fullcourtdefense-cli 1.35.7 → 1.35.8

package/dist/commands/hook.js

@@ -69,6 +69,7 @@ const askDialog_1 = require("../askDialog");
 const hookIo_1 = require("../hookIo");
 const fileWriteCanon_1 = require("../fileWriteCanon");
 const discoverProxy_1 = require("./discoverProxy");
+const shellAstLoader_1 = require("../shellAstLoader");
 function inferEvent(explicit, payload) {
     const e = (explicit || '').toLowerCase();
     if (e) {
@@ -552,6 +553,7 @@ function spoolCallEvent(call, rest) {
         toolName: call.toolName,
         operation: rest.operation || operation,
         evidence: rest.evidence || (0, telemetry_1.evidenceFromToolArgs)(call.toolArgs),
+        shellAst: rest.shellAst || (0, shellAstLoader_1.collectShellAstFacts)(),
     });
 }
 /**
@@ -964,7 +966,7 @@ function tryLocalPolicyEnforcement(ctx, call, detail, opts = {}) {
     });
     const declaredOperations = (0, actionPolicyEngine_1.deriveToolOperations)(call.toolName);
     const local = (0, actionPolicyEngine_1.evaluateActionPolicies)(policies, call.toolName, operation, context, declaredOperations);
-    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail });
+    (0, hookIo_1.dbg)({ phase: 'policy_local_verdict', event: ctx.event, tool: call.toolName, operation, verdict: local.verdict, policyName: local.policyName, detail, astMode: (0, actionPolicyEngine_1.getShellAstMode)() });
     // Developer-scoped approvals need no backend at all — the IDE prompt IS the approver.
     if (tryDeveloperConfirmation(ctx, call, local, ctx.payload, 'offline'))
         return true;
@@ -1239,6 +1241,9 @@ function processIo(stdin, stdinErr) {
  * an allow verdict, never an error the thin client would surface.
  */
 async function evaluateHookRequest(args, stdinRaw, config) {
+    // Structural shell facts (shadow by default). A missing/slow parser means
+    // "no facts" and the regex floor decides alone — never a wait, never fail-open.
+    await (0, shellAstLoader_1.ensureShellAst)();
     return evaluateBuffered(args, stdinRaw, '', config, { isTTY: false, exitsProcess: false });
 }
 /**
@@ -1319,6 +1324,11 @@ async function hookCommandOuter(args, config, startedAt) {
             // machine that silently stopped using the fast path is diagnosable.
             (0, hookIo_1.dbg)({ phase: 'ipc_unavailable', event: args.event, detail: ipc.detail });
         }
+        // Structural shell facts for the local evaluation (shadow by default; the
+        // daemon path above initialises its own copy once). Bounded: a slow or
+        // missing parser resolves to "no facts" and the regex floor decides alone.
+        const astReady = await (0, shellAstLoader_1.ensureShellAst)();
+        (0, hookIo_1.dbg)({ phase: 'shell_ast', ready: astReady, status: (0, shellAstLoader_1.shellAstStatus)() });
         // Buffered so an `ask` can be put to the developer in OUR dialog before the
         // IDE reads the verdict; exitsProcess stays true — this process ends right after.
         const result = await evaluateBuffered(args, raw, stdinErr, config, { isTTY: !!process.stdin.isTTY, exitsProcess: true });
@@ -1456,9 +1466,11 @@ async function hookCommandInner(args, config, io) {
     // this is instant when fresh and bounded (~1.5s) only when stale.
     let machineSuspended = false;
     let modeResolved = false;
+    let runtimeBundleFlags = {};
     if (shieldId) {
         try {
             const bundle = await (0, runtimeConfig_1.getRuntimeBundle)({ apiUrl, shieldId, shieldKey, developerName: developerId(), machineName: os.hostname(), hotPath: true });
+            runtimeBundleFlags = bundle;
             // Kill-switch holds even on a 'default' bundle: with the cache missing
             // but a signed last-known-suspended marker standing, getRuntimeBundle
             // stamps suspended on the default — deleting the cache file must not
@@ -1486,6 +1498,10 @@ async function hookCommandInner(args, config, io) {
         }
         catch { /* keep the local default */ }
     }
+    // Shell AST mode: FCD_SHELL_AST_MODE env, else the bundle's `shellAstMode`
+    // (server-controlled rollout), else shadow — facts recorded, verdicts unchanged.
+    (0, shellAstLoader_1.applyShellAstMode)((0, shellAstLoader_1.resolveShellAstMode)(process.env.FCD_SHELL_AST_MODE, runtimeBundleFlags.shellAstMode));
+    (0, hookIo_1.dbg)({ phase: 'shell_ast_mode', mode: (0, actionPolicyEngine_1.getShellAstMode)(), fromEnv: process.env.FCD_SHELL_AST_MODE, fromBundle: runtimeBundleFlags.shellAstMode });
     // Monitor-first: no authoritative bundle (fresh/uncached/fetch failed) => report-only.
     if (!modeResolved && !forceEnforce) {
         shadow = true;

