fullcourtdefense-cli 1.35.7 → 1.35.9

package/dist/commands/deterministicGuard.js

@@ -35,6 +35,10 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.setShellAstProvider = setShellAstProvider;
+exports.setShellAstMode = setShellAstMode;
+exports.getShellAstMode = getShellAstMode;
+exports.takeShellAstComparison = takeShellAstComparison;
 exports.unquotedCode = unquotedCode;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
@@ -722,25 +726,211 @@ function credentialCommandReason(value, options) {
 // stall. Root targets (`/`, `/*`) stay blocked even inside containers (the
 // Patria case: an agent nuking a running container's filesystem).
 const CONTAINER_EXEC_BEFORE = /\b(?:docker|podman|nerdctl|kubectl)(?:\.exe)?\s+(?:compose\s+)?(?:exec|run)\b[^;&|]*$/i;
-function destructiveCommandReason(value) {
+let shellAstProvider;
+let shellAstMode = 'shadow';
+let lastShellAstComparison;
+function setShellAstProvider(provider) {
+    shellAstProvider = provider;
+}
+function setShellAstMode(mode) { shellAstMode = mode; }
+function getShellAstMode() { return shellAstMode; }
+/** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
+function takeShellAstComparison() {
+    const value = lastShellAstComparison;
+    lastShellAstComparison = undefined;
+    return value;
+}
+function shellAstFactsFullyComplete(facts) {
+    if (!facts || !facts.complete)
+        return false;
+    for (const command of facts.commands)
+        if (command.wrapper?.inner && !shellAstFactsFullyComplete(command.wrapper.inner))
+            return false;
+    return true;
+}
+const AST_TRANSPARENT_WRAPPERS = new Set(['sudo', 'doas', 'pkexec', 'run0', 'gosu', 'runuser', 'env', 'nice', 'nohup', 'ionice', 'chrt', 'stdbuf', 'timeout', 'command', 'builtin', 'time', 'exec']);
+/**
+ * The destructive-rm decision from structure: which program really runs
+ * (through `sudo` / `env` / `time` / `exec`), which words are its flags after
+ * quote resolution (`rm "-rf" /` ≡ `rm -rf /`, `-r -f` ≡ `-rf`, `--recursive
+ * --force`), and what each target is once the cwd scope is known. Inner scripts
+ * of `bash -c` / `docker run … sh -c` are included; inside a container a bare
+ * `*` is the container workdir (cleanup), the root `/` is still the root.
+ */
+function astDestructiveRm(facts, inContainer = false) {
+    for (const command of facts.commands) {
+        if (command.wrapper?.inner) {
+            const hit = astDestructiveRm(command.wrapper.inner, inContainer || command.wrapper.kind === 'container');
+            if (hit)
+                return hit;
+        }
+        let argv = command.argv;
+        let literal = command.literal;
+        let name = command.name;
+        // Unwrap transparent wrappers: `sudo -u root rm -rf /`, `env X=1 rm -rf /`.
+        for (let guard = 0; guard < 4 && AST_TRANSPARENT_WRAPPERS.has(name); guard++) {
+            let i = 1;
+            while (i < argv.length && ((argv[i].startsWith('-') && argv[i] !== '-') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i]))) {
+                // `sudo -u root`: the option value follows on the next word.
