fullcourtdefense-cli 1.35.10 → 1.36.2

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,5 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot' | 'agent_guard_tamper';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'remote_control' | 'honeypot' | 'agent_guard_tamper';
 /**
  * Per-rule enforcement action (org-configured, shipped in the Local Safety
  * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and
@@ -34,6 +34,8 @@ export interface DeterministicFinding {
      * findings — the seam 'mask' uses to redact tool responses. Never spooled.
      */
     matchedSecret?: string;
+    /** Catalog facts for remote_control findings (bridge id, mode, launcher) — no argument text. */
+    remoteControl?: RemoteControlFacts;
 }
 export interface LocalSafetyCustomBlock {
     id: string;
@@ -70,6 +72,12 @@ export interface LocalSafetyScanOptions {
      * attack fixtures (security tooling, guard regression tests).
      */
     trustedScriptPaths?: string[];
+    /**
+     * ProductCodes (`{GUID}`) of the installed FullCourtDefense MSI, recorded on
+     * this machine by the daemon from the uninstall registry key. The code changes
+     * with every build, so `msiexec /x {GUID}` is ours only when it is listed here.
+     */
+    fcdProductCodes?: string[];
 }
 /**
  * Built-ins that ship OFF until an org switches them on in the console. Shared
@@ -90,7 +98,7 @@ export declare const DEFAULT_DISABLED_BUILT_INS: ReadonlySet<string>;
 export interface SharedCommandRule {
     itemId: string;
     /** Catalog category id (local-safety-catalog.ts). */
-    categoryId: 'credential_commands';
+    categoryId: 'credential_commands' | 'remote_control';
     severity: 'critical' | 'high' | 'medium' | 'low';
     pattern: string;
     reason: string;
@@ -102,10 +110,68 @@ export interface SharedCommandRule {
  * useless against them because the secret never comes from a watched file
  * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
  * rarely-legitimate-for-agents forms are on by default; cloud token printers
- * that legitimate deploy tooling uses constantly are strict (off by default,
- * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
+ * that legitimate deploy tooling uses constantly are strict (warn by default,
+ * see DEFAULT_WARN_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+export declare const REMOTE_CONTROL_CATALOG_VERSION = "2026-09-26.1";
+export interface RemoteControlFacts {
+    /** Catalog entry id. */
+    bridge: string;
+    /** Catalog mode label: 'remote' | 'serve' | 'connect'. */
+    mode: string;
+    /** How it was started: 'npx', 'npm exec', 'pnpm dlx', …, or 'direct' for an installed binary. */
+    launcher: string;
+}
+export interface RemoteControlBridge {
+    id: string;
+    title: string;
+    kind: 'remote_control' | 'remote_connector';
+    /** Registry package names (npm / PyPI), as typed after a launcher. */
+    packages: string[];
+    /** Executable names when installed globally or run from node_modules/.bin. */
+    bins: string[];
+    mode: 'remote' | 'serve' | 'connect';
+    /** Regex source applied right after the package token (JS + .NET, IgnoreCase). */
+    modePattern: string;
+    /** Short label for the console and evidence. */
+    label: string;
+    /** Decision Card sentence — what starting it means, in plain words. */
+    card: string;
+}
+export declare const REMOTE_CONTROL_BRIDGES: readonly RemoteControlBridge[];
+/** The positional pattern for one catalog entry: program at a statement start, package, then its mode. */
+export declare function remoteControlBridgePattern(bridge: RemoteControlBridge): string;
+/** Shared command rules for the terminal guards: one per remote-control entry, same Local Safety item. */
+export declare const REMOTE_CONTROL_COMMAND_RULES: readonly SharedCommandRule[];
+export interface RemoteControlMatch {
+    bridge: RemoteControlBridge;
+    facts: RemoteControlFacts;
+}
+/** A shell line that starts a remote-control bridge (any statement, any de-obfuscated variant). */
+export declare function remoteControlBridgeInCommand(command: string): RemoteControlMatch | undefined;
+/**
+ * An MCP server launch (config `command` + `args`) that is a catalogued bridge:
+ * a remote-control bridge first, else a remote connector. Arguments with
+ * spaces are re-quoted so a `--stdio "npx server"` value stays one argument.
+ */
+export declare function classifyRemoteMcpLaunch(command: string | undefined, args?: readonly string[]): RemoteControlMatch | undefined;
+/** Wire-supplied facts constrained to the catalog vocabulary (backend ingest); anything else is dropped. */
+export declare function sanitizeRemoteControlFacts(raw: unknown): RemoteControlFacts | undefined;
+/** The engine fact provider: the catalog id of the remote-control bridge this line starts. */
+export declare function remoteControlFactFor(command: string): string | undefined;
+/** What an "Always allow" on a bridge is bound to: the package and its mode, never the launcher that ran it. */
+export declare function remoteControlGrantKey(bridge: RemoteControlBridge): string;
+/**
+ * Every distinct remote-control bridge a line starts (as grant keys), plus the
+ * line with each verbatim launch cut out — statement separators kept — so the
+ * caller can still read the OTHER programs on the line. A launch seen only in a
+ * de-obfuscated variant is not cut: the rest is over-counted, never under-counted.
+ */
+export declare function remoteControlLaunches(command: string): {
+    bridges: string[];
+    rest: string;
+};
 export type ShellAstMode = 'off' | 'shadow' | 'primary';
 /** Structural subset of shellAst.ts ShellFacts that the guard reads. */
 export interface ShellAstFactsLike {