fullcourtdefense-cli 1.35.9 → 1.35.10

package/dist/askDialog.js

@@ -141,8 +141,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         return { ...clean, resolution: 'ide' };
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
-    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits)
-        && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
+    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits) && (0, devConfirm_1.grantOffered)(envelope.scope);
     const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope, { policyId: envelope.policyId, policyName: envelope.policyName }) : undefined;
     const limitsLabel = allowAlways && grantLimits ? (0, devConfirm_1.describeGrantLimits)(grantLimits) : undefined;
     const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;

package/dist/callerEnv.d.ts

@@ -23,6 +23,16 @@ export declare function callerEnv(): NodeJS.ProcessEnv;
  * from the daemon. No snapshot (older client) = this process's env, as before.
  */
 export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+export declare const IDE_HOOK_TIMEOUT_MS = 90000;
+export declare const IDE_TIMEOUT_MARGIN_MS = 15000;
+export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
 /**

package/dist/callerEnv.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CALLER_ENV_KEYS = void 0;
+exports.IDE_TIMEOUT_MARGIN_MS = exports.IDE_HOOK_TIMEOUT_MS = exports.CALLER_ENV_KEYS = void 0;
 exports.snapshotCallerEnv = snapshotCallerEnv;
 exports.callerEnv = callerEnv;
 exports.withCallerEnv = withCallerEnv;
+exports.ideHookTimeoutMs = ideHookTimeoutMs;
+exports.ideWaitCutoff = ideWaitCutoff;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
 const async_hooks_1 = require("async_hooks");
@@ -66,6 +68,21 @@ function withCallerEnv(snapshot, fn) {
     }
     return requestEnv.run(env, fn);
 }
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+exports.IDE_HOOK_TIMEOUT_MS = 90_000;
+exports.IDE_TIMEOUT_MARGIN_MS = 15_000;
+function ideHookTimeoutMs(env = callerEnv()) {
+    const override = Number(env.FCD_HOOK_IDE_TIMEOUT_MS);
+    return override > 0 ? override : exports.IDE_HOOK_TIMEOUT_MS;
+}
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+function ideWaitCutoff(startedAt, ideTimeoutMs = ideHookTimeoutMs()) {
+    return startedAt + ideTimeoutMs - Math.min(exports.IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4);
+}
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
 function isCiEnvironment(env = callerEnv()) {
     return env.GITHUB_ACTIONS === 'true'

package/dist/commandNarrative.d.ts

@@ -20,6 +20,14 @@ export interface CommandStep {
     text: string;
     /** The grammar recognised the program and its verb. */
     known: boolean;
+    /** A credential stored in a variable by this step (`$tok = gcloud auth print-access-token`). */
+    captures?: {
+        variable: string;
+        issuer?: {
+            name: string;
+            domains: string[];
+        };
+    };
 }
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 export declare function splitCommandSteps(command: string): string[];

package/dist/commandNarrative.js

@@ -20,6 +20,12 @@ exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
+/** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
+const TOKEN_PRINTERS = [
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+(?:application-default\s+)?print-access-token\b/i, issuer: { name: 'Google', domains: ['googleapis.com'] } },
+    { re: /^gcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+print-identity-token\b/i },
+    { re: /^gh(?:\.exe)?\s+auth\s+token\b/i, issuer: { name: 'GitHub', domains: ['github.com', 'githubusercontent.com'] } },
+];
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 function splitCommandSteps(command) {
     const steps = [];
@@ -158,7 +164,11 @@ function describeSecretVersions(toks, verbAt, where) {
         return `${state[verb]} ${version}${secret(flagSecret)} in Secret Manager${where}`;
     return `Runs \`gcloud secrets versions ${verb}\`${where}`;
 }
-function describeGcloud(toks) {
+/**
+ * `captured` = the variable the command's output is assigned to (`$tok = gcloud …`,
+ * `TOKEN=$(gcloud …)`): the output never reaches the terminal.
+ */
+function describeGcloud(toks, captured) {
     let i = 1;
     while (i < toks.length && toks[i].startsWith('-'))
         i++;
@@ -210,8 +220,10 @@ function describeGcloud(toks) {
         return `Reads the contents of ${isStorageUri(first) ? `an object in storage bucket ${bucketOf(first)}` : shortValue(first, 60)}`;
     if (verb === 'rm')
         return `Deletes ${named(first)}`;
-    if (/^print-(?:access|identity)-token$/.test(verb))
-        return 'Prints a cloud access token to the terminal';
+    if (/^print-(?:access|identity)-token$/.test(verb)) {
+        const kind = verb === 'print-identity-token' ? 'identity' : 'access';
+        return captured ? `Stores a cloud ${kind} token in variable ${captured}` : `Prints a cloud ${kind} token to the terminal`;
+    }
     if (verb === 'login')
         return 'Signs in to Google Cloud';
     if (verb === 'add-iam-policy-binding' || verb === 'remove-iam-policy-binding') {
@@ -334,7 +346,7 @@ function peelGroups(text) {
     }
     return value;
 }
-function describeOne(segmentIn) {
+function describeOne(segmentIn, captured) {
     const segment = segmentIn.trim();
     const [head, ...pipe] = splitPipe(segment);
     const tail = describePipeTail(pipe);
@@ -370,8 +382,13 @@ function describeOne(segmentIn) {
             }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
-        const inner = rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
-        const innerStep = describeOne(inner);
+        const substituted = /^\$\((.*)\)$/s.exec(rhs) || /^`(.*)`$/s.exec(rhs);
+        const inner = substituted ? substituted[1].trim() : rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
+        const innerStep = describeOne(inner, name);
+        const printer = TOKEN_PRINTERS.find(p => p.re.test(inner));
+        if (printer) {
+            return { segment, text: shortValue(`${innerStep.text}${tail}`, MAX_LINE), known: innerStep.known, captures: { variable: name, ...(printer.issuer ? { issuer: printer.issuer } : {}) } };
+        }
         return { segment, text: shortValue(`Stores in ${name}: ${innerStep.text.charAt(0).toLowerCase()}${innerStep.text.slice(1)}${tail}`, MAX_LINE), known: innerStep.known };
     }
     // A bare string statement: PowerShell writes it to the output (`"len=$($t.Length)"`).
@@ -412,7 +429,7 @@ function describeOne(segmentIn) {
         case 'exit':
         case 'return': return step('Ends the script');
         case 'gcloud': {
-            const text = describeGcloud(rest);
+            const text = describeGcloud(rest, captured);
             return text ? step(`${text}${redirectNote}`) : step(`Runs \`gcloud\``, false);
         }
         case 'gsutil': {
@@ -475,7 +492,7 @@ function describeOne(segmentIn) {
             if (/\b(?:create|edit|merge|close|delete|comment)\b/.test(sub))
                 return step(`Changes GitHub ${sub.split(' ')[0]} (${sub.split(' ')[1]})`);
             if (/^auth token\b/.test(sub))
-                return step('Prints the GitHub token');
+                return step(captured ? `Stores the GitHub token in variable ${captured}` : 'Prints the GitHub token');
             return step(`Runs \`gh ${sub}\``, false);
         }
         case 'npm':
@@ -691,17 +708,59 @@ function resolveStorageVariables(steps) {
         return { ...step, text };
     });
 }
+/**
+ * A token stored in a variable, then used later on the line: name the host(s)
+ * that receive it and whether each is the token's issuer. Hosts are literal
+ * URLs in the using step, or a variable assigned a literal URL earlier.
+ */
+function noteTokenDestinations(steps) {
+    const urlVars = new Map();
+    for (const step of steps) {
+        const assign = /^\$?([\w:]+)\s*=\s*["']?https?:\/\/([^/\s"'`$]+)/i.exec(step.segment);
+        if (assign)
+            urlVars.set(assign[1].toLowerCase(), assign[2].toLowerCase());
+    }
+    return steps.map((step, index) => {
+        if (!step.captures)
+            return step;
+        const { variable, issuer } = step.captures;
+        const ref = new RegExp(`\\$\\{?${variable.replace(/[^\w:]/g, '')}\\}?(?![\\w])`, 'i');
+        const hosts = new Set();
+        for (const later of steps.slice(index + 1)) {
+            if (!ref.test(later.segment))
+                continue;
+            for (const m of later.segment.matchAll(/https?:\/\/([^/\s"'`<>]+)/gi))
+                if (!/[$({]/.test(m[1]))
+                    hosts.add(m[1].toLowerCase().replace(/:\d+$/, ''));
+            for (const m of later.segment.matchAll(/\$\{?([\w:]+)\}?/g)) {
+                const host = urlVars.get(m[1].toLowerCase());
+                if (host)
+                    hosts.add(host);
+            }
+        }
+        if (!hosts.size)
+            return step;
+        const described = [...hosts].sort().map(host => {
+            if (!issuer)
+                return host;
+            const own = issuer.domains.some(d => host === d || host.endsWith(`.${d}`));
+            return own ? `${host} (${issuer.name}, the token's issuer)` : `${host}, which is not ${issuer.name}`;
+        });
+        return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
+    });
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
     const steps = splitCommandSteps(command);
-    const out = resolveStorageVariables(steps.slice(0, MAX_STEPS).map(segment => {
+    const described = steps.map(segment => {
         try {
             return describeOne(segment);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };
         }
-    }));
+    });
+    const out = resolveStorageVariables(noteTokenDestinations(described).slice(0, MAX_STEPS));
     if (steps.length > MAX_STEPS)
         out.push({ segment: '', text: `… and ${steps.length - MAX_STEPS} more step${steps.length - MAX_STEPS === 1 ? '' : 's'}`, known: false });
     return out;

