fullcourtdefense-cli 1.35.2 → 1.35.5

package/dist/commands/deterministicGuard.js

@@ -35,10 +35,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.unquotedCode = unquotedCode;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
+exports.referencedScripts = referencedScripts;
 exports.resolveDeterministicOutcome = resolveDeterministicOutcome;
 exports.resolveDeterministicTextResponse = resolveDeterministicTextResponse;
 const fs = __importStar(require("fs"));
@@ -698,9 +700,14 @@ exports.CREDENTIAL_COMMAND_RULES = [
         pattern: String.raw `\bvault\s+(?:kv\s+get|read)\b` },
 ];
 const CREDENTIAL_COMMAND_REGEXES = exports.CREDENTIAL_COMMAND_RULES.map(rule => ({ rule, re: new RegExp(rule.pattern, 'i') }));
-function credentialCommandReason(value) {
+function credentialCommandReason(value, options) {
     return matchCommand(value, text => {
         for (const { rule, re } of CREDENTIAL_COMMAND_REGEXES) {
+            // Skip suppressed / org-disabled items so a second credential command on
+            // the same line is still found after resolveDeterministicOutcome hides
+            // the first ask (gh then gcloud, not "gh forever").
+            if (!isEnabled(rule.itemId, options))
+                continue;
             if (re.test(text))
                 return { itemId: rule.itemId, reason: rule.reason };
         }
@@ -724,6 +731,11 @@ function destructiveCommandReason(value) {
         // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
         if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+        // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
+        // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
+        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
+            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        }
         // Bare `*` deletes the current directory tree — destructive on the HOST,
         // but inside a container exec/run it is the container workdir (cleanup).
         const bareStar = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/.exec(lower);
@@ -746,6 +758,10 @@ function destructiveCommandReason(value) {
             && /remove-item\b[^;|&]{0,80}?["']?\b[a-z]:[\\/]?["']?(?=\s|$|[;&|])/i.test(text)) {
             return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
         }
+        if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force')
+            && /remove-item\b[^;|&]{0,80}?["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:[\\/]\*?)?["']?(?=\s|$|[;&|])/i.test(lower)) {
+            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        }
         if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
             return { itemId: 'fork_bomb', reason: 'fork bomb' };
         if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
@@ -875,8 +891,12 @@ function isWebLookupTarget(toolName, candidate) {
  * must not block — the unconditional match over-blocked ordinary development work.
  */
 function isMetadataRequestContext(toolName, candidate) {
-    if (isCommandContext(toolName, candidate))
+    if (isCommandContext(toolName, candidate)) {
+        // `rg "169.254.169.254" scripts/` searches for the address; it does not request it.
+        if (commandOnlySearchesMetadata(candidate.value))
+            return false;
         return true;
+    }
     if (isWebLookupTarget(toolName, candidate))
         return true;
     if (OUTBOUND_TOOL_HINT.test(toolName))
@@ -884,6 +904,76 @@ function isMetadataRequestContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return /(?:url|uri|endpoint|host|address|webhook)/i.test(lastKey);
 }
+const METADATA_SEARCH_PROGRAMS = new Set([
+    'rg', 'grep', 'egrep', 'fgrep', 'findstr', 'ack', 'ag', 'select-string', 'sls',
+]);
+/**
+ * Split on unquoted `;` / `&&` / `||` / `|` / newline so a pipe cannot hide a
+ * later client (`rg … | curl http://169.254…`) while `rg "a|b"` stays one segment.
+ */
+function splitUnquotedCommandSegments(command) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (quote) {
+            cur += c;
+            if (c === '\\' && i + 1 < command.length) {
+                cur += command[++i];
+                continue;
+            }
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        if (c === '\n' || c === ';') {
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        if (c === '&' && command[i + 1] === '&') {
+            out.push(cur);
+            cur = '';
+            i += 1;
+            continue;
+        }
+        if (c === '|') {
+            if (command[i + 1] === '|')
+                i += 1;
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        cur += c;
+    }
+    if (cur)
+        out.push(cur);
+    return out;
+}
+/** True when every segment that mentions a metadata endpoint is a searcher, not a client. */
+function commandOnlySearchesMetadata(command) {
+    if (!containsMetadataEndpoint(command))
+        return false;
+    const segments = splitUnquotedCommandSegments(command);
+    let saw = false;
+    for (const raw of segments) {
+        const seg = raw.trim();
+        if (!seg || !containsMetadataEndpoint(seg))
+            continue;
+        saw = true;
+        const token = (seg.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/) || [''])[0];
+        const program = token.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.exe$/, '');
+        if (!METADATA_SEARCH_PROGRAMS.has(program))
+            return false;
+    }
+    return saw;
+}
 /**
  * Sensitive credential PATHS only matter where the string is used AS a path (a file access,
  * a path-typed argument) or inside a command. File CONTENTS being written/edited routinely
@@ -978,8 +1068,36 @@ const INERT_DATA = ' fcd_inert_data ';
 // Code position immediately before a quoted span: interpreter code flags or a
 // remote/nested executor earlier in the same statement (no ; & | between).
 const CODE_CONTEXT_BEFORE = /(?:(?:^|[;&|(]|\s)(?:-c|\/c|-e|-command|-scriptblock|-filter)[= ]\s*|(?:^|[;&|(]\s*)(?:\S*[\\/])?(?:sudo\s+|doas\s+)?(?:ssh|wsl(?:\.exe)?|chroot|su|screen|tmux)(?:\s[^;&|"']*)?\s|(?:\S*[\\/])?(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b[^;&|"']*\s)$/i;
+/**
+ * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
+ * space. Detectors that ask "does this EXECUTE" must look here; the raw line
+ * still carries fixture strings and docs.
+ */
+function unquotedCode(text) {
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === "'" || c === '"' || c === '`') {
+            const q = c;
+            i += 1;
+            while (i < text.length) {
+                if (text[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                if (text[i] === q)
+                    break;
+                i += 1;
+            }
+            out += ' ';
+            continue;
+        }
+        out += c;
+    }
+    return out;
+}
 function stripInertDataSegments(text) {
-    if (DATA_TO_INTERPRETER.test(text))
+    if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
         return text;
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
@@ -1201,22 +1319,27 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     // stripInertDataSegments invariants). This is the generic FP guard for
     // "wrote ABOUT a dangerous command" vs "ran one".
     const value = stripInertDataSegments(rawValue);
+    // Script files: path/metadata facts are judged on RAW lines, then
+    // `scriptActsOnFinding` keeps only unquoted access (fetch/http.get/curl).
+    // Shell-prose strip would eat `execSync('curl -s http://169.254…')` and miss
+    // a real call. Command-shaped rules below still use the stripped view.
+    const actingView = toolName === 'script_file' ? rawValue : value;
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.
     const sensitivePath = containsSensitiveCredentialPath(commandContext
-        ? `${credentialAccessCommandText(value)}\n${interpreterFileArguments(rawValue)}` : value);
+        ? `${credentialAccessCommandText(actingView)}\n${interpreterFileArguments(rawValue)}` : actingView);
     if (sensitivePath) {
         const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', 
         // Verdict-neutral: the same finding is a warning on a monitor machine and
         // a block on an enforcing one — the console shows the verdict, not this text.
-        `Local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        `Local agent access to ${sensitivePath.label}.`, actingView, sensitivePath.label, options);
         if (finding)
             return finding;
     }
-    const metadata = containsMetadataEndpoint(value);
+    const metadata = containsMetadataEndpoint(actingView);
     if (metadata) {
-        const finding = builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, value, metadata.value, options);
+        const finding = builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, actingView, metadata.value, options);
         if (finding)
             return finding;
     }
@@ -1224,7 +1347,7 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     if (reverseShell) {
         return builtIn(reverseShell.itemId, 'reverse_shells', 'reverse_shell', 'local-reverse-shell', `Blocked ${reverseShell.reason}.`, value, reverseShell.reason, options);
     }
-    const credentialCmd = credentialCommandReason(value);
+    const credentialCmd = credentialCommandReason(value, options);
     if (credentialCmd) {
         const finding = builtIn(credentialCmd.itemId, 'credential_commands', 'credential_command', 'local-credential-command', `Blocked credential-revealing command: ${credentialCmd.reason}.`, value, credentialCmd.reason, options);
         if (finding)
@@ -1434,13 +1557,23 @@ function referencedScripts(command, cwd) {
 // Collision-hardened forms: `ssh` must be a command start (NOT the `.ssh` of the
 // flagged path itself), `type` the cmd.exe read form (`type file`, not `type:` in
 // JSON/TS fixtures), `open` a call (`open(`), `requests.*` a python HTTP call.
-const SCRIPT_ACCESS_VERB = /\b(?:cat|gc|get-content|get-item|copy(?:-item)?|cp|xcopy|robocopy|move(?:-item)?|mv|scp|sftp|rsync|curl|wget|invoke-webrequest|invoke-restmethod|iwr|irm|openssl|tar|zip|7z|certutil|base64|readfile(?:sync)?|createreadstream|read_text|read_bytes|fopen|urlopen|fetch|upload|download)\b|\btype\s+\S|(?:^|[^.\w])ssh(?:-add|-keygen|\.exe)?\s|\bopen\s*\(|\brequests\.\w+\s*\(/i;
+const SCRIPT_ACCESS_VERB = /\b(?:cat|gc|get-content|get-item|copy(?:-item)?|cp|xcopy|robocopy|move(?:-item)?|mv|scp|sftp|rsync|curl|wget|invoke-webrequest|invoke-restmethod|iwr|irm|openssl|tar|zip|7z|certutil|base64|readfile(?:sync)?|createreadstream|read_text|read_bytes|fopen|urlopen|fetch|upload|download|exec(?:sync|file(?:sync)?)?|spawn(?:sync)?)\b|\btype\s+\S|(?:^|[^.\w])ssh(?:-add|-keygen|\.exe)?\s|\bopen\s*\(|\brequests\.\w+\s*\(/i;
+/** `http.get(` / `require(…).get(` — the call is code; the URL may be a literal. */
+const SCRIPT_ACCESS_CALL = /\.\s*(?:get|request|post|put|patch|delete|fetch|exec(?:sync|file(?:sync)?)?|spawn(?:sync)?)\s*\(/i;
 /**
  * A path/metadata finding inside a referenced script only counts when some LINE both
- * contains the flagged pattern AND acts on it. Scripts (and their tests, and security
- * tooling) routinely mention credential paths as inert strings — "found inside
- * referenced script" used to block running our own guard test suite over fixtures.
+ * contains the flagged pattern AND acts on it in CODE. The entire matched span
+ * sitting inside one string literal (`'curl http://169.254…'`) is data — that
+ * was the live IDE false positive on `node scripts/test-execution-view.js`.
+ * `fetch('http://169.254…')` / `http.get('…')` still fire: the CALL is unquoted.
  */
+function lineActsOnFinding(line) {
+    const code = unquotedCode(line)
+        .replace(/\/\/[^\n]*/g, ' ')
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .replace(/(^|[^$\w])#[^\n]*/g, '$1 ');
+    return SCRIPT_ACCESS_VERB.test(code) || SCRIPT_ACCESS_CALL.test(code);
+}
 function scriptActsOnFinding(content, category) {
     const matcher = category === 'sensitive_file'
         ? (line) => Boolean(containsSensitiveCredentialPath(line))
@@ -1448,7 +1581,7 @@ function scriptActsOnFinding(content, category) {
     for (const rawLine of content.split(/\r?\n/)) {
         if (!rawLine || rawLine.length > 4000)
             continue;
-        if (matcher(rawLine) && SCRIPT_ACCESS_VERB.test(rawLine))
+        if (matcher(rawLine) && lineActsOnFinding(rawLine))
             return true;
     }
     return false;

package/dist/commands/shellGuard.js

@@ -198,7 +198,7 @@ const BUILTIN_RULES = [
     compileSpec({ id: 'rm_rf_root', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of filesystem root',
         command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [T_UNIX_ROOT] }),
     compileSpec({ id: 'rm_rf_home', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of the home directory',
-        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [String.raw `["']?(?:~|\$HOME)(?:/\S*)?["']?(?:\s|$|[;&|])`] }),
+        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [String.raw `["']?(?:~|\$HOME|\$\{HOME\}|%USERPROFILE%|\$env:USERPROFILE)(?:[\\/]\*?)?["']?(?:\s|$|[;&|])`] }),
     compileSpec({ id: 'windows_drive_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive delete',
         command: ['del', 'erase'], flags: [String.raw `/s\b`], target: [T_WIN_DRIVE] }),
     compileSpec({ id: 'windows_drive_rmdir', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive remove directory',

package/dist/commands/workloadProtect.d.ts

@@ -63,6 +63,13 @@ export interface WorkloadProtectArgs {
     httpGateway?: string;
     /** Agent name for API-destination attribution (default: the workload name). */
     agentName?: string;
+    /**
+     * The connection this workload was protected THROUGH — the console section
+     * it files under (heroku | kubernetes | aws | gcp). Set by the snippet the
+     * console generated (FCD_ENROLLED_VIA) or detected from the platform; never
+     * derived from the cloud the container happens to run on.
+     */
+    enrolledVia?: string;
 }
 export interface WorkloadContext {
     kind: string;
@@ -70,7 +77,10 @@ export interface WorkloadContext {
     environment?: string;
     instanceId?: string;
     image?: string;
+    /** Connection implied by the platform's own env (Heroku dyno, Cloud Run, Lambda, Kubernetes). */
+    enrolledVia?: string;
 }
+export declare function resolveEnrolledVia(explicit: string | undefined, env: NodeJS.ProcessEnv, detected: string | undefined): string | undefined;
 /**
  * Detect the workload from standard platform env vars. Explicit flags /
  * FCD_WORKLOAD_* always win; detection only fills the gaps.

package/dist/commands/workloadProtect.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertWorkloadSubstrate = assertWorkloadSubstrate;
+exports.resolveEnrolledVia = resolveEnrolledVia;
 exports.detectWorkloadContext = detectWorkloadContext;
 exports.workloadProtectCommand = workloadProtectCommand;
 const fs = __importStar(require("fs"));
@@ -64,6 +65,16 @@ function assertWorkloadSubstrate(kind, rt, options = {}) {
         + 'workload-protect is for containers, pods and functions. On a laptop or long-lived VM run `fullcourtdefense onboard` instead, '
         + 'or pass --force true if this really is a disposable workload host.');
 }
+/** Connections the console has a section for; anything else is the generic snippet. */
+const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'snippet']);
+function resolveEnrolledVia(explicit, env, detected) {
+    for (const candidate of [explicit, env.FCD_ENROLLED_VIA, detected]) {
+        const clean = (candidate || '').trim().toLowerCase();
+        if (clean && ENROLLED_VIA_VALUES.has(clean))
+            return clean;
+    }
+    return undefined;
+}
 /** Cloud coding agents that run as unattended workloads (env markers they set). */
 const CLOUD_AGENT_MARKERS = [
     ['CURSOR_AGENT', 'cursor-cloud-agent'],
@@ -86,22 +97,32 @@ function detectWorkloadContext(env = process.env, fsProbe = fs) {
         }
     }
     if (env.AWS_LAMBDA_FUNCTION_NAME) {
-        return { kind: 'serverless', name: explicitName || env.AWS_LAMBDA_FUNCTION_NAME, environment: environment || env.AWS_LAMBDA_FUNCTION_VERSION, instanceId: env.AWS_LAMBDA_LOG_STREAM_NAME, image };
+        return { kind: 'serverless', name: explicitName || env.AWS_LAMBDA_FUNCTION_NAME, environment: environment || env.AWS_LAMBDA_FUNCTION_VERSION, instanceId: env.AWS_LAMBDA_LOG_STREAM_NAME, image, enrolledVia: 'aws' };
     }
     if (env.K_SERVICE) {
         // Cloud Run / Knative
-        return { kind: 'serverless', name: explicitName || env.K_SERVICE, environment, instanceId: env.K_REVISION, image };
+        return { kind: 'serverless', name: explicitName || env.K_SERVICE, environment, instanceId: env.K_REVISION, image, enrolledVia: 'gcp' };
     }
     if (env.FUNCTIONS_WORKER_RUNTIME && env.WEBSITE_SITE_NAME) {
         // Azure Functions
         return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image };
     }
+    if (env.ECS_CONTAINER_METADATA_URI_V4 || env.ECS_CONTAINER_METADATA_URI) {
+        // ECS / Fargate task: the service name comes from the task definition env.
+        return { kind: 'container', name: explicitName || env.SERVICE_NAME || env.APP_NAME, environment, instanceId: env.HOSTNAME, image, enrolledVia: 'aws' };
+    }
     if (env.KUBERNETES_SERVICE_HOST) {
         // Pod names are "<deployment>-<replicaset-hash>-<pod-hash>"; the stable
         // workload name comes from the Downward API when the chart exposes it.
         const podName = env.HOSTNAME || env.POD_NAME || undefined;
         const name = explicitName || env.WORKLOAD_NAME || env.APP_NAME || env.DEPLOYMENT_NAME || (podName ? podName.replace(/(-[a-z0-9]{8,10})?-[a-z0-9]{5}$/, '') : undefined);
-        return { kind: 'kubernetes', name, environment: environment || env.POD_NAMESPACE || env.NAMESPACE, instanceId: podName, image };
+        return { kind: 'kubernetes', name, environment: environment || env.POD_NAMESPACE || env.NAMESPACE, instanceId: podName, image, enrolledVia: 'kubernetes' };
+    }
+    if (env.DYNO) {
+        // Heroku dyno (buildpack or container stack). HEROKU_APP_NAME exists only
+        // with the runtime-dyno-metadata feature; the console snippet sets
+        // FCD_WORKLOAD_NAME so the row is named after the app either way.
+        return { kind: 'container', name: explicitName || env.HEROKU_APP_NAME, environment, instanceId: env.DYNO, image, enrolledVia: 'heroku' };
     }
     if (fsProbe.existsSync('/.dockerenv') || env.container || env.DOCKER_CONTAINER) {
         return { kind: 'container', name: explicitName || env.SERVICE_NAME || env.APP_NAME, environment, instanceId: env.HOSTNAME, image };
@@ -137,8 +158,9 @@ async function workloadProtectCommand(args, config) {
     // substrate, not to the `--kind` the caller claimed.
     const hostRuntime = (0, hostRuntime_1.getHostRuntime)();
     assertWorkloadSubstrate(kind, hostRuntime, { force: args.force === 'true' });
+    const enrolledVia = resolveEnrolledVia(args.enrolledVia, process.env, detected.enrolledVia);
     console.log('\x1b[1m\x1b[36mFullCourtDefense — workload runtime protection\x1b[0m');
-    console.log(`  Workload: ${kind}/${name}${environment ? `/${environment}` : ''}`);
+    console.log(`  Workload: ${kind}/${name}${environment ? `/${environment}` : ''}${enrolledVia ? ` · via ${enrolledVia}` : ''}`);
     if (instanceId)
         console.log(`  Instance: ${instanceId}`);
     console.log(`  Detected: ${(0, hostRuntime_1.describeHostRuntime)(hostRuntime)}`);
@@ -156,6 +178,7 @@ async function workloadProtectCommand(args, config) {
             // `npm run`, never when the binary runs from a container entrypoint.
             cliVersion: (0, cliVersion_1.cliVersion)(),
             hostRuntime,
+            enrolledVia,
         }),
     });
     const data = (await resp.json().catch(() => ({})));