fullcourtdefense-cli 1.35.7 → 1.35.9

package/dist/askDialog.js

@@ -31,13 +31,14 @@ exports.resolveAskWithDialog = resolveAskWithDialog;
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
 const hookIo_1 = require("./hookIo");
+const callerEnv_1 = require("./callerEnv");
 /** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
 exports.ASK_ENVELOPE_FIELD = 'fcdAsk';
 /** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
 exports.ASK_DIALOG_TIMEOUT_MS = 55_000;
 /** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
 function askChannel() {
-    return (process.env.FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
+    return ((0, callerEnv_1.callerEnv)().FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
 }
 /** Attach the envelope to a decision object (core side). */
 function attachAskEnvelope(decision, envelope) {
@@ -142,7 +143,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
     const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits)
         && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
-    const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope) : undefined;
+    const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope, { policyId: envelope.policyId, policyName: envelope.policyName }) : undefined;
     const limitsLabel = allowAlways && grantLimits ? (0, devConfirm_1.describeGrantLimits)(grantLimits) : undefined;
     const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;
     const reason = options.clientLabel ? `IDE: ${options.clientLabel}\n${envelope.reason}` : envelope.reason;
@@ -172,7 +173,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
             toolName: envelope.toolName,
             operation: envelope.operation,
             reason: granted
-                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (${limitsLabel}, this rule)${policyLabel}`
+                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (${limitsLabel})${policyLabel}`
                 : `developer confirmed in the FullCourtDefense dialog${policyLabel}`,
             ruleId: envelope.policyId,
             policyHash: envelope.policyHash,
@@ -182,7 +183,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         });
         (0, telemetry_1.triggerFlush)(false);
         const agentMsg = granted
-            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} (${limitsLabel}) under this rule.`
+            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} (${limitsLabel}).`
             : `FullCourtDefense: the developer allowed this ${envelope.event} once in the FullCourtDefense dialog.`;
         return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, true, '', agentMsg)), exitCode: 0, resolution: outcome };
     }

package/dist/blockExplanation.js

@@ -84,6 +84,8 @@ function scopeWords(scope, developerName) {
         return '🌐 company default — applies to every machine';
     if (scope === 'machine' || scope === 'developer' || scope === 'local')
         return `📍 local rule — only ${developerName || 'this machine'}`;
+    if (scope === 'shield')
+        return '📍 shield rule — only the machines on the shield it was saved on, or the ones it names';
     return `${scope} policy`;
 }
 const FACT_WORDS = [

package/dist/callerEnv.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The environment of the process that ASKED for a verdict (#1466).
+ *
+ * A hook answered by the resident daemon is evaluated inside the daemon's
+ * process, whose own environment belongs to a scheduled task — not to the IDE
+ * session that spawned the hook. Every fact the decision reads from the
+ * environment (is a human present, which CI / ephemeral markers are set, the
+ * session identity, the IDE's hook budget) must be the CALLER's. The thin
+ * client sends a snapshot of exactly these keys; the daemon evaluates the
+ * request with them in place of its own values, per request.
+ *
+ * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
+ */
+export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS"];
+export type CallerEnvSnapshot = Partial<Record<(typeof CALLER_ENV_KEYS)[number], string>>;
+/** The keys above that are set in `env` — what the thin client sends. */
+export declare function snapshotCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
+/** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
+export declare function callerEnv(): NodeJS.ProcessEnv;
+/**
+ * Run `fn` with the caller's snapshot in place of this process's values for
+ * CALLER_ENV_KEYS — a key the caller did not send is UNSET, never inherited
+ * from the daemon. No snapshot (older client) = this process's env, as before.
+ */
+export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
+/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
+ * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
+ * developer-scoped approval must go to the org queue or block, never self-resolve.
+ */
+export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;

package/dist/callerEnv.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CALLER_ENV_KEYS = void 0;
+exports.snapshotCallerEnv = snapshotCallerEnv;
+exports.callerEnv = callerEnv;
+exports.withCallerEnv = withCallerEnv;
+exports.isCiEnvironment = isCiEnvironment;
+exports.isHumanPresent = isHumanPresent;
+const async_hooks_1 = require("async_hooks");
+/**
+ * The environment of the process that ASKED for a verdict (#1466).
+ *
+ * A hook answered by the resident daemon is evaluated inside the daemon's
+ * process, whose own environment belongs to a scheduled task — not to the IDE
+ * session that spawned the hook. Every fact the decision reads from the
+ * environment (is a human present, which CI / ephemeral markers are set, the
+ * session identity, the IDE's hook budget) must be the CALLER's. The thin
+ * client sends a snapshot of exactly these keys; the daemon evaluates the
+ * request with them in place of its own values, per request.
+ *
+ * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
+ */
+exports.CALLER_ENV_KEYS = [
+    // Human presence (isHumanPresent / isCiEnvironment).
+    'FCD_HUMAN_PRESENT', 'FCD_EPHEMERAL', 'FULLCOURTDEFENSE_EPHEMERAL',
+    'CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'TF_BUILD', 'JENKINS_URL', 'BUILDKITE', 'CIRCLECI',
+    // Whether a dialog can be shown in the caller's session.
+    'DISPLAY', 'WAYLAND_DISPLAY', 'FCD_ASK_CHANNEL',
+    // Action identity (captureActionIdentity).
+    'FCD_SESSION_ID', 'CLAUDE_CODE_SESSION_ID', 'CODEX_THREAD_ID', 'FCD_RUN_ID', 'GITHUB_RUN_ID', 'CI_PIPELINE_ID', 'FCD_WORKLOAD_INSTANCE_ID',
+    // Which client / workspace the verdict is written for.
+    'CLAUDECODE', 'CLAUDE_PROJECT_DIR', 'VSCODE_PID', 'TERM_PROGRAM', 'WORKSPACE_PATH',
+    // Human-wait budget and approve-once switches.
+    'FCD_HOOK_IDE_TIMEOUT_MS', 'FCD_TAINT_APPROVE_ONCE_DISABLED', 'FCD_TAINT_APPROVAL_TIMEOUT_MS',
+];
+/** The keys above that are set in `env` — what the thin client sends. */
+function snapshotCallerEnv(env = process.env) {
+    const snapshot = {};
+    for (const key of exports.CALLER_ENV_KEYS) {
+        const value = env[key];
+        if (typeof value === 'string')
+            snapshot[key] = value;
+    }
+    return snapshot;
+}
+const requestEnv = new async_hooks_1.AsyncLocalStorage();
+/** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
+function callerEnv() {
+    return requestEnv.getStore() ?? process.env;
+}
+/**
+ * Run `fn` with the caller's snapshot in place of this process's values for
+ * CALLER_ENV_KEYS — a key the caller did not send is UNSET, never inherited
+ * from the daemon. No snapshot (older client) = this process's env, as before.
+ */
+function withCallerEnv(snapshot, fn) {
+    if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot))
+        return fn();
+    const env = { ...process.env };
+    for (const key of exports.CALLER_ENV_KEYS) {
+        const value = snapshot[key];
+        if (typeof value === 'string')
+            env[key] = value;
+        else
+            delete env[key];
+    }
+    return requestEnv.run(env, fn);
+}
+/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
+function isCiEnvironment(env = callerEnv()) {
+    return env.GITHUB_ACTIONS === 'true'
+        || env.GITLAB_CI === 'true'
+        || env.TF_BUILD === 'True' // Azure Pipelines
+        || !!env.JENKINS_URL
+        || !!env.BUILDKITE
+        || !!env.CIRCLECI
+        || env.CI === 'true';
+}
+/**
+ * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
+ * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
+ * developer-scoped approval must go to the org queue or block, never self-resolve.
+ */
+function isHumanPresent(env = callerEnv()) {
+    if (env.FCD_EPHEMERAL === '1' || env.FCD_EPHEMERAL === 'true' || env.FULLCOURTDEFENSE_EPHEMERAL === '1')
+        return false;
+    if (env.FCD_HUMAN_PRESENT === '0' || env.FCD_HUMAN_PRESENT === 'false')
+        return false;
+    return !isCiEnvironment(env);
+}

package/dist/commandNarrative.js

@@ -110,12 +110,12 @@ const GCLOUD_SERVICE_NAMES = {
     secrets: 'Secret Manager', iam: 'IAM', projects: 'project', functions: 'Cloud Functions', container: 'GKE', logging: 'Cloud Logging',
     artifacts: 'Artifact Registry', scheduler: 'Cloud Scheduler', tasks: 'Cloud Tasks', kms: 'Cloud KMS', builds: 'Cloud Build', auth: 'auth', config: 'config',
 };
-const GCLOUD_READ = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check|versions)$/;
+const GCLOUD_READ = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check)$/;
 const GCLOUD_WRITE = /^(?:create|update|patch|replace|enable|disable|deploy|apply|start|stop|restart|resume|suspend|scale|promote|migrate|rollback|add-[a-z-]+|remove-[a-z-]+|set-[a-z-]+|unset|clear|activate|revoke|copy)$/;
 function humanVerb(verb) {
     const map = {
         describe: 'Reads details of', list: 'Lists', ls: 'Lists', 'get-iam-policy': 'Reads the access policy of', 'get-value': 'Reads the setting',
-        read: 'Reads', check: 'Checks', versions: 'Lists versions of',
+        read: 'Reads', check: 'Checks',
         create: 'Creates', update: 'Updates', patch: 'Updates', replace: 'Replaces', enable: 'Enables', disable: 'Disables', deploy: 'Deploys',
         apply: 'Applies', start: 'Starts', stop: 'Stops', restart: 'Restarts', resume: 'Resumes', suspend: 'Suspends', scale: 'Scales',
         promote: 'Promotes', migrate: 'Migrates', rollback: 'Rolls back', unset: 'Unsets', clear: 'Clears', activate: 'Activates', revoke: 'Revokes', copy: 'Copies',
@@ -135,12 +135,39 @@ function humanVerb(verb) {
         return `Sets ${verb.slice(4).replace(/-/g, ' ')} on`;
     return `Runs \`${verb}\` on`;
 }
+/** `gcloud secrets versions <verb>`: `access` reads the secret VALUE, `list` lists versions, `add` stores a new value. */
+function describeSecretVersions(toks, verbAt, where) {
+    const verb = toks[verbAt] || '';
+    const ops = operandsAfter(toks, verbAt + 1);
+    const flagSecret = flagValue(toks, '--secret');
+    const secret = (name) => (name ? `secret ${shortValue(name, 60)}` : 'a secret');
+    if (verb === 'access') {
+        return `Reads the value of ${secret(flagSecret)} (version ${shortValue(ops[0] || 'latest', 20)}) from Secret Manager${where}`;
+    }
+    if (verb === 'list')
+        return `Lists the versions of ${secret(ops[0])} in Secret Manager${where}`;
+    if (verb === 'add') {
+        const dataFile = flagValue(toks, '--data-file');
+        return `Adds a new version to ${secret(ops[0])} in Secret Manager${dataFile ? `, value from ${dataFile === '-' ? 'standard input' : shortValue(dataFile, 60)}` : ''}${where}`;
+    }
+    const version = ops[0] ? `version ${shortValue(ops[0], 20)} of ` : '';
+    if (verb === 'describe')
+        return `Reads details of ${version}${secret(flagSecret)} in Secret Manager${where}`;
+    const state = { destroy: 'Destroys', disable: 'Disables', enable: 'Enables' };
+    if (state[verb])
+        return `${state[verb]} ${version}${secret(flagSecret)} in Secret Manager${where}`;
+    return `Runs \`gcloud secrets versions ${verb}\`${where}`;
+}
 function describeGcloud(toks) {
     let i = 1;
     while (i < toks.length && toks[i].startsWith('-'))
         i++;
     if (/^(?:alpha|beta)$/.test(toks[i] || ''))
         i++;
+    if (toks[i] === 'secrets' && toks[i + 1] === 'versions') {
+        const project = flagValue(toks, '--project');
+        return describeSecretVersions(toks, i + 2, project ? ` in project ${project}` : '');
+    }
     const groups = [];
     let verb;
     for (; i < toks.length; i++) {
@@ -234,6 +261,79 @@ function describePipeTail(stages) {
         return ', and writes the output to a file';
     return '';
 }
+/**
+ * The whole statement is one quoted string (`"len=$($t.Length)"`, `'done'`): its text
+ * with each `$( … )` sub-expression shown as `…`. Undefined when it is anything else.
+ */
+function bareStringText(head) {
+    const value = head.trim();
+    const q = value[0];
+    if ((q !== '"' && q !== "'") || value.length < 2 || value[value.length - 1] !== q)
+        return undefined;
+    let depth = 0;
+    let text = '';
+    for (let k = 1; k < value.length - 1; k++) {
+        const ch = value[k];
+        if (q === '"' && ch === '`') {
+            text += value[++k] ?? '';
+            continue;
+        }
+        if (q === '"' && ch === '$' && value[k + 1] === '(') {
+            if (depth++ === 0)
+                text += '…';
+            k++;
+            continue;
+        }
+        if (depth > 0) {
+            if (ch === '(')
+                depth++;
+            else if (ch === ')')
+                depth--;
+            continue;
+        }
+        if (ch === q) {
+            if (q === "'" && value[k + 1] === "'") {
+                text += "'";
+                k++;
+                continue;
+            }
+            return undefined;
+        }
+        text += ch;
+    }
+    return depth === 0 ? text.trim() : undefined;
+}
+/** `((gcloud … $p) -join '').Trim()` -> `gcloud … $p`: the command inside nested groups (quote-aware). */
+function peelGroups(text) {
+    let value = text.trim();
+    for (let guard = 0; guard < 8 && value.startsWith('('); guard++) {
+        let depth = 0;
+        let end = -1;
+        let quote = '';
+        for (let k = 0; k < value.length; k++) {
+            const ch = value[k];
+            if (quote) {
+                if (ch === quote)
+                    quote = '';
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                quote = ch;
+                continue;
+            }
+            if (ch === '(')
+                depth++;
+            else if (ch === ')' && --depth === 0) {
+                end = k;
+                break;
+            }
+        }
+        if (end < 0)
+            break;
+        value = value.slice(1, end).trim();
+    }
+    return value;
+}
 function describeOne(segmentIn) {
     const segment = segmentIn.trim();
     const [head, ...pipe] = splitPipe(segment);
@@ -270,10 +370,14 @@ function describeOne(segmentIn) {
             }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
-        const inner = rhs.replace(/^\(\s*/, '').replace(/\)\s*(?:\.\w+\(\))*$/, '');
+        const inner = rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
         const innerStep = describeOne(inner);
         return { segment, text: shortValue(`Stores in ${name}: ${innerStep.text.charAt(0).toLowerCase()}${innerStep.text.slice(1)}${tail}`, MAX_LINE), known: innerStep.known };
     }
+    // A bare string statement: PowerShell writes it to the output (`"len=$($t.Length)"`).
+    const bare = bareStringText(head);
+    if (bare !== undefined)
+        return step(bare ? `Prints text: ${shortValue(bare, 80)}` : 'Prints an empty line');
     const toks = tokens(head);
     if (toks.length === 0)
         return step('(empty)', false);
@@ -531,7 +635,10 @@ function describeOne(segmentIn) {
         default:
             if (/^\$/.test(programToken))
                 return step(pipe.length ? `Uses ${shortValue(programToken, 40)}${tail}` : `Reads variable ${shortValue(programToken, 40)}`, false);
-            return step(`Runs \`${shortValue([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50)}\``, false);
+            {
+                const shown = shortValue([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50);
+                return step(shown ? `Runs \`${shown}\`` : 'Runs a command this dialog cannot describe', false);
+            }
     }
 }
 /** Split one step on top-level `|` (quote-aware). */

package/dist/commands/daemon.js

@@ -1593,7 +1593,7 @@ async function runDaemon(args, config) {
     // to full local evaluation whenever this server is down — never a blocker.
     let verdictServer;
     try {
-        verdictServer = (0, verdictIpc_1.startVerdictServer)((hookArgs, stdin) => (0, hook_1.evaluateHookRequest)(hookArgs, stdin, (0, config_1.loadConfig)()), log);
+        verdictServer = (0, verdictIpc_1.startVerdictServer)((hookArgs, stdin) => (0, hook_1.evaluateHookRequest)(hookArgs, stdin, (0, config_1.loadConfig)(), { viaDaemon: true }), log);
     }
     catch (error) {
         log(`Verdict IPC: failed to start (${error.message}) — hooks will evaluate locally.`);

package/dist/commands/deterministicGuard.d.ts

@@ -106,6 +106,38 @@ export interface SharedCommandRule {
  * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+export type ShellAstMode = 'off' | 'shadow' | 'primary';
+/** Structural subset of shellAst.ts ShellFacts that the guard reads. */
+export interface ShellAstFactsLike {
+    complete: boolean;
+    incompleteReason?: string;
+    dynamicExecution?: boolean;
+    commands: Array<{
+        name: string;
+        argv: string[];
+        literal: boolean[];
+        cwdScope: 'scoped' | 'unscoped' | 'unknown';
+        wrapper?: {
+            kind: string;
+            program: string;
+            inner?: ShellAstFactsLike;
+        };
+    }>;
+}
+export interface ShellAstComparison {
+    mode: ShellAstMode;
+    complete: boolean;
+    /** Destructive-rm item id the regex floor produced (undefined = clean). */
+    regex?: string;
+    /** Destructive-rm item id the AST produced (undefined = clean). */
+    ast?: string;
+    agree: boolean;
+}
+export declare function setShellAstProvider(provider: ((command: string) => ShellAstFactsLike | undefined) | undefined): void;
+export declare function setShellAstMode(mode: ShellAstMode): void;
+export declare function getShellAstMode(): ShellAstMode;
+/** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
+export declare function takeShellAstComparison(): ShellAstComparison | undefined;
 /**
  * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
  * space. Detectors that ask "does this EXECUTE" must look here; the raw line