fullcourtdefense-cli 1.36.0 → 1.36.2

package/dist/commands/deterministicGuard.js

@@ -221,15 +221,6 @@ exports.DEFAULT_DISABLED_BUILT_INS = new Set([
     // IDE). Off by default — orgs opt in via the Local Safety console toggle,
     // which the runtime snapshot then applies on every machine.
     'contextual_secret',
-    // Cloud token printers / secret fetchers used constantly by LEGITIMATE
-    // deploy tooling and dev loops. Off by default; orgs with stricter posture
-    // opt in via the console. (The rarely-legitimate forms — gh auth token,
-    // git credential fill, keychain dumps — are ON by default.)
-    'gcloud_access_token_cmd',
-    'gcloud_secret_access_cmd',
-    'az_access_token_cmd',
-    'aws_secret_fetch_cmd',
-    'vault_read_cmd',
 ]);
 function evidence(value) {
     const compact = value.replace(/\s+/g, ' ').trim();
@@ -446,8 +437,18 @@ function isEnabled(itemId, options) {
  * the snapshot carries no explicit action for the item — an org override to
  * 'block' ships explicitly in the snapshot and wins. Keeps offline machines
  * and stale snapshots on the warn-first rollout instead of hard-blocking.
+ * The cloud token printers / secret fetchers are used constantly by
+ * legitimate deploy tooling and dev loops: recorded, never stopped, unless an
+ * org sets them to Ask / Block / Off (#1837).
  */
-const DEFAULT_WARN_BUILT_INS = new Set(['env_workspace']);
+const DEFAULT_WARN_BUILT_INS = new Set([
+    'env_workspace',
+    'gcloud_access_token_cmd',
+    'gcloud_secret_access_cmd',
+    'az_access_token_cmd',
+    'aws_secret_fetch_cmd',
+    'vault_read_cmd',
+]);
 /**
  * Items that ASK by default when the snapshot carries no action for them — a
  * snapshot built before the item existed (older backend) must not turn a new
@@ -683,8 +684,8 @@ function envFileClass(token) {
  * useless against them because the secret never comes from a watched file
  * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
  * rarely-legitimate-for-agents forms are on by default; cloud token printers
- * that legitimate deploy tooling uses constantly are strict (off by default,
- * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
+ * that legitimate deploy tooling uses constantly are strict (warn by default,
+ * see DEFAULT_WARN_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 exports.CREDENTIAL_COMMAND_RULES = [
     { itemId: 'gh_auth_token_cmd', categoryId: 'credential_commands', severity: 'critical', commands: ['gh'],
@@ -798,7 +799,9 @@ const RC_EXT = String.raw `(?:\.cmd|\.exe|\.ps1)?`;
 // Statement start, then transparent wrappers (`sudo`, `env X=1`, `cmd /c`, `bash -c "`, `pwsh -Command "`).
 const RC_START = String.raw `(?:^|[;&|(\n])\s*`;
 const RC_WRAPPERS = String.raw `(?:(?:(?:sudo|doas)(?:\s+-[a-z]+)*|env|nohup|time|exec|command|call|start|[a-z_][a-z0-9_]*=[^\s;&|]*|(?:ba|z|da|k)?sh\s+-l?c|cmd(?:\.exe)?\s+/[ck]|(?:powershell|pwsh)(?:\.exe)?(?:\s+-[a-z]+)*?\s+-c(?:ommand)?)\s+["']?)*`;
-const RC_PATH = String.raw `(?:[^\s;&|"']*[\\/])?`;
+// No `(` in the path: `(` is itself a statement start above, and a path class that
+// spans it re-scanned a whole `(((…` run from every `(` (quadratic, 8 KB ~0.2 s per rule).
+const RC_PATH = String.raw `(?:[^\s;&|"'(]*[\\/])?`;
 const RC_LAUNCHER = String.raw `(?:(?:npx|pnpx|bunx|uvx)${RC_EXT}|npm${RC_EXT}\s+(?:exec|x)|pnpm${RC_EXT}\s+(?:dlx|exec)|yarn${RC_EXT}\s+dlx|bun${RC_EXT}\s+x|uv${RC_EXT}\s+tool\s+run|pipx${RC_EXT}\s+run)`;
 // Launcher options (`-y`, `--package=x`, `-p x`, `--from x`); a value never starts with `-`.
 const RC_LAUNCHER_OPTIONS = String.raw `(?:\s+-{1,2}[a-z][\w-]*(?:=[^\s;&|]*)?(?:\s+[^\s;&|-][^\s;&|]*)?)*?`;
@@ -914,7 +917,7 @@ function canonicalRemoteLaunch(match) {
 // wipes the CONTAINER's workdir — routine build/image cleanup on a
 // docker-heavy fleet — not the developer's machine, so it must never warn or
 // stall. Root targets (`/`, `/*`) stay blocked even inside containers (the
-// Patria case: an agent nuking a running container's filesystem).
+// Contoso case: an agent nuking a running container's filesystem).
 const CONTAINER_EXEC_BEFORE = /\b(?:docker|podman|nerdctl|kubectl)(?:\.exe)?\s+(?:compose\s+)?(?:exec|run)\b[^;&|]*$/i;
 let shellAstProvider;
 let shellAstMode = 'shadow';
@@ -947,10 +950,10 @@ const AST_TRANSPARENT_WRAPPERS = new Set(['sudo', 'doas', 'pkexec', 'run0', 'gos
  * of `bash -c` / `docker run … sh -c` are included; inside a container a bare
  * `*` is the container workdir (cleanup), the root `/` is still the root.
  */
-function astDestructiveRm(facts, inContainer = false) {
+function astDestructiveRm(facts, inContainer = false, text = '') {
     for (const command of facts.commands) {
         if (command.wrapper?.inner) {
-            const hit = astDestructiveRm(command.wrapper.inner, inContainer || command.wrapper.kind === 'container');
+            const hit = astDestructiveRm(command.wrapper.inner, inContainer || command.wrapper.kind === 'container', text);
             if (hit)
                 return hit;
         }
@@ -1014,7 +1017,8 @@ function astDestructiveRm(facts, inContainer = false) {
             if (/^(?:\*|\.\/+\*)$/.test(t)) {
                 if (inContainer || command.cwdScope === 'scoped')
                     continue;
-                return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
+                // Wording from the `cd` before the removal, as on the regex path.
+                return bareStarRemoval(text.slice(0, Math.max(0, text.toLowerCase().lastIndexOf('rm '))));
             }
         }
     }
@@ -1028,9 +1032,12 @@ const RM_SCOPE_ITEMS = new Set(['rm_rf_root', 'rm_rf_home']);
  * a regex false positive or adding a structurally proven hit the regex missed —
  * while every other destructive rule keeps its regex verdict.
  */
-function destructiveCommandDecision(value) {
+function destructiveCommandDecision(value, commandContext) {
     const regexHit = destructiveCommandReason(value);
-    if (shellAstMode === 'off' || !shellAstProvider)
+    // Text outside a command position (file content, a search query, a path) is
+    // gated out of destructive findings by scanBuiltInRules, so a parse cannot
+    // change its verdict; the bash grammar is super-linear on long non-shell text.
+    if (shellAstMode === 'off' || !shellAstProvider || !commandContext)
         return regexHit;
     let facts;
     try {
@@ -1040,7 +1047,7 @@ function destructiveCommandDecision(value) {
         facts = undefined;
     }
     const complete = shellAstFactsFullyComplete(facts);
-    const astHit = complete && facts ? astDestructiveRm(facts) : undefined;
+    const astHit = complete && facts ? astDestructiveRm(facts, false, value) : undefined;
     const regexRm = regexHit && RM_SCOPE_ITEMS.has(regexHit.itemId) ? regexHit.itemId : undefined;
     lastShellAstComparison = { mode: shellAstMode, complete, regex: regexRm, ast: astHit?.itemId, agree: !complete || regexRm === astHit?.itemId };
     if (shellAstMode !== 'primary' || !complete)
@@ -1061,6 +1068,34 @@ function destructiveCommandDecision(value) {
 // Every `cd <target>` statement start (cwd persists across `&&`, `;`, `|`,
 // newlines and `then`/`do`); the caller keeps the LAST one before the `rm`.
 const CD_STATEMENT = /(?:^|[;&|\n(]|\bthen\b|\bdo\b)\s*cd\s+(?:--\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/gi;
+/** The directory the LAST `cd` before this point changed into (dequoted, `/` separators); undefined when none applies. */
+function lastCdTarget(before) {
+    let last = null;
+    CD_STATEMENT.lastIndex = 0;
+    for (let m = CD_STATEMENT.exec(before); m; m = CD_STATEMENT.exec(before))
+        last = m;
+    if (!last)
+        return undefined;
+    // A `)` after the cd closes a subshell: `(cd x && …); rm -rf *` runs the rm
+    // back in the ORIGINAL directory, which the cd never changed.
+    if (before.slice(last.index + last[0].length).includes(')'))
+        return undefined;
+    const target = last[1].replace(/^["']|["']$/g, '').trim().replace(/\\/g, '/');
+    return target || undefined;
+}
+/**
+ * The finding for a bare `rm -rf *` that is not scoped: it wipes the CURRENT
+ * folder — the filesystem root or the home folder only when a `cd` said so.
+ * Wording only; the item (and so the verdict) is `rm_rf_root` in every case.
+ */
+function bareStarRemoval(before) {
+    const target = (lastCdTarget(before) || '').toLowerCase();
+    if (/^(?:\/+\*?|[a-z]:\/*\*?)$/.test(target))
+        return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+    if (/^(?:~\/*\*?|\$home\/?|\$\{home\}\/?|%userprofile%\/?|\$env:userprofile\/?)$/.test(target))
+        return { itemId: 'rm_rf_root', reason: 'recursive force delete of the home directory' };
+    return { itemId: 'rm_rf_root', reason: 'recursive force delete of everything in the current folder (rm -rf *)' };
+}
 /**
  * Bare `rm -rf *` wipes whatever the CURRENT directory is. When the same
  * script has already `cd`'d into a scoped directory — a literal subpath such
@@ -1072,17 +1107,7 @@ const CD_STATEMENT = /(?:^|[;&|\n(]|\bthen\b|\bdo\b)\s*cd\s+(?:--\s+)?("[^"]*"|'
  * conservative reading: the agent's cwd is usually the project.
  */
 function cdScopedBeforeBareStar(before) {
-    let last = null;
-    CD_STATEMENT.lastIndex = 0;
-    for (let m = CD_STATEMENT.exec(before); m; m = CD_STATEMENT.exec(before))
-        last = m;
-    if (!last)
-        return false;
-    // A `)` after the cd closes a subshell: `(cd x && …); rm -rf *` runs the rm
-    // back in the ORIGINAL directory, which the cd never changed.
