here: they
@@ -249,6 +260,11 @@ function mapBuiltinToolPayload(toolName, input, payload) {
         const content = (0, fileWriteCanon_1.newContentOnly)(filePath || undefined, delta || whole);
         return { event: 'file', payload: { ...payload, file_path: filePath, content } };
     }
+    if (BUILTIN_DELETE_TOOLS.has(canon)) {
+        const filePath = str(input.file_path) || str(input.path) || str(input.filePath) || str(input.target_file) || str(input.absolute_path)
+            || (Array.isArray(input.files) ? input.files.map((f) => str(f)).filter(Boolean).join(', ') : '');
+        return { event: 'file', payload: { ...payload, file_path: filePath, fcd_file_op: 'delete' } };
+    }
     if (BUILTIN_PASSIVE_TOOLS.has(canon))
         return { event: 'ignore', payload };
     return null;
@@ -488,6 +504,14 @@ function buildToolCall(event, p) {
         }
         case 'file': {
             const filePath = str(p.file_path) || str(p.path);
+            // A built-in single-file removal (mapBuiltinToolPayload): no content to
+            // judge; the engine sees `delete_file {path}` → operation `delete`,
+            // `action.kind = file`.
+            if (str(p.fcd_file_op) === 'delete') {
+                if (!filePath)
+                    return null;
+                return { toolName: 'delete_file', toolArgs: { path: filePath } };
+            }
             const edits = p.edits;
             const rawContent = Array.isArray(edits)
                 ? edits.map((e) => str(e.new_text) || str(e.text) || str(e.content)).filter(Boolean).join('\n')

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.7"
+  "version": "1.34.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.7",
+  "version": "1.34.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {