fullcourtdefense-cli 1.35.8 → 1.35.10

package/dist/commandNarrative.d.ts

@@ -20,6 +20,14 @@ export interface CommandStep {
     text: string;
     /** The grammar recognised the program and its verb. */
     known: boolean;
+    /** A credential stored in a variable by this step (`$tok = gcloud auth print-access-token`). */
+    captures?: {
+        variable: string;
+        issuer?: {
+            name: string;
+            domains: string[];
+        };
+    };
 }
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 export declare function splitCommandSteps(command: string): string[];

package/dist/commandNarrative.js

@@ -20,6 +20,12 @@ exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
+/** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
+const TOKEN_PRINTERS = [
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+(?:application-default\s+)?print-access-token\b/i, issuer: { name: 'Google', domains: ['googleapis.com'] } },
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+print-identity-token\b/i },
+    { re: /^gh(?:\.exe)?\s+auth\s+token\b/i, issuer: { name: 'GitHub', domains: ['github.com', 'githubusercontent.com'] } },
+];
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 function splitCommandSteps(command) {
     const steps = [];
@@ -110,12 +116,12 @@ const GCLOUD_SERVICE_NAMES = {
     secrets: 'Secret Manager', iam: 'IAM', projects: 'project', functions: 'Cloud Functions', container: 'GKE', logging: 'Cloud Logging',
     artifacts: 'Artifact Registry', scheduler: 'Cloud Scheduler', tasks: 'Cloud Tasks', kms: 'Cloud KMS', builds: 'Cloud Build', auth: 'auth', config: 'config',
 };
-const GCLOUD_READ = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check|versions)$/;
+const GCLOUD_READ = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check)$/;
 const GCLOUD_WRITE = /^(?:create|update|patch|replace|enable|disable|deploy|apply|start|stop|restart|resume|suspend|scale|promote|migrate|rollback|add-[a-z-]+|remove-[a-z-]+|set-[a-z-]+|unset|clear|activate|revoke|copy)$/;
 function humanVerb(verb) {
     const map = {
         describe: 'Reads details of', list: 'Lists', ls: 'Lists', 'get-iam-policy': 'Reads the access policy of', 'get-value': 'Reads the setting',
-        read: 'Reads', check: 'Checks', versions: 'Lists versions of',
+        read: 'Reads', check: 'Checks',
         create: 'Creates', update: 'Updates', patch: 'Updates', replace: 'Replaces', enable: 'Enables', disable: 'Disables', deploy: 'Deploys',
         apply: 'Applies', start: 'Starts', stop: 'Stops', restart: 'Restarts', resume: 'Resumes', suspend: 'Suspends', scale: 'Scales',
         promote: 'Promotes', migrate: 'Migrates', rollback: 'Rolls back', unset: 'Unsets', clear: 'Clears', activate: 'Activates', revoke: 'Revokes', copy: 'Copies',
@@ -135,12 +141,43 @@ function humanVerb(verb) {
         return `Sets ${verb.slice(4).replace(/-/g, ' ')} on`;
     return `Runs \`${verb}\` on`;
 }
-function describeGcloud(toks) {
+/** `gcloud secrets versions <verb>`: `access` reads the secret VALUE, `list` lists versions, `add` stores a new value. */
+function describeSecretVersions(toks, verbAt, where) {
+    const verb = toks[verbAt] || '';
+    const ops = operandsAfter(toks, verbAt + 1);
+    const flagSecret = flagValue(toks, '--secret');
+    const secret = (name) => (name ? `secret ${shortValue(name, 60)}` : 'a secret');
+    if (verb === 'access') {
+        return `Reads the value of ${secret(flagSecret)} (version ${shortValue(ops[0] || 'latest', 20)}) from Secret Manager${where}`;
+    }
+    if (verb === 'list')
+        return `Lists the versions of ${secret(ops[0])} in Secret Manager${where}`;
+    if (verb === 'add') {
+        const dataFile = flagValue(toks, '--data-file');
+        return `Adds a new version to ${secret(ops[0])} in Secret Manager${dataFile ? `, value from ${dataFile === '-' ? 'standard input' : shortValue(dataFile, 60)}` : ''}${where}`;
+    }
+    const version = ops[0] ? `version ${shortValue(ops[0], 20)} of ` : '';
+    if (verb === 'describe')
+        return `Reads details of ${version}${secret(flagSecret)} in Secret Manager${where}`;
+    const state = { destroy: 'Destroys', disable: 'Disables', enable: 'Enables' };
+    if (state[verb])
+        return `${state[verb]} ${version}${secret(flagSecret)} in Secret Manager${where}`;
+    return `Runs \`gcloud secrets versions ${verb}\`${where}`;
+}
+/**
+ * `captured` = the variable the command's output is assigned to (`$tok = gcloud …`,
+ * `TOKEN=$(gcloud …)`): the output never reaches the terminal.
+ */
+function describeGcloud(toks, captured) {
     let i = 1;
     while (i < toks.length && toks[i].startsWith('-'))
         i++;
     if (/^(?:alpha|beta)$/.test(toks[i] || ''))
         i++;
+    if (toks[i] === 'secrets' && toks[i + 1] === 'versions') {
+        const project = flagValue(toks, '--project');
+        return describeSecretVersions(toks, i + 2, project ? ` in project ${project}` : '');
+    }
     const groups = [];
     let verb;
     for (; i < toks.length; i++) {
@@ -183,8 +220,10 @@ function describeGcloud(toks) {
         return `Reads the contents of ${isStorageUri(first) ? `an object in storage bucket ${bucketOf(first)}` : shortValue(first, 60)}`;
     if (verb === 'rm')
         return `Deletes ${named(first)}`;
-    if (/^print-(?:access|identity)-token$/.test(verb))
-        return 'Prints a cloud access token to the terminal';
+    if (/^print-(?:access|identity)-token$/.test(verb)) {
+        const kind = verb === 'print-identity-token' ? 'identity' : 'access';
+        return captured ? `Stores a cloud ${kind} token in variable ${captured}` : `Prints a cloud ${kind} token to the terminal`;
+    }
     if (verb === 'login')
         return 'Signs in to Google Cloud';
     if (verb === 'add-iam-policy-binding' || verb === 'remove-iam-policy-binding') {
@@ -234,7 +273,80 @@ function describePipeTail(stages) {
         return ', and writes the output to a file';
     return '';
 }
-function describeOne(segmentIn) {
+/**
+ * The whole statement is one quoted string (`"len=$($t.Length)"`, `'done'`): its text
+ * with each `$( … )` sub-expression shown as `…`. Undefined when it is anything else.
+ */
+function bareStringText(head) {
+    const value = head.trim();
+    const q = value[0];
+    if ((q !== '"' && q !== "'") || value.length < 2 || value[value.length - 1] !== q)
+        return undefined;
+    let depth = 0;
+    let text = '';
+    for (let k = 1; k < value.length - 1; k++) {
+        const ch = value[k];
+        if (q === '"' && ch === '`') {
+            text += value[++k] ?? '';
+            continue;
+        }
+        if (q === '"' && ch === '$' && value[k + 1] === '(') {
+            if (depth++ === 0)
+                text += '…';
+            k++;
+            continue;
+        }
+        if (depth > 0) {
+            if (ch === '(')
+                depth++;
+            else if (ch === ')')
+                depth--;
+            continue;
+        }
+        if (ch === q) {
+            if (q === "'" && value[k + 1] === "'") {
+                text += "'";
+                k++;
+                continue;
+            }
+            return undefined;
+        }
+        text += ch;
+    }
+    return depth === 0 ? text.trim() : undefined;
+}
+/** `((gcloud … $p) -join '').Trim()` -> `gcloud … $p`: the command inside nested groups (quote-aware). */
+function peelGroups(text) {
+    let value = text.trim();
+    for (let guard = 0; guard < 8 && value.startsWith('('); guard++) {
+        let depth = 0;
+        let end = -1;
+        let quote = '';
+        for (let k = 0; k < value.length; k++) {
+            const ch = value[k];
+            if (quote) {
+                if (ch === quote)
+                    quote = '';
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                quote = ch;
+                continue;
+            }
+            if (ch === '(')
+                depth++;
+            else if (ch === ')' && --depth === 0) {
+                end = k;
+                break;
+            }
+        }
+        if (end < 0)
+            break;
+        value = value.slice(1, end).trim();
+    }
+    return value;
+}
+function describeOne(segmentIn, captured) {
     const segment = segmentIn.trim();
     const [head, ...pipe] = splitPipe(segment);
     const tail = describePipeTail(pipe);
@@ -270,10 +382,19 @@ function describeOne(segmentIn) {
             }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
-        const inner = rhs.replace(/^\(\s*/, '').replace(/\)\s*(?:\.\w+\(\))*$/, '');
-        const innerStep = describeOne(inner);
+        const substituted = /^\$\((.*)\)$/s.exec(rhs) || /^`(.*)`$/s.exec(rhs);
+        const inner = substituted ? substituted[1].trim() : rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
+        const innerStep = describeOne(inner, name);
+        const printer = TOKEN_PRINTERS.find(p => p.re.test(inner));
+        if (printer) {
+            return { segment, text: shortValue(`${innerStep.text}${tail}`, MAX_LINE), known: innerStep.known, captures: { variable: name, ...(printer.issuer ? { issuer: printer.issuer } : {}) } };
+        }
         return { segment, text: shortValue(`Stores in ${name}: ${innerStep.text.charAt(0).toLowerCase()}${innerStep.text.slice(1)}${tail}`, MAX_LINE), known: innerStep.known };
     }
+    // A bare string statement: PowerShell writes it to the output (`"len=$($t.Length)"`).
+    const bare = bareStringText(head);
+    if (bare !== undefined)
+        return step(bare ? `Prints text: ${shortValue(bare, 80)}` : 'Prints an empty line');
     const toks = tokens(head);
     if (toks.length === 0)
         return step('(empty)', false);
@@ -308,7 +429,7 @@ function describeOne(segmentIn) {
         case 'exit':
         case 'return': return step('Ends the script');
         case 'gcloud': {
-            const text = describeGcloud(rest);
+            const text = describeGcloud(rest, captured);
             return text ? step(`${text}${redirectNote}`) : step(`Runs \`gcloud\``, false);
         }
         case 'gsutil': {
@@ -371,7 +492,7 @@ function describeOne(segmentIn) {
             if (/\b(?:create|edit|merge|close|delete|comment)\b/.test(sub))
                 return step(`Changes GitHub ${sub.split(' ')[0]} (${sub.split(' ')[1]})`);
             if (/^auth token\b/.test(sub))
-                return step('Prints the GitHub token');
+                return step(captured ? `Stores the GitHub token in variable ${captured}` : 'Prints the GitHub token');
             return step(`Runs \`gh ${sub}\``, false);
         }
         case 'npm':
@@ -531,7 +652,10 @@ function describeOne(segmentIn) {
         default:
             if (/^\$/.test(programToken))
                 return step(pipe.length ? `Uses ${shortValue(programToken, 40)}${tail}` : `Reads variable ${shortValue(programToken, 40)}`, false);
-            return step(`Runs \`${shortValue([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50)}\``, false);
+            {
+                const shown = shortValue([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50);
+                return step(shown ? `Runs \`${shown}\`` : 'Runs a command this dialog cannot describe', false);
+            }
     }
 }
 /** Split one step on top-level `|` (quote-aware). */
@@ -584,17 +708,59 @@ function resolveStorageVariables(steps) {
         return { ...step, text };
     });
 }
+/**
+ * A token stored in a variable, then used later on the line: name the host(s)
+ * that receive it and whether each is the token's issuer. Hosts are literal
+ * URLs in the using step, or a variable assigned a literal URL earlier.
+ */
+function noteTokenDestinations(steps) {
+    const urlVars = new Map();
+    for (const step of steps) {
+        const assign = /^\$?([\w:]+)\s*=\s*["']?https?:\/\/([^/\s"'`$]+)/i.exec(step.segment);
+        if (assign)
+            urlVars.set(assign[1].toLowerCase(), assign[2].toLowerCase());
+    }
+    return steps.map((step, index) => {
+        if (!step.captures)
+            return step;
+        const { variable, issuer } = step.captures;
+        const ref = new RegExp(`\\$\\{?${variable.replace(/[^\w:]/g, '')}\\}?(?![\\w])`, 'i');
+        const hosts = new Set();
+        for (const later of steps.slice(index + 1)) {
+            if (!ref.test(later.segment))
+                continue;
+            for (const m of later.segment.matchAll(/https?:\/\/([^/\s"'`<>]+)/gi))
+                if (!/[$({]/.test(m[1]))
+                    hosts.add(m[1].toLowerCase().replace(/:\d+$/, ''));
+            for (const m of later.segment.matchAll(/\$\{?([\w:]+)\}?/g)) {
+                const host = urlVars.get(m[1].toLowerCase());
+                if (host)
+                    hosts.add(host);
+            }
+        }
+        if (!hosts.size)
+            return step;
+        const described = [...hosts].sort().map(host => {
+            if (!issuer)
+                return host;
+            const own = issuer.domains.some(d => host === d || host.endsWith(`.${d}`));
+            return own ? `${host} (${issuer.name}, the token's issuer)` : `${host}, which is not ${issuer.name}`;
+        });
+        return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
+    });
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
     const steps = splitCommandSteps(command);
-    const out = resolveStorageVariables(steps.slice(0, MAX_STEPS).map(segment => {
+    const described = steps.map(segment => {
         try {
             return describeOne(segment);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };
         }
-    }));
+    });
+    const out = resolveStorageVariables(noteTokenDestinations(described).slice(0, MAX_STEPS));
     if (steps.length > MAX_STEPS)
         out.push({ segment: '', text: `… and ${steps.length - MAX_STEPS} more step${steps.length - MAX_STEPS === 1 ? '' : 's'}`, known: false });
     return out;

package/dist/commands/agentCi.js

@@ -216,6 +216,8 @@ function agentFileRemediation(tags) {
         fixes.push('remove inline secret/password/token references and use a managed secret store');
     if (tags.includes('jailbreak_hint'))
         fixes.push('remove jailbreak/bypass instructions and add hierarchy language that system and security policies win');
+    if (tags.includes('hooks_disabled'))
+        fixes.push('remove "disableAllHooks": true (or a managed "allowManagedHooksOnly": true) so Claude Code runs the Full Court Defense hook again');
     if (tags.includes('no_runtime_hook'))
         fixes.push('install the Full Court Defense hook/gateway so risky tool calls are checked before execution');
     if (fixes.length === 0)
@@ -266,7 +268,7 @@ function evaluateAgentGate(args) {
     }
     for (const file of agentFiles.filter(item => item.riskTags.length > 0)) {
         findings.push(finding({
-            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') ? 'high' : 'medium',
+            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') || file.riskTags.includes('hooks_disabled') ? 'high' : 'medium',
             category: 'agent-file',
             title: `Risky agent instruction: ${file.title}`,
             detail: `${file.filePath} contains agent risk tags: ${file.riskTags.join(', ')}.`,

package/dist/commands/daemon.js

@@ -526,6 +526,9 @@ async function runDaemon(args, config) {
             // of an OLDER version is the upgrade itself, not something to alarm on.
             log(`Previous daemon (v${postmortem.version}) was replaced by this upgrade to v${current} — the updater's forced stop is expected, not a crash. Post-mortem recorded for the timeline.`);
         }
+        else if (postmortem.cause === 'machine_restart') {
+            log(`Previous daemon (v${postmortem.version || '?'}) stopped when the machine restarted (booted ${postmortem.machineBootedAt || 'after its last heartbeat'}; last alive ${postmortem.lastAliveAt || 'unknown'}). Expected, not a crash. Post-mortem recorded for the timeline.`);
+        }
         else {
             log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
         }
@@ -1097,7 +1100,7 @@ async function runDaemon(args, config) {
         // whose enrolled fingerprint drifted can set FCD_MACHINE_ACTION_ANY_MACHINE_OK=1
         // locally while they re-enroll.
         const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
-        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId });
+        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId, apiUrl: creds.apiUrl });
         if (!verdict.ok) {
             log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
             await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` }, action.signature?.signature);
@@ -1505,6 +1508,8 @@ async function runDaemon(args, config) {
                         lastAliveAt: unreportedCrash.lastAliveAt,
                         detectedAt: unreportedCrash.detectedAt,
                         detectedBy: unreportedCrash.detectedBy,
+                        cause: unreportedCrash.cause,
+                        machineBootedAt: unreportedCrash.machineBootedAt,
                     }
                     : undefined,
             });
@@ -1593,7 +1598,7 @@ async function runDaemon(args, config) {
     // to full local evaluation whenever this server is down — never a blocker.
     let verdictServer;
     try {
-        verdictServer = (0, verdictIpc_1.startVerdictServer)((hookArgs, stdin) => (0, hook_1.evaluateHookRequest)(hookArgs, stdin, (0, config_1.loadConfig)()), log);
+        verdictServer = (0, verdictIpc_1.startVerdictServer)((hookArgs, stdin) => (0, hook_1.evaluateHookRequest)(hookArgs, stdin, (0, config_1.loadConfig)(), { viaDaemon: true }), log);
     }
     catch (error) {
         log(`Verdict IPC: failed to start (${error.message}) — hooks will evaluate locally.`);

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,5 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot' | 'agent_guard_tamper';
 /**
  * Per-rule enforcement action (org-configured, shipped in the Local Safety
  * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and