fullcourtdefense-cli 1.35.6 → 1.35.8

package/dist/commands/hook.js

@@ -69,6 +69,7 @@ const askDialog_1 = require("../askDialog");
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
 const discoverProxy_1 = require("./discoverProxy");
+const shellAstLoader_1 = require("../shellAstLoader");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -552,6 +553,7 @@ function spoolCallEvent(call, rest) {
         toolName: call.toolName,
         operation: rest.operation || operation,
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
+        shellAst: rest.shellAst || (0, shellAstLoader_1.collectShellAstFacts)(),
     });
 }
 /**
@@ -820,7 +822,9 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     // this exact rule (same rule hash). Rules that forbid memory never reach here.
     // The caps in force come from the rule and the org ceiling in the cached bundle;
     // an org that switched "Always allow" off (`null`) honours no grant at all.
-    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context);
+    // The grant binds the facts THIS rule fired on: a credential-command rule is
+    // about the program, an egress / SSRF / exfil rule is about the host too.
+    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context, (0, devConfirm_1.grantRuleFactsFor)(source));
     const grantLimits = (0, devConfirm_1.resolveGrantLimits)(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)());
     const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
     if (grant) {
@@ -962,7 +966,7 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     });
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
-    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
+    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail, astMode: (0, actionPolicyEngine_1.getShellAstMode)() });
     // Developer-scoped approvals need no backend at all — the IDE prompt IS the approver.
     if (tryDeveloperConfirmation(ctx, call, local, ctx.payload, 'offline'))
         return true;
@@ -1237,6 +1241,9 @@ function processIo(stdin, stdinErr) {
  * an allow verdict, never an error the thin client would surface.
  */
 async function evaluateHookRequest(args, stdinRaw, config) {
+    // Structural shell facts (shadow by default). A missing/slow parser means
+    // "no facts" and the regex floor decides alone — never a wait, never fail-open.
+    await (0, shellAstLoader_1.ensureShellAst)();
     return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false });
 }
 /**
@@ -1317,6 +1324,11 @@ async function hookCommandOuter(args, config, startedAt) {
             // machine that silently stopped using the fast path is diagnosable.
             (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
         }
+        // Structural shell facts for the local evaluation (shadow by default; the
+        // daemon path above initialises its own copy once). Bounded: a slow or
+        // missing parser resolves to "no facts" and the regex floor decides alone.
+        const astReady = await (0, shellAstLoader_1.ensureShellAst)();
+        (0, hookIo_1.dbg)({ phase: 'shell_ast', ready: astReady, status: (0, shellAstLoader_1.shellAstStatus)() });
         // Buffered so an `ask` can be put to the developer in OUR dialog before the
         // IDE reads the verdict; exitsProcess stays true — this process ends right after.
         const result = await evaluateBuffered(args, raw, stdinErr, config, { isTTY: !!process.stdin.isTTY, exitsProcess: true });
@@ -1454,9 +1466,11 @@ async function hookCommandInner(args, config, io) {
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
     let modeResolved = false;
+    let runtimeBundleFlags = {};
     if (shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
+            runtimeBundleFlags = bundle;
             // Kill-switch holds even on a 'default' bundle: with the cache missing
             // but a signed last-known-suspended marker standing, getRuntimeBundle
             // stamps suspended on the default — deleting the cache file must not
@@ -1484,6 +1498,10 @@ async function hookCommandInner(args, config, io) {
         }
         catch { /* keep the local default */ }
     }
+    // Shell AST mode: FCD_SHELL_AST_MODE env, else the bundle's `shellAstMode`
+    // (server-controlled rollout), else shadow — facts recorded, verdicts unchanged.
+    (0, shellAstLoader_1.applyShellAstMode)((0, shellAstLoader_1.resolveShellAstMode)(process.env.FCD_SHELL_AST_MODE, runtimeBundleFlags.shellAstMode));
+    (0, hookIo_1.dbg)({ phase: 'shell_ast_mode', mode: (0, actionPolicyEngine_1.getShellAstMode)(), fromEnv: process.env.FCD_SHELL_AST_MODE, fromBundle: runtimeBundleFlags.shellAstMode });
     // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
     if (!modeResolved && !forceEnforce) {
         shadow = true;

package/dist/commands/mcpGateway.js

@@ -74,6 +74,7 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const machineIdentity_1 = require("../machineIdentity");
 const backupManifest_1 = require("../backupManifest");
+const shellAstLoader_1 = require("../shellAstLoader");
 const devConfirm_1 = require("../devConfirm");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
@@ -2148,6 +2149,7 @@ class McpGatewayServer {
     }
 }
 async function mcpGatewayCommand(args, config) {
+    await (0, shellAstLoader_1.ensureShellAstReady)(); // resident process: load the parser once, before the first tool call (shadow by default)
     // The gateway is a resident proxy in front of the IDE's MCP servers — if it
     // crashes, EVERY protected tool goes down at once. Any escaped exception
     // (detached flush, timer, transport edge case) logs one line and the proxy

package/dist/commands/workloadProtect.js

@@ -66,7 +66,7 @@ function assertWorkloadSubstrate(kind, rt, options = {}) {
         + 'or pass --force true if this really is a disposable workload host.');
 }
 /** Connections the console has a section for; anything else is the generic snippet. */
-const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'snippet']);
+const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'azure', 'snippet']);
 function resolveEnrolledVia(explicit, env, detected) {
     for (const candidate of [explicit, env.FCD_ENROLLED_VIA, detected]) {
         const clean = (candidate || '').trim().toLowerCase();
@@ -105,7 +105,11 @@ function detectWorkloadContext(env = process.env, fsProbe = fs) {
     }
     if (env.FUNCTIONS_WORKER_RUNTIME && env.WEBSITE_SITE_NAME) {
         // Azure Functions
-        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image };
+        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image, enrolledVia: 'azure' };
+    }
+    if (env.CONTAINER_APP_NAME && env.CONTAINER_APP_REVISION) {
+        // Azure Container Apps: the app name is the stable identity, the replica the instance.
+        return { kind: 'container', name: explicitName || env.CONTAINER_APP_NAME, environment, instanceId: env.CONTAINER_APP_REPLICA_NAME || env.HOSTNAME, image, enrolledVia: 'azure' };
     }
     if (env.ECS_CONTAINER_METADATA_URI_V4 || env.ECS_CONTAINER_METADATA_URI) {
         // ECS / Fargate task: the service name comes from the task definition env.

package/dist/devConfirm.d.ts

@@ -334,7 +334,38 @@ export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 export declare function revokeDeveloperGrants(key?: string): number;
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 export declare function describeGrantScope(scope: GrantScope): string;
-export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
+/**
+ * Which line-level facts the RULE that asked actually depends on. A grant binds
+ * the facts the rule fired on and nothing else: `gcloud_access_token_cmd` fired
+ * on `gcloud auth print-access-token`, so where a later `Invoke-RestMethod` in
+ * the same line posts (`logging.` vs `monitoring.googleapis.com`) and whether
+ * the engine classed the line `write` or `SHELL` must not partition the grant —
+ * that is what made every Always allow ask again (this machine, 2026-09-14..20).
+ * A rule that IS about the host (egress policy, SSRF, exfiltration, reverse
+ * shell) keeps the host in the grant so `evil.example` never rides on it.
+ */
+export interface GrantRuleFacts {
+    bindsDestination: boolean;
+}
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+export declare function grantRuleFactsFor(source: {
+    localFinding?: {
+        category?: string;
+    };
+    policyId?: string;
+    policies?: Array<{
+        id: string;
+        rules?: Array<{
+            constraints?: Array<{
+                field: string;
+            }>;
+        }>;
+    }>;
+}): GrantRuleFacts;
+export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined, facts?: GrantRuleFacts): GrantScope;
 /**
  * Is this exact action covered in the same session and policy context?
  * The 1h choice is a shorter expiry, never authorization for another session.

package/dist/devConfirm.js

@@ -61,6 +61,7 @@ exports.recordDeveloperGrant = recordDeveloperGrant;
 exports.listDeveloperGrants = listDeveloperGrants;
 exports.revokeDeveloperGrants = revokeDeveloperGrants;
 exports.describeGrantScope = describeGrantScope;
+exports.grantRuleFactsFor = grantRuleFactsFor;
 exports.grantScopeFor = grantScopeFor;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
@@ -1200,7 +1201,25 @@ function scriptGrantKeys(command, cwd) {
     });
     return [...new Set(keys)].sort();
 }
-function grantScopeFor(event, toolName, toolArgs, operation, context) {
+/** Local Safety categories whose finding is the destination host itself. */
+const DESTINATION_BOUND_CATEGORIES = new Set(['metadata_ssrf', 'secret_exfiltration', 'reverse_shell']);
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+function grantRuleFactsFor(source) {
+    if (source.localFinding) {
+        return { bindsDestination: DESTINATION_BOUND_CATEGORIES.has(String(source.localFinding.category || '')) };
+    }
+    const policy = source.policyId ? source.policies?.find(p => p.id === source.policyId) : undefined;
+    if (!policy)
+        return { bindsDestination: true };
+    const bindsDestination = (policy.rules || []).some(rule => (rule.constraints || []).some(c => typeof c.field === 'string' && c.field.startsWith('destination.')));
+    return { bindsDestination };
+}
+/** Grants made without rule facts (MCP gateway, older callers) keep the narrow, host-bound shape. */
+const DEFAULT_GRANT_RULE_FACTS = { bindsDestination: true };
+function grantScopeFor(event, toolName, toolArgs, operation, context, facts = DEFAULT_GRANT_RULE_FACTS) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
@@ -1209,9 +1228,14 @@ function grantScopeFor(event, toolName, toolArgs, operation, context) {
         const scripts = scriptGrantKeys(command, cwd);
         if (scripts.length)
             scope.scripts = scripts;
+        // A shell line's identity is its programs. The engine verb (`write` for a
+        // POST, `SHELL` otherwise) describes the line, not the app the rule asked
+        // about, and it changed the key between two `gcloud … ; Invoke-RestMethod`
+        // lines that fired the very same rule. One verb for every shell grant.
+        scope.operation = 'SHELL';
     }
     const domain = context?.['destination.domain'];
-    if (typeof domain === 'string' && domain.trim())
+    if (facts.bindsDestination && typeof domain === 'string' && domain.trim())
         scope.destinationDomain = domain.trim().toLowerCase();
     return scope;
 }

package/dist/shellAst.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Shell AST facts — the structural view of a shell command line that the
+ * deterministic guard and the action-policy engine consume as DATA.
+ *
+ * A tree-sitter-bash parse tree is walked ONCE into a flat, JSON-serializable
+ * list of simple commands in execution order. Each command carries its argv
+ * with quoting resolved, which words are fully literal, the cwd scope in force
+ * when it runs (tracked through `cd`/`pushd`, subshells, loops, functions), the
+ * nesting it sits in, its redirections, and — for wrappers such as `sudo`,
+ * `bash -c '…'`, `docker run … sh -c '…'` — the inner script parsed recursively.
+ *
+ * Contract (the part that keeps this safe to put on the decision path):
+ *
+ *   1. FAIL CLOSED. `complete` is true only when the tree has no ERROR / MISSING
+ *      node and every node type met is in the explicit allow-list below. Any
+ *      structure this module does not understand makes the whole result
+ *      incomplete, and an incomplete result may never RELAX a verdict — the
+ *      regex floor in the guard and the engine then decides alone. (Same
+ *      property Codex's `codex-command` and the tree-sitter rewrite of Claude
+ *      Code's bash safety take: never interpret structure you cannot prove.)
+ *   2. Deterministic, no I/O. This file has no imports; the parser is injected
+ *      as a minimal node interface so the same bytes are vendored into the
+ *      backend (console simulator) and stay byte-identical with the CLI.
+ *   3. Data, not code. The facts cross into the hot-updatable detector worker
+ *      as JSON. Nothing here executes, expands or resolves anything.
+ *
+ * Why an AST at all: every false positive of the last months was structural —
+ * quoted text mistaken for a command, a heredoc body scanned as shell, a bare
+ * `rm -rf *` after `cd scratch/` read as a root wipe, a `$( )` boundary missed.
+ * A parser answers those once; a regex answers them one incident at a time.
+ */
+export interface ShellSyntaxNode {
+    type: string;
+    text: string;
+    startIndex: number;
+    endIndex: number;
+    childCount: number;
+    isMissing: boolean;
+    isNamed: boolean;
+    child(index: number): ShellSyntaxNode | null;
+    childForFieldName(name: string): ShellSyntaxNode | null;
+}
+export type CwdScope = 'scoped' | 'unscoped' | 'unknown';
+export interface ShellRedirectFact {
+    op: string;
+    target: string;
+    literal: boolean;
+}
+export interface ShellWrapperFact {
+    kind: 'privilege' | 'shell' | 'eval' | 'exec' | 'env' | 'container' | 'timing' | 'xargs';
+    program: string;
+    /** The wrapped script when it is a literal string, parsed with the same walker. */
+    inner?: ShellFacts;
+}
+export interface ShellCommandFact {
+    /** argv[0] with quotes resolved; '' when it is dynamic (variable, substitution). */
+    name: string;
+    /** Words with quotes resolved. Dynamic parts keep their source text (`$X`, `$(…)`). */
+    argv: string[];
+    /** argv[i] is entirely literal: no expansion, substitution, glob-carrying variable. */
+    literal: boolean[];
+    /** Source text of the command including its redirects, EXCLUDING heredoc bodies. */
+    text: string;
+    start: number;
+    end: number;
+    /** cwd scope in force when this command runs. */
+    cwdScope: CwdScope;
+    depth: {
+        subshell: number;
+        function: number;
+        loop: number;
+        conditional: number;
+        substitution: number;
+    };
+    /** Members of one pipeline share an id (0 = not in a pipeline). */
+    pipeline: number;
+    redirects: ShellRedirectFact[];
+    hasHeredoc: boolean;
+    wrapper?: ShellWrapperFact;
+}
+export interface ShellFacts {
+    parser: 'tree-sitter-bash';
+    /** No parse errors and every node type understood. Only a complete result may relax a verdict. */
+    complete: boolean;
+    /** Why the result is incomplete (first reason). */
+    incompleteReason?: string;
+    commands: ShellCommandFact[];
+    /** Node types met that are not in the allow-list (for diagnostics / corpus growth). */
+    unknownNodeTypes: string[];
+    /** Any `eval`, `source`/`.`, or dynamic command name — structure the parse cannot see through. */
+    dynamicExecution: boolean;
+}
+/** What a `cd`/`pushd` target says about the cwd afterwards. */
+export declare function cdTargetScope(target: string, literal: boolean): CwdScope;
+/** A parsed inner script: its root plus the release of the parser's native tree. */
+export interface ParsedShellTree {
+    root: ShellSyntaxNode;
+    release(): void;
+}
+export declare const MAX_SHELL_AST_SOURCE = 64000;
+/**
+ * Walk a parsed tree into facts. `nesting` guards the recursion through
+ * literal `bash -c` scripts (depth 3 is plenty; deeper is treated as unknown).
+ */
+export declare function analyzeShellTree(root: ShellSyntaxNode, nesting?: number): ShellFacts;
+/** Register the grammar-backed parser used for inner `bash -c` scripts. */
+export declare function setInnerShellParser(parse: ((source: string) => ParsedShellTree | undefined) | undefined): void;
+/** All commands, including those inside literal wrapper scripts, depth-first in execution order. */
+export declare function flattenShellCommands(facts: ShellFacts): ShellCommandFact[];
+/** True when every part of the analysis (including inner scripts) is complete. */
+export declare function shellFactsFullyComplete(facts: ShellFacts | undefined): facts is ShellFacts;
+/**
+ * Text that looks like PowerShell — tree-sitter-bash will often parse it
+ * WITHOUT errors into nonsense, so the loader refuses it up front and the
+ * PowerShell model in the engine keeps deciding alone.
+ */
+export declare function looksLikePowerShell(command: string): boolean;