package/dist/commands/agentCi.js

@@ -216,6 +216,8 @@ function agentFileRemediation(tags) {
         fixes.push('remove inline secret/password/token references and use a managed secret store');
     if (tags.includes('jailbreak_hint'))
         fixes.push('remove jailbreak/bypass instructions and add hierarchy language that system and security policies win');
+    if (tags.includes('hooks_disabled'))
+        fixes.push('remove "disableAllHooks": true (or a managed "allowManagedHooksOnly": true) so Claude Code runs the Full Court Defense hook again');
     if (tags.includes('no_runtime_hook'))
         fixes.push('install the Full Court Defense hook/gateway so risky tool calls are checked before execution');
     if (fixes.length === 0)
@@ -266,7 +268,7 @@ function evaluateAgentGate(args) {
     }
     for (const file of agentFiles.filter(item => item.riskTags.length > 0)) {
         findings.push(finding({
-            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') ? 'high' : 'medium',
+            severity: file.riskTags.includes('allows_shell') || file.riskTags.includes('broad_filesystem') || file.riskTags.includes('hooks_disabled') ? 'high' : 'medium',
             category: 'agent-file',
             title: `Risky agent instruction: ${file.title}`,
             detail: `${file.filePath} contains agent risk tags: ${file.riskTags.join(', ')}.`,

package/dist/commands/daemon.js

@@ -526,6 +526,9 @@ async function runDaemon(args, config) {
             // of an OLDER version is the upgrade itself, not something to alarm on.
             log(`Previous daemon (v${postmortem.version}) was replaced by this upgrade to v${current} — the updater's forced stop is expected, not a crash. Post-mortem recorded for the timeline.`);
         }
+        else if (postmortem.cause === 'machine_restart') {
+            log(`Previous daemon (v${postmortem.version || '?'}) stopped when the machine restarted (booted ${postmortem.machineBootedAt || 'after its last heartbeat'}; last alive ${postmortem.lastAliveAt || 'unknown'}). Expected, not a crash. Post-mortem recorded for the timeline.`);
+        }
         else {
             log(`Previous daemon (v${postmortem.version || '?'}) died UNCLEANLY — last alive ${postmortem.lastAliveAt || 'unknown'}, no shutdown recorded. Likely killed externally (EDR/AV, OOM, or forced termination). Post-mortem recorded; reporting upstream.`);
         }
@@ -1097,7 +1100,7 @@ async function runDaemon(args, config) {
         // whose enrolled fingerprint drifted can set FCD_MACHINE_ACTION_ANY_MACHINE_OK=1
         // locally while they re-enroll.
         const localIdentity = (0, machineIdentity_1.getMachineIdentity)();
-        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId });
+        const verdict = (0, machineActionVerify_1.verifyMachineAction)(action, { localMachineId: localIdentity.machineId, apiUrl: creds.apiUrl });
         if (!verdict.ok) {
             log(`Remote action REJECTED: ${action.type} (${action.id}) — ${verdict.reason}`);
             await reportMachineAction(action.id, 'failed', { error: `Action verification failed: ${verdict.reason}` }, action.signature?.signature);
@@ -1505,6 +1508,8 @@ async function runDaemon(args, config) {
                         lastAliveAt: unreportedCrash.lastAliveAt,
                         detectedAt: unreportedCrash.detectedAt,
                         detectedBy: unreportedCrash.detectedBy,
+                        cause: unreportedCrash.cause,
+                        machineBootedAt: unreportedCrash.machineBootedAt,
                     }
                     : undefined,
             });

package/dist/commands/deterministicGuard.d.ts

@@ -1,5 +1,5 @@
 export type DeterministicDirection = 'request' | 'response';
-export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot';
+export type DeterministicCategory = 'sensitive_file' | 'metadata_ssrf' | 'credential_command' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration' | 'honeypot' | 'agent_guard_tamper';
 /**
  * Per-rule enforcement action (org-configured, shipped in the Local Safety
  * snapshot). Absent everywhere = 'block' — the only behavior older CLIs and