+                if (/^-(?:u|g|h|C|p|r|t|U|D)$/.test(argv[i]))
+                    i++;
+                i++;
+            }
+            if (i >= argv.length || !literal[i]) {
+                name = '';
+                break;
+            }
+            argv = argv.slice(i);
+            literal = literal.slice(i);
+            name = argv[0].replace(/^.*\//, '').replace(/\.exe$/i, '').toLowerCase();
+        }
+        if (name !== 'rm')
+            continue;
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        let flagsDone = false;
+        for (let i = 1; i < argv.length; i++) {
+            const word = argv[i];
+            if (!flagsDone && word === '--') {
+                flagsDone = true;
+                continue;
+            }
+            if (!flagsDone && /^--/.test(word)) {
+                if (/^--recursive$/i.test(word))
+                    recursive = true;
+                if (/^--force$/i.test(word))
+                    force = true;
+                continue;
+            }
+            if (!flagsDone && /^-[A-Za-z]+$/.test(word)) {
+                if (/[rR]/.test(word))
+                    recursive = true;
+                if (/f/.test(word))
+                    force = true;
+                continue;
+            }
+            targets.push({ value: word, literal: literal[i] });
+        }
+        if (!recursive || !force)
+            continue;
+        for (const target of targets) {
+            const t = target.value.trim().replace(/\\/g, '/');
+            const lower = t.toLowerCase();
+            if (/^\/+\*?$/.test(t))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            if (/^(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/+\*?)?$/.test(lower))
+                return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+            if (/^(?:\*|\.\/+\*)$/.test(t)) {
+                if (inContainer || command.cwdScope === 'scoped')
+                    continue;
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
+            }
+        }
+    }
+    return undefined;
+}
+const RM_SCOPE_ITEMS = new Set(['rm_rf_root', 'rm_rf_home']);
+/**
+ * Destructive-command decision with the AST in the loop. Returns the regex
+ * verdict in 'off'/'shadow' (recording the comparison in shadow), and in
+ * 'primary' lets a fully complete AST decide the two rm-scope items — clearing
+ * a regex false positive or adding a structurally proven hit the regex missed —
+ * while every other destructive rule keeps its regex verdict.
+ */
+function destructiveCommandDecision(value) {
+    const regexHit = destructiveCommandReason(value);
+    if (shellAstMode === 'off' || !shellAstProvider)
+        return regexHit;
+    let facts;
+    try {
+        facts = shellAstProvider(value);
+    }
+    catch {
+        facts = undefined;
+    }
+    const complete = shellAstFactsFullyComplete(facts);
+    const astHit = complete && facts ? astDestructiveRm(facts) : undefined;
+    const regexRm = regexHit && RM_SCOPE_ITEMS.has(regexHit.itemId) ? regexHit.itemId : undefined;
+    lastShellAstComparison = { mode: shellAstMode, complete, regex: regexRm, ast: astHit?.itemId, agree: !complete || regexRm === astHit?.itemId };
+    if (shellAstMode !== 'primary' || !complete)
+        return regexHit;
+    if (astHit)
+        return astHit;
+    if (regexRm) {
+        // The AST cleared the rm-scope hit; other destructive rules still apply.
+        return destructiveCommandReason(value, { skipRmScope: true });
+    }
+    return regexHit;
+}
+// Every `cd <target>` statement start (cwd persists across `&&`, `;`, `|`,
+// newlines and `then`/`do`); the caller keeps the LAST one before the `rm`.
+const CD_STATEMENT = /(?:^|[;&|\n(]|\bthen\b|\bdo\b)\s*cd\s+(?:--\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/gi;
+/**
+ * Bare `rm -rf *` wipes whatever the CURRENT directory is. When the same
+ * script has already `cd`'d into a scoped directory — a literal subpath such
+ * as `x`, `./build`, `"$SP/chk"`, `/tmp/work` — the star is that directory's
+ * contents: everyday scratch cleanup (`mkdir -p x && cd x && rm -rf * && unzip …`
+ * on a bank workstation, 2026-09-24). It stays destructive when the cd target
+ * is a filesystem root, a home root, a drive root, `..`/`-`/`.`, or a BARE
+ * variable (`cd "$X"` with X unset lands in $HOME). No cd at all keeps the
+ * conservative reading: the agent's cwd is usually the project.
+ */
+function cdScopedBeforeBareStar(before) {
+    let last = null;
+    CD_STATEMENT.lastIndex = 0;
+    for (let m = CD_STATEMENT.exec(before); m; m = CD_STATEMENT.exec(before))
+        last = m;
+    if (!last)
+        return false;
+    // A `)` after the cd closes a subshell: `(cd x && …); rm -rf *` runs the rm
+    // back in the ORIGINAL directory, which the cd never changed.
+    if (before.slice(last.index + last[0].length).includes(')'))
+        return false;
+    const target = last[1].replace(/^["']|["']$/g, '').trim().replace(/\\/g, '/');
+    if (!target)
+        return false;
+    const lower = target.toLowerCase();
+    if (/^(?:\/+\*?|~\/*\*?|\.{1,2}\/?|-|\$home\/?|\$\{home\}\/?|%userprofile%\/?|\$env:userprofile\/?|[a-z]:\/*\*?)$/.test(lower))
+        return false;
+    if (/^(?:\$\{?[a-z_][a-z0-9_]*\}?|%[a-z_][a-z0-9_]*%|\$env:[a-z_][a-z0-9_]*)\/?$/.test(lower))
+        return false;
+    // At least one real path component that is not `.`/`..`.
+    return lower.split('/').some(part => part && part !== '.' && part !== '..');
+}
+function destructiveCommandReason(value, opts = {}) {
     return matchCommand(value, (text, lower) => {
-        // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
-        // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
-        // outer command — is caught too. Path-aware: only the root `/`, the root
-        // wildcard `/*`, and a bare `*` are treated as destructive — scoped paths
-        // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
-        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
-            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
-        // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
-        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
-            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        if (!opts.skipRmScope) {
+            // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
+            // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
+            // outer command — is caught too. Path-aware: only the root `/`, the root
+            // wildcard `/*`, and a bare `*` are treated as destructive — scoped paths
+            // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
+            if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            // Split or long flags: `rm -r -f /`, `rm -f -r /`, `rm --recursive --force /`
+            // (the structural parser saw these first — 2026-09-24; the floor must too).
+            const splitFlags = /\b(?:sudo\s+)?rm\s+((?:-(?:[a-z]+|-recursive|-force|-no-preserve-root)\s+){2,})["']?\/\*?["']?(?:\s|$|[;&|)])/.exec(lower);
+            if (splitFlags && /(?:^|\s)-(?:[a-z]*r|-recursive)/.test(splitFlags[1]) && /(?:^|\s)-(?:[a-z]*f|-force)/.test(splitFlags[1]))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
+            // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
+            if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
+                return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+            }
+            // Bare `*` deletes the current directory tree — destructive on the HOST,
+            // but inside a container exec/run it is the container workdir (cleanup),
+            // and after an explicit `cd <subdir>` it is that scratch folder's contents.
+            // EVERY bare-star rm on the line is judged: `(cd x && rm -rf *); rm -rf *`
+            // has one scoped and one unscoped removal, and the unscoped one wipes.
+            const bareStars = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/g;
+            for (let bareStar = bareStars.exec(lower); bareStar; bareStar = bareStars.exec(lower)) {
+                const before = lower.slice(0, bareStar.index);
+                if (!CONTAINER_EXEC_BEFORE.test(before) && !cdScopedBeforeBareStar(before)) {
+                    return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
+                }
+            }
         }
-        // Bare `*` deletes the current directory tree — destructive on the HOST,
-        // but inside a container exec/run it is the container workdir (cleanup).
-        const bareStar = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/.exec(lower);
-        if (bareStar && !CONTAINER_EXEC_BEFORE.test(lower.slice(0, bareStar.index)))
-            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
         // handles `"C:\"`. rd/rmdir are the same wipe under a different verb — the
@@ -1029,6 +1219,11 @@ function interpreterCodeSpawnsProcess(before, code) {
         return true;
     return BACKTICK_SHELL_INTERPRETER.test(before) && /`[^`]*`|%x[\[{(]/.test(code);
 }
+// An HTTP client in the same code makes a metadata endpoint literal a request target, not prose.
+const CODE_OPENS_REQUEST = /\b(?:urlopen|Request|requests|httpx|urllib3|aiohttp|http\.client|HTTPS?Connection|fetch|axios|got|XMLHttpRequest|https?\.(?:get|request)|Net::HTTP|LWP|HTTP::Tiny|URI\.open|curl_exec|file_get_contents|fsockopen|socket)\b/;
+function interpreterCodeRequestsMetadata(code) {
+    return Boolean(containsMetadataEndpoint(code)) && CODE_OPENS_REQUEST.test(code);
+}
 /** First path argument of direct file APIs in inline language code, not printed examples. */
 function interpreterFileArguments(text) {
     if (text.length > 32_000)
@@ -1116,7 +1311,7 @@ function stripInertDataSegments(text) {
         const before = src.slice(Math.max(0, offset - 80), offset);
         // Language-interpreter code: data unless it spawns a process (see above).
         if (LANG_INTERPRETER_CODE_BEFORE.test(before))
-            return interpreterCodeSpawnsProcess(before, body) ? whole : INERT_DATA;
+            return interpreterCodeSpawnsProcess(before, body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
         if (CODE_CONTEXT_BEFORE.test(before))
             return whole; // code position: executes
         if (dq !== undefined && INTERPOLATES.test(body))
@@ -1353,7 +1548,7 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
         if (finding)
             return finding;
     }
-    const destructive = destructiveCommandReason(value);
+    const destructive = destructiveCommandDecision(value);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
     }

package/dist/commands/hook.d.ts

@@ -193,7 +193,27 @@ export interface HookIo {
      * mode, where `exit` only unwinds the evaluation and the process lives on.
      */
     exitsProcess: boolean;
+    /** Evaluated inside the resident daemon for a thin client (see DaemonDeclined). */
+    viaDaemon?: boolean;
+    /** Set when this evaluation's verdict is a stop still being settled (approval wait). */
+    pendingStop?: string;
 }
+/**
+ * The daemon declines a request whose verdict is a human wait (org approval,
+ * taint approve-once). The thin client stops listening after ~2.5s and
+ * re-evaluates locally, so a daemon-side wait only opened a second approval
+ * request nobody would ever read. Declining sends the client to its local
+ * evaluation at once, where the one wait runs in the developer's own process.
+ */
+export declare class DaemonDeclined extends Error {
+}
+/** Absolute time a human wait must end by: its own cap, and never past the IDE's timeout. */
+export declare function humanWaitDeadline(waitMs: number, now?: number, startedAt?: number, ideTimeoutMs?: number): number;
+/** Verdict for an unexpected error that escaped the evaluation (process-level handlers). */
+export declare function crashVerdictForProcess(event: string | undefined, message: string): {
+    stdout: string;
+    exitCode: number;
+};
 /**
  * Daemon-side entry: evaluate one hook request in-process and return the
  * verdict instead of writing/exiting. Everything the per-event hook process
@@ -202,7 +222,9 @@ export interface HookIo {
  * Mirrors hookCommand's fail-open contract: any unexpected exception yields
  * an allow verdict, never an error the thin client would surface.
  */
-export declare function evaluateHookRequest(args: HookArgs, stdinRaw: string, config: BotGuardConfig): Promise<{
+export declare function evaluateHookRequest(args: HookArgs, stdinRaw: string, config: BotGuardConfig, opts?: {
+    viaDaemon?: boolean;
+}): Promise<{
     stdout: string;
     stderr: string;
     exitCode: number;
@@ -217,4 +239,15 @@ export declare function evaluateHookRequest(args: HookArgs, stdinRaw: string, co
  * through respond() inside and never reach this catch.
  */
 export declare function hookCommand(args: HookArgs, config: BotGuardConfig): Promise<void>;
+/**
+ * Errors that escape every await (an async 'error' event from a child process,
+ * a stray rejection) never reach the try/catch around the evaluation. Without
+ * these handlers Node prints a stack and exits 1 with NO verdict, which every
+ * client reads as a non-blocking hook error — the action runs. Route them
+ * through the same contract as a caught crash instead.
+ */
+export declare function installHookCrashHandlers(verdict: (message: string) => {
+    stdout: string;
+    exitCode: number;
+}): void;
 export {};