-    if (before.slice(last.index + last[0].length).includes(')'))
-        return false;
-    const target = last[1].replace(/^["']|["']$/g, '').trim().replace(/\\/g, '/');
+    const target = lastCdTarget(before);
     if (!target)
         return false;
     const lower = target.toLowerCase();
@@ -1176,9 +1201,8 @@ function destructiveCommandReason(value, opts = {}) {
             const bareStars = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/g;
             for (let bareStar = bareStars.exec(lower); bareStar; bareStar = bareStars.exec(lower)) {
                 const before = lower.slice(0, bareStar.index);
-                if (!CONTAINER_EXEC_BEFORE.test(before) && !cdScopedBeforeBareStar(before)) {
-                    return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
-                }
+                if (!CONTAINER_EXEC_BEFORE.test(before) && !cdScopedBeforeBareStar(before))
+                    return bareStarRemoval(before);
             }
         }
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
@@ -1322,8 +1346,16 @@ function isCommandContext(toolName, candidate) {
         || COMMAND_KEYS.has(lastKey) || COMMAND_KEYS.has(candidate.keyPath);
 }
 function isSqlContext(toolName, candidate) {
+    if (SQL_TOOL_HINT.test(toolName))
+        return true;
     const lastKey = candidate.keyPath.split('.').pop() || '';
-    return SQL_TOOL_HINT.test(toolName) || SQL_KEYS.has(lastKey) || SQL_KEYS.has(candidate.keyPath);
+    // A search / list tool's `query` is the text it looks for (`list_issues {
+    // query: "… drop schema …" }`), not a statement it runs; `sql` still runs.
+    const nameWords = toolName.toLowerCase().replace(/[_\-.]+/g, ' ');
+    if (lastKey === 'query' && /\b(?:search|grep|find|lookup|locate|list)\b/.test(nameWords)
+        && !/\b(?:delete|remove|drop|write|update|insert|replace|create)\b/.test(nameWords))
+        return false;
+    return SQL_KEYS.has(lastKey) || SQL_KEYS.has(candidate.keyPath);
 }
 function isWebLookupTarget(toolName, candidate) {
     return WEB_LOOKUP_TOOL_HINT.test(toolName) && candidate.keyPath.split('.').pop() === 'ref_id';
@@ -1368,10 +1400,13 @@ function isPowerShellBacktickEscape(text, i, quote) {
         return true;
     return quote === null && /["'$\s]/.test(text[i + 1]);
 }
-function splitUnquotedCommandSegments(command) {
+/** Unquoted statements (`;`, newline, `&&`, `||`), each split into its single-`|` pipeline stages. */
+function splitUnquotedPipelines(command) {
     const out = [];
+    let stages = [];
     let cur = '';
     let quote = null;
+    const endStatement = () => { stages.push(cur); out.push(stages); stages = []; cur = ''; };
     for (let i = 0; i < command.length; i++) {
         const c = command[i];
         if (isPowerShellBacktickEscape(command, i, quote)) {
@@ -1394,29 +1429,35 @@ function splitUnquotedCommandSegments(command) {
             continue;
         }
         if (c === '\n' || c === ';') {
-            out.push(cur);
-            cur = '';
+            endStatement();
             continue;
         }
         if (c === '&' && command[i + 1] === '&') {
-            out.push(cur);
-            cur = '';
+            endStatement();
             i += 1;
             continue;
         }
         if (c === '|') {
-            if (command[i + 1] === '|')
+            if (command[i + 1] === '|') {
+                endStatement();
                 i += 1;
-            out.push(cur);
+                continue;
+            }
+            stages.push(cur);
             cur = '';
             continue;
         }
         cur += c;
     }
     if (cur)
-        out.push(cur);
+        stages.push(cur);
+    if (stages.length)
+        out.push(stages);
     return out;
 }
+function splitUnquotedCommandSegments(command) {
+    return [].concat(...splitUnquotedPipelines(command));
+}
 /** True when every segment that mentions a metadata endpoint is a searcher, not a client. */
 function commandOnlySearchesMetadata(command) {
     if (!containsMetadataEndpoint(command))
@@ -1475,7 +1516,7 @@ function isSensitivePathContext(toolName, candidate) {
 //      remote executor earlier in the same statement) are kept.
 //   5. Secret-literal rules and honeypot/custom rules never use this view —
 //      a token pasted into a commit message still leaks.
-const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|\|\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
 // A LANGUAGE interpreter's `-c` / `-e` argument is CODE in another language, not
 // a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
 // `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
@@ -1566,20 +1607,93 @@ function unquotedCode(text) {
     }
     return out;
 }
+/**
+ * `text.replace(/OPEN[\s\S]*?CLOSE/g, fn)` in one pass: the lazy regex re-scans
+ * to the end from every OPEN once no CLOSE follows (quadratic on a long body of
+ * unclosed `@'`); once no CLOSE remains, no later OPEN can match either.
+ */
+function replaceDelimited(text, open, close, fn) {
+    let out = '';
+    let from = 0;
+    for (;;) {
+        const start = text.indexOf(open, from);
+        if (start < 0)
+            break;
+        const end = text.indexOf(close, start + open.length);
+        if (end < 0)
+            break;
+        out += text.slice(from, start) + fn(text.slice(start, end + close.length));
+        from = end + close.length;
+    }
+    return out + text.slice(from);
+}
+const LINE_TERMINATOR = new Set(['\n', '\r', '\u2028', '\u2029']);
+/**
+ * `src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, fn)` in one
+ * pass, same matches and callback arguments (a PowerShell backtick escapes any
+ * character inside double quotes). After an unclosed quote the regex retried
+ * every later quote of that kind; each one before the dead end is the tail of an
+ * escape pair and walks the same path to the same dead end (quadratic on a body
+ * of `\"`).
+ */
+function replaceQuotedSpans(src, fn) {
+    const deadUntil = { '"': -1, "'": -1 };
+    let out = '';
+    let from = 0;
+    let i = 0;
+    while (i < src.length) {
+        const quote = src[i];
+        if ((quote !== '"' && quote !== "'") || i < deadUntil[quote]) {
+            i++;
+            continue;
+        }
+        let j = i + 1;
+        let closed = -1;
+        while (j < src.length) {
+            const c = src[j];
+            if (c === quote) {
+                closed = j;
+                break;
+            }
+            if (c === '`' && quote === '"') {
+                if (j + 1 >= src.length)
+                    break;
+                j += 2;
+                continue;
+            }
+            if (c === '\\') {
+                if (j + 1 >= src.length || LINE_TERMINATOR.has(src[j + 1]))
+                    break;
+                j += 2;
+                continue;
+            }
+            j++;
+        }
+        if (closed < 0) {
+            deadUntil[quote] = j;
+            i++;
+            continue;
+        }
+        const body = src.slice(i + 1, closed);
+        out += src.slice(from, i) + fn(src.slice(i, closed + 1), quote === '"' ? body : undefined, quote === "'" ? body : undefined, i);
+        from = i = closed + 1;
+    }
+    return out + src.slice(from);
+}
 function stripInertDataSegments(text) {
     if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
         return text;
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
-    out = out.replace(/@'[\s\S]*?'@/g, INERT_DATA);
-    out = out.replace(/@"[\s\S]*?"@/g, m => (m.includes('$(') ? m : INERT_DATA));
+    out = replaceDelimited(out, "@'", "'@", () => INERT_DATA);
+    out = replaceDelimited(out, '@"', '"@', m => (m.includes('$(') ? m : INERT_DATA));
     // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
     out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
     out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
-    out = src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
+    out = replaceQuotedSpans(src, (whole, dq, sq, offset) => {
         const body = dq !== undefined ? dq : (sq || '');
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
@@ -1881,7 +1995,7 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
         if (finding)
             return { ...finding, remoteControl: remoteBridge.facts };
     }
-    const destructive = destructiveCommandDecision(value);
+    const destructive = destructiveCommandDecision(value, commandContext);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
     }
@@ -1942,7 +2056,22 @@ function redirectTargets(segment) {
         out.push(match[2]);
     return out;
 }
-function isFcdUninstall(program, rest) {
+const MSI_PRODUCT_CODE_RE = /^\{?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\}?/i;
+/** `msiexec /x <target>` whose target is a FullCourtDefense package path/name or the recorded FCD ProductCode. */
+function msiexecRemovesFcd(argText, productCodes) {
+    const at = argText.match(/(?:^|[\s,'"])[/-](?:x|uninstall)(?=[\s,'"{]|$)/i);
+    if (!at || at.index === undefined)
+        return false;
+    const target = argText.slice(at.index + at[0].length).replace(/^[\s,'"]+/, '').split(/[\s,'"]+[/-][a-z]/i)[0];
+    if (/fullcourtdefense/i.test(target))
+        return true;
+    const guid = target.match(MSI_PRODUCT_CODE_RE);
+    if (!guid)
+        return false;
+    const code = guid[1].toLowerCase();
+    return productCodes.some(recorded => (recorded.match(MSI_PRODUCT_CODE_RE)?.[1] || '').toLowerCase() === code);
+}
+function isFcdUninstall(program, rest, productCodes = []) {
     let prog = program;
     let args = rest;
     if (prog === 'npx' || prog === 'pnpx' || prog === 'bunx') {
@@ -1956,9 +2085,11 @@ function isFcdUninstall(program, rest) {
         return args.some(token => /^(?:uninstall|remove|rm|r|un|unlink)$/i.test(token))
             && args.some(token => /^fullcourtdefense-cli(?:@|$)/i.test(token));
     }
-    if (prog === 'msiexec') {
-        const at = args.findIndex(token => /^[/-](?:x|uninstall)$/i.test(token));
-        return at >= 0 && /fullcourtdefense/i.test(args[at + 1] || '');
+    if (prog === 'msiexec')
+        return msiexecRemovesFcd(args.join(' '), productCodes);
+    if (prog === 'start-process' || prog === 'saps' || prog === 'start') {
+        const at = args.findIndex(token => /^(?:.*[\\/])?msiexec(?:\.exe)?$/i.test(token));
+        return at >= 0 && msiexecRemovesFcd(args.slice(at + 1).join(' '), productCodes);
     }
     if (prog === 'schtasks') {
         if (!args.some(token => /^[/-](?:delete|disable)$/i.test(token)))
@@ -2025,18 +2156,51 @@ function optionValues(args, named, skipNamed) {
     }
     return out;
 }
+const PROCESS_SOURCE_PROGRAMS = new Set(['get-process', 'gps', 'ps', 'get-ciminstance', 'gcim', 'get-wmiobject', 'gwmi', 'pgrep', 'get-package']);
+const PROCESS_STOP_PROGRAMS = new Set(['stop-process', 'spps', 'kill', 'uninstall-package']);
+const EACH_STOP_RE = /\b(?:stop-process|spps|taskkill|kill|uninstall-package)\b|\.(?:kill|terminate)\s*\(/i;
+/** A filter that EXCLUDES FullCourtDefense (`-notlike '*FullCourtDefense*'`, `grep -v fullcourtdefense`) selects other processes. */
+const NEGATED_FCD_FILTER_RE = /-(?:notlike|notmatch|ne|notcontains|notin)\s+['"]?[^\s'"}|]*fullcourtdefense[^\s'"}|]*['"]?|\b(?:grep|findstr)\s+(?:-[a-z]*\s+)*-[a-z]*[v][a-z]*\s+(?:-[a-z]+\s+)*['"]?[^\s'"|]*fullcourtdefense[^\s'"|]*['"]?|\/v\s+['"]?[^\s'"|]*fullcourtdefense[^\s'"|]*['"]?/gi;
+function stageSelectsFcd(stage) {
+    return /fullcourtdefense/i.test(stage.replace(NEGATED_FCD_FILTER_RE, ' '));
+}
+/**
+ * Pipeline view: a stop/uninstall stage fed by a process (or package) source
+ * whose upstream stages select FullCourtDefense by name or path, e.g.
+ * `Get-Process | Where-Object { $_.Path -like '*FullCourtDefense*' } | Stop-Process`.
+ * The per-segment view sees a bare `Stop-Process` there.
+ */
+function fcdPipelineStop(stages) {
+    if (stages.length < 2)
+        return false;
+    const programs = stages.map(stage => segmentProgram(segmentTokens(stage.trim())));
+    if (!PROCESS_SOURCE_PROGRAMS.has(programs[0].program))
+        return false;
+    for (let i = 1; i < stages.length; i++) {
+        const { program, rest } = programs[i];
+        const stops = PROCESS_STOP_PROGRAMS.has(program)
+            || (program === 'invoke-cimmethod' && rest.some(token => /^(?:terminate|uninstall)$/i.test(token)))
+            || ((program === 'foreach-object' || program === '%' || program === 'foreach' || program === 'xargs') && EACH_STOP_RE.test(stages[i]));
+        if (stops && stages.slice(0, i).some(stageSelectsFcd))
+            return true;
+    }
+    return false;
+}
 /**
  * Shell view: per unquoted segment, the leading program decides. Quoted prose
  * (commit messages, issue bodies, echo text) is removed before redirections
  * and off-switch keys are judged, so writing ABOUT the setting never matches.
  */
-function hookConfigShellChange(command) {
+function hookConfigShellChange(command, productCodes = []) {
+    if (splitUnquotedPipelines(command).some(fcdPipelineStop)) {
+        return { itemId: 'fcd_uninstalled_by_agent', reason: 'agent stopping FullCourtDefense processes' };
+    }
     for (const rawSegment of splitUnquotedCommandSegments(command)) {
         const raw = rawSegment.trim();
         if (!raw)
             continue;
         const { program, rest } = segmentProgram(segmentTokens(raw));
-        if (isFcdUninstall(program, rest)) {
+        if (isFcdUninstall(program, rest, productCodes)) {
             return { itemId: 'fcd_uninstalled_by_agent', reason: 'agent removing FullCourtDefense from this machine' };
         }
         const stripped = stripInertDataSegments(raw);
@@ -2094,7 +2258,7 @@ function agentGuardTamperFinding(toolName, candidates, options) {
     for (const candidate of candidates) {
         if (!isCommandContext(toolName, candidate))
             continue;
-        const hit = hookConfigShellChange(candidate.value);
+        const hit = hookConfigShellChange(candidate.value, options?.fcdProductCodes);
         const found = hit && finding(hit, candidate.value);
         if (found)
             return found;

package/dist/commands/discover.js

@@ -45,6 +45,7 @@ const discoverProxy_1 = require("./discoverProxy");
 const discoverSchedule_1 = require("./discoverSchedule");
 const mcpGateway_1 = require("./mcpGateway");
 const discoverPaths_1 = require("./discoverPaths");
+const discoverProjectRoots_1 = require("./discoverProjectRoots");
 const runtimeConfig_1 = require("../runtimeConfig");
 const knownMcpServers_1 = require("./knownMcpServers");
 const discoverAgentFiles_1 = require("./discoverAgentFiles");
@@ -130,15 +131,6 @@ function buildHostMetadata(userEmail, probeMode = 'config') {
 function candidateConfigPaths(cwd, extra) {
     return (0, discoverPaths_1.discoverScanTargets)(cwd, extra);
 }
-/** True when a path is an operating-system folder (daemon/scheduled-task cwd), never a real project. */
-function isOsSystemFolder(dir) {
-    const normalized = path.resolve(dir).toLowerCase();
-    if (process.platform === 'win32') {
-        const windir = (process.env.SystemRoot || 'C:\\Windows').toLowerCase();
-        return normalized === windir || normalized.startsWith(`${windir}${path.sep}`) || /^[a-z]:\\$/.test(normalized);
-    }
-    return normalized === '/' || ['/usr', '/bin', '/sbin', '/etc', '/var'].some(root => normalized === root || normalized.startsWith(`${root}/`));
-}
 /** Dot-dirs that hold a client's project config; the real project root is their parent. */
 const CONFIG_DOT_DIRS = new Set(['.cursor', '.claude', '.codex', '.vscode', '.gemini', '.kiro']);
 /** Map discovered project config file paths back to their owning project folders. */
@@ -844,7 +836,7 @@ async function discoverCommand(args, config) {
     // meaningless and confusing in the dashboard scan-scope report — fall back to
     // the user's home, which is where all the AI-dev roots we scan live anyway.
     const rawCwd = process.cwd();
-    const cwd = isOsSystemFolder(rawCwd) ? os.homedir() : rawCwd;
+    const cwd = (0, discoverProjectRoots_1.isOsSystemFolder)(rawCwd) ? os.homedir() : rawCwd;
     const runMcp = surfaces.has('mcp');
     const scanned = [];
     let found = [];
@@ -865,10 +857,18 @@ async function discoverCommand(args, config) {
         .filter(root => !isDisabledRoot(root));
     const sweep = scanRoots.length > 0
         ? (0, discoverPaths_1.scanRootsForProjectConfigs)(scanRoots, { excludedRoots: normalizedDisabledRoots })
-        : { candidates: [], scannedDirs: 0, excludedDirs: 0, truncated: false, maxDepth: 4, maxDirs: 25000 };
+        : { candidates: [], scannedDirs: 0, excludedDirs: 0, truncated: false, truncatedReason: undefined, maxDepth: 4, maxDirs: 25000 };
     // Admin roots are scanned for env/secrets even when no MCP config lives there.
     const sweepProjectRoots = (0, discoverPaths_1.compactScanRoots)([...deriveProjectRoots(sweep.candidates), ...adminScanRoots])
         .filter(root => !isDisabledRoot(root));
+    // Folders the AI clients themselves list as projects. Kept separate from the
+    // compacted roots on purpose: each is walked from its own top level, so a
+    // project nested deeper than the home walk's depth limit is still covered.
+    const aiClientRoots = surfaces.has('secrets') || surfaces.has('posture') || surfaces.has('agent-files')
+        ? (0, discoverProjectRoots_1.collectAiClientProjectRoots)({ disabledRoots: normalizedDisabledRoots, allowedNetworkRoots: adminScanRoots })
+        : { roots: [], stats: { candidates: 0, skippedMissing: 0, skippedUnsafe: 0, skippedNetwork: 0, skippedDisabled: 0, capped: 0 } };
+    const aiClientRootPaths = aiClientRoots.roots.map(root => root.path);
+    const postureProjectRoots = (0, discoverPaths_1.uniqueNormalizedPaths)([...sweepProjectRoots, ...aiClientRootPaths]);
     const knownConfigCandidates = candidateConfigPaths(cwd, args.extraPath)
         .filter(candidate => !isDisabledRoot(candidate.path));
     const secretConfigFiles = [...knownConfigCandidates, ...sweep.candidates]
@@ -917,10 +917,10 @@ async function discoverCommand(args, config) {
         }
     }
     const secrets = surfaces.has('secrets') || surfaces.has('posture')
-        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: sweepProjectRoots, disabledRoots: normalizedDisabledRoots, configFiles: secretConfigFiles })
+        ? (0, discoverSecrets_1.scanSecrets)({ cwd, extraRoots: postureProjectRoots, disabledRoots: normalizedDisabledRoots, configFiles: secretConfigFiles })
         : undefined;
     const agentFileScan = surfaces.has('agent-files') || surfaces.has('posture')
-        ? (0, discoverAgentFiles_1.scanAgentFilesWithMetadata)({ cwd, extraRoots: sweepProjectRoots, disabledRoots: normalizedDisabledRoots })
+        ? (0, discoverAgentFiles_1.scanAgentFilesWithMetadata)({ cwd, extraRoots: postureProjectRoots, disabledRoots: normalizedDisabