fullcourtdefense-cli 1.35.2 → 1.35.3

package/dist/commands/workloadProtect.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertWorkloadSubstrate = assertWorkloadSubstrate;
+exports.resolveEnrolledVia = resolveEnrolledVia;
 exports.detectWorkloadContext = detectWorkloadContext;
 exports.workloadProtectCommand = workloadProtectCommand;
 const fs = __importStar(require("fs"));
@@ -64,6 +65,16 @@ function assertWorkloadSubstrate(kind, rt, options = {}) {
         + 'workload-protect is for containers, pods and functions. On a laptop or long-lived VM run `fullcourtdefense onboard` instead, '
         + 'or pass --force true if this really is a disposable workload host.');
 }
+/** Connections the console has a section for; anything else is the generic snippet. */
+const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'snippet']);
+function resolveEnrolledVia(explicit, env, detected) {
+    for (const candidate of [explicit, env.FCD_ENROLLED_VIA, detected]) {
+        const clean = (candidate || '').trim().toLowerCase();
+        if (clean && ENROLLED_VIA_VALUES.has(clean))
+            return clean;
+    }
+    return undefined;
+}
 /** Cloud coding agents that run as unattended workloads (env markers they set). */
 const CLOUD_AGENT_MARKERS = [
     ['CURSOR_AGENT', 'cursor-cloud-agent'],
@@ -86,22 +97,32 @@ function detectWorkloadContext(env = process.env, fsProbe = fs) {
         }
     }
     if (env.AWS_LAMBDA_FUNCTION_NAME) {
-        return { kind: 'serverless', name: explicitName || env.AWS_LAMBDA_FUNCTION_NAME, environment: environment || env.AWS_LAMBDA_FUNCTION_VERSION, instanceId: env.AWS_LAMBDA_LOG_STREAM_NAME, image };
+        return { kind: 'serverless', name: explicitName || env.AWS_LAMBDA_FUNCTION_NAME, environment: environment || env.AWS_LAMBDA_FUNCTION_VERSION, instanceId: env.AWS_LAMBDA_LOG_STREAM_NAME, image, enrolledVia: 'aws' };
     }
     if (env.K_SERVICE) {
         // Cloud Run / Knative
-        return { kind: 'serverless', name: explicitName || env.K_SERVICE, environment, instanceId: env.K_REVISION, image };
+        return { kind: 'serverless', name: explicitName || env.K_SERVICE, environment, instanceId: env.K_REVISION, image, enrolledVia: 'gcp' };
     }
     if (env.FUNCTIONS_WORKER_RUNTIME && env.WEBSITE_SITE_NAME) {
         // Azure Functions
         return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image };
     }
+    if (env.ECS_CONTAINER_METADATA_URI_V4 || env.ECS_CONTAINER_METADATA_URI) {
+        // ECS / Fargate task: the service name comes from the task definition env.
+        return { kind: 'container', name: explicitName || env.SERVICE_NAME || env.APP_NAME, environment, instanceId: env.HOSTNAME, image, enrolledVia: 'aws' };
+    }
     if (env.KUBERNETES_SERVICE_HOST) {
         // Pod names are "<deployment>-<replicaset-hash>-<pod-hash>"; the stable
         // workload name comes from the Downward API when the chart exposes it.
         const podName = env.HOSTNAME || env.POD_NAME || undefined;
         const name = explicitName || env.WORKLOAD_NAME || env.APP_NAME || env.DEPLOYMENT_NAME || (podName ? podName.replace(/(-[a-z0-9]{8,10})?-[a-z0-9]{5}$/, '') : undefined);
-        return { kind: 'kubernetes', name, environment: environment || env.POD_NAMESPACE || env.NAMESPACE, instanceId: podName, image };
+        return { kind: 'kubernetes', name, environment: environment || env.POD_NAMESPACE || env.NAMESPACE, instanceId: podName, image, enrolledVia: 'kubernetes' };
+    }
+    if (env.DYNO) {
+        // Heroku dyno (buildpack or container stack). HEROKU_APP_NAME exists only
+        // with the runtime-dyno-metadata feature; the console snippet sets
+        // FCD_WORKLOAD_NAME so the row is named after the app either way.
+        return { kind: 'container', name: explicitName || env.HEROKU_APP_NAME, environment, instanceId: env.DYNO, image, enrolledVia: 'heroku' };
     }
     if (fsProbe.existsSync('/.dockerenv') || env.container || env.DOCKER_CONTAINER) {
         return { kind: 'container', name: explicitName || env.SERVICE_NAME || env.APP_NAME, environment, instanceId: env.HOSTNAME, image };
@@ -137,8 +158,9 @@ async function workloadProtectCommand(args, config) {
     // substrate, not to the `--kind` the caller claimed.
     const hostRuntime = (0, hostRuntime_1.getHostRuntime)();
     assertWorkloadSubstrate(kind, hostRuntime, { force: args.force === 'true' });
+    const enrolledVia = resolveEnrolledVia(args.enrolledVia, process.env, detected.enrolledVia);
     console.log('\x1b[1m\x1b[36mFullCourtDefense — workload runtime protection\x1b[0m');
-    console.log(`  Workload: ${kind}/${name}${environment ? `/${environment}` : ''}`);
+    console.log(`  Workload: ${kind}/${name}${environment ? `/${environment}` : ''}${enrolledVia ? ` · via ${enrolledVia}` : ''}`);
     if (instanceId)
         console.log(`  Instance: ${instanceId}`);
     console.log(`  Detected: ${(0, hostRuntime_1.describeHostRuntime)(hostRuntime)}`);
@@ -156,6 +178,7 @@ async function workloadProtectCommand(args, config) {
             // `npm run`, never when the binary runs from a container entrypoint.
             cliVersion: (0, cliVersion_1.cliVersion)(),
             hostRuntime,
+            enrolledVia,
         }),
     });
     const data = (await resp.json().catch(() => ({})));