package/dist/commands/mcpGateway.js

@@ -74,6 +74,7 @@ const policyGateHealth_1 = require("../policyGateHealth");
 const actionPolicyEngine_1 = require("../actionPolicyEngine");
 const machineIdentity_1 = require("../machineIdentity");
 const backupManifest_1 = require("../backupManifest");
+const shellAstLoader_1 = require("../shellAstLoader");
 const devConfirm_1 = require("../devConfirm");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
@@ -2148,6 +2149,7 @@ class McpGatewayServer {
     }
 }
 async function mcpGatewayCommand(args, config) {
+    await (0, shellAstLoader_1.ensureShellAstReady)(); // resident process: load the parser once, before the first tool call (shadow by default)
     // The gateway is a resident proxy in front of the IDE's MCP servers — if it
     // crashes, EVERY protected tool goes down at once. Any escaped exception
     // (detached flush, timer, transport edge case) logs one line and the proxy

package/dist/commands/workloadProtect.js

@@ -66,7 +66,7 @@ function assertWorkloadSubstrate(kind, rt, options = {}) {
         + 'or pass --force true if this really is a disposable workload host.');
 }
 /** Connections the console has a section for; anything else is the generic snippet. */
-const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'snippet']);
+const ENROLLED_VIA_VALUES = new Set(['heroku', 'kubernetes', 'aws', 'gcp', 'azure', 'snippet']);
 function resolveEnrolledVia(explicit, env, detected) {
     for (const candidate of [explicit, env.FCD_ENROLLED_VIA, detected]) {
         const clean = (candidate || '').trim().toLowerCase();
@@ -105,7 +105,11 @@ function detectWorkloadContext(env = process.env, fsProbe = fs) {
     }
     if (env.FUNCTIONS_WORKER_RUNTIME && env.WEBSITE_SITE_NAME) {
         // Azure Functions
-        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image };
+        return { kind: 'serverless', name: explicitName || env.WEBSITE_SITE_NAME, environment, instanceId: env.WEBSITE_INSTANCE_ID, image, enrolledVia: 'azure' };
+    }
+    if (env.CONTAINER_APP_NAME && env.CONTAINER_APP_REVISION) {
+        // Azure Container Apps: the app name is the stable identity, the replica the instance.
+        return { kind: 'container', name: explicitName || env.CONTAINER_APP_NAME, environment, instanceId: env.CONTAINER_APP_REPLICA_NAME || env.HOSTNAME, image, enrolledVia: 'azure' };
     }
     if (env.ECS_CONTAINER_METADATA_URI_V4 || env.ECS_CONTAINER_METADATA_URI) {
         // ECS / Fargate task: the service name comes from the task definition env.

package/dist/shellAst.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Shell AST facts — the structural view of a shell command line that the
+ * deterministic guard and the action-policy engine consume as DATA.
+ *
+ * A tree-sitter-bash parse tree is walked ONCE into a flat, JSON-serializable
+ * list of simple commands in execution order. Each command carries its argv
+ * with quoting resolved, which words are fully literal, the cwd scope in force
+ * when it runs (tracked through `cd`/`pushd`, subshells, loops, functions), the
+ * nesting it sits in, its redirections, and — for wrappers such as `sudo`,
+ * `bash -c '…'`, `docker run … sh -c '…'` — the inner script parsed recursively.
+ *
+ * Contract (the part that keeps this safe to put on the decision path):
+ *
+ *   1. FAIL CLOSED. `complete` is true only when the tree has no ERROR / MISSING
+ *      node and every node type met is in the explicit allow-list below. Any
+ *      structure this module does not understand makes the whole result
+ *      incomplete, and an incomplete result may never RELAX a verdict — the
+ *      regex floor in the guard and the engine then decides alone. (Same
+ *      property Codex's `codex-command` and the tree-sitter rewrite of Claude
+ *      Code's bash safety take: never interpret structure you cannot prove.)
+ *   2. Deterministic, no I/O. This file has no imports; the parser is injected
+ *      as a minimal node interface so the same bytes are vendored into the
+ *      backend (console simulator) and stay byte-identical with the CLI.
+ *   3. Data, not code. The facts cross into the hot-updatable detector worker
+ *      as JSON. Nothing here executes, expands or resolves anything.
+ *
+ * Why an AST at all: every false positive of the last months was structural —
+ * quoted text mistaken for a command, a heredoc body scanned as shell, a bare
+ * `rm -rf *` after `cd scratch/` read as a root wipe, a `$( )` boundary missed.
+ * A parser answers those once; a regex answers them one incident at a time.
+ */
+export interface ShellSyntaxNode {
+    type: string;
+    text: string;
+    startIndex: number;
+    endIndex: number;
+    childCount: number;
+    isMissing: boolean;
+    isNamed: boolean;
+    child(index: number): ShellSyntaxNode | null;
+    childForFieldName(name: string): ShellSyntaxNode | null;
+}
+export type CwdScope = 'scoped' | 'unscoped' | 'unknown';
+export interface ShellRedirectFact {
+    op: string;
+    target: string;
+    literal: boolean;
+}
+export interface ShellWrapperFact {
+    kind: 'privilege' | 'shell' | 'eval' | 'exec' | 'env' | 'container' | 'timing' | 'xargs';
+    program: string;
+    /** The wrapped script when it is a literal string, parsed with the same walker. */
+    inner?: ShellFacts;
+}
+export interface ShellCommandFact {
+    /** argv[0] with quotes resolved; '' when it is dynamic (variable, substitution). */
+    name: string;
+    /** Words with quotes resolved. Dynamic parts keep their source text (`$X`, `$(…)`). */
+    argv: string[];
+    /** argv[i] is entirely literal: no expansion, substitution, glob-carrying variable. */
+    literal: boolean[];
+    /** Source text of the command including its redirects, EXCLUDING heredoc bodies. */
+    text: string;
+    start: number;
+    end: number;
+    /** cwd scope in force when this command runs. */
+    cwdScope: CwdScope;
+    depth: {
+        subshell: number;
+        function: number;
+        loop: number;
+        conditional: number;
+        substitution: number;
+    };
+    /** Members of one pipeline share an id (0 = not in a pipeline). */
+    pipeline: number;
+    redirects: ShellRedirectFact[];
+    hasHeredoc: boolean;
+    wrapper?: ShellWrapperFact;
+}
+export interface ShellFacts {
+    parser: 'tree-sitter-bash';
+    /** No parse errors and every node type understood. Only a complete result may relax a verdict. */
+    complete: boolean;
+    /** Why the result is incomplete (first reason). */
+    incompleteReason?: string;
+    commands: ShellCommandFact[];
+    /** Node types met that are not in the allow-list (for diagnostics / corpus growth). */
+    unknownNodeTypes: string[];
+    /** Any `eval`, `source`/`.`, or dynamic command name — structure the parse cannot see through. */
+    dynamicExecution: boolean;
+}
+/** What a `cd`/`pushd` target says about the cwd afterwards. */
+export declare function cdTargetScope(target: string, literal: boolean): CwdScope;
+/** A parsed inner script: its root plus the release of the parser's native tree. */
+export interface ParsedShellTree {
+    root: ShellSyntaxNode;
+    release(): void;
+}
+export declare const MAX_SHELL_AST_SOURCE = 64000;
+/**
+ * Walk a parsed tree into facts. `nesting` guards the recursion through
+ * literal `bash -c` scripts (depth 3 is plenty; deeper is treated as unknown).
+ */
+export declare function analyzeShellTree(root: ShellSyntaxNode, nesting?: number): ShellFacts;
+/** Register the grammar-backed parser used for inner `bash -c` scripts. */
+export declare function setInnerShellParser(parse: ((source: string) => ParsedShellTree | undefined) | undefined): void;
+/** All commands, including those inside literal wrapper scripts, depth-first in execution order. */
+export declare function flattenShellCommands(facts: ShellFacts): ShellCommandFact[];
+/** True when every part of the analysis (including inner scripts) is complete. */
+export declare function shellFactsFullyComplete(facts: ShellFacts | undefined): facts is ShellFacts;
+/**
+ * Text that looks like PowerShell — tree-sitter-bash will often parse it
+ * WITHOUT errors into nonsense, so the loader refuses it up front and the
+ * PowerShell model in the engine keeps deciding alone.
+ */
+export declare function looksLikePowerShell(command: string): boolean;