fullcourtdefense-cli 1.35.6 → 1.35.7

package/dist/commands/hook.js

@@ -820,7 +820,9 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     // this exact rule (same rule hash). Rules that forbid memory never reach here.
     // The caps in force come from the rule and the org ceiling in the cached bundle;
     // an org that switched "Always allow" off (`null`) honours no grant at all.
-    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context);
+    // The grant binds the facts THIS rule fired on: a credential-command rule is
+    // about the program, an egress / SSRF / exfil rule is about the host too.
+    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context, (0, devConfirm_1.grantRuleFactsFor)(source));
     const grantLimits = (0, devConfirm_1.resolveGrantLimits)(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)());
     const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
     if (grant) {

package/dist/devConfirm.d.ts

@@ -334,7 +334,38 @@ export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 export declare function revokeDeveloperGrants(key?: string): number;
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 export declare function describeGrantScope(scope: GrantScope): string;
-export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
+/**
+ * Which line-level facts the RULE that asked actually depends on. A grant binds
+ * the facts the rule fired on and nothing else: `gcloud_access_token_cmd` fired
+ * on `gcloud auth print-access-token`, so where a later `Invoke-RestMethod` in
+ * the same line posts (`logging.` vs `monitoring.googleapis.com`) and whether
+ * the engine classed the line `write` or `SHELL` must not partition the grant —
+ * that is what made every Always allow ask again (this machine, 2026-09-14..20).
+ * A rule that IS about the host (egress policy, SSRF, exfiltration, reverse
+ * shell) keeps the host in the grant so `evil.example` never rides on it.
+ */
+export interface GrantRuleFacts {
+    bindsDestination: boolean;
+}
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+export declare function grantRuleFactsFor(source: {
+    localFinding?: {
+        category?: string;
+    };
+    policyId?: string;
+    policies?: Array<{
+        id: string;
+        rules?: Array<{
+            constraints?: Array<{
+                field: string;
+            }>;
+        }>;
+    }>;
+}): GrantRuleFacts;
+export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined, facts?: GrantRuleFacts): GrantScope;
 /**
  * Is this exact action covered in the same session and policy context?
  * The 1h choice is a shorter expiry, never authorization for another session.

package/dist/devConfirm.js

@@ -61,6 +61,7 @@ exports.recordDeveloperGrant = recordDeveloperGrant;
 exports.listDeveloperGrants = listDeveloperGrants;
 exports.revokeDeveloperGrants = revokeDeveloperGrants;
 exports.describeGrantScope = describeGrantScope;
+exports.grantRuleFactsFor = grantRuleFactsFor;
 exports.grantScopeFor = grantScopeFor;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
@@ -1200,7 +1201,25 @@ function scriptGrantKeys(command, cwd) {
     });
     return [...new Set(keys)].sort();
 }
-function grantScopeFor(event, toolName, toolArgs, operation, context) {
+/** Local Safety categories whose finding is the destination host itself. */
+const DESTINATION_BOUND_CATEGORIES = new Set(['metadata_ssrf', 'secret_exfiltration', 'reverse_shell']);
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+function grantRuleFactsFor(source) {
+    if (source.localFinding) {
+        return { bindsDestination: DESTINATION_BOUND_CATEGORIES.has(String(source.localFinding.category || '')) };
+    }
+    const policy = source.policyId ? source.policies?.find(p => p.id === source.policyId) : undefined;
+    if (!policy)
+        return { bindsDestination: true };
+    const bindsDestination = (policy.rules || []).some(rule => (rule.constraints || []).some(c => typeof c.field === 'string' && c.field.startsWith('destination.')));
+    return { bindsDestination };
+}
+/** Grants made without rule facts (MCP gateway, older callers) keep the narrow, host-bound shape. */
+const DEFAULT_GRANT_RULE_FACTS = { bindsDestination: true };
+function grantScopeFor(event, toolName, toolArgs, operation, context, facts = DEFAULT_GRANT_RULE_FACTS) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
@@ -1209,9 +1228,14 @@ function grantScopeFor(event, toolName, toolArgs, operation, context) {
         const scripts = scriptGrantKeys(command, cwd);
         if (scripts.length)
             scope.scripts = scripts;
+        // A shell line's identity is its programs. The engine verb (`write` for a
+        // POST, `SHELL` otherwise) describes the line, not the app the rule asked
+        // about, and it changed the key between two `gcloud … ; Invoke-RestMethod`
+        // lines that fired the very same rule. One verb for every shell grant.
+        scope.operation = 'SHELL';
     }
     const domain = context?.['destination.domain'];
-    if (typeof domain === 'string' && domain.trim())
+    if (facts.bindsDestination && typeof domain === 'string' && domain.trim())
         scope.destinationDomain = domain.trim().toLowerCase();
     return scope;
 }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.6"
+  "version": "1.35.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.6",
+  "version": "1.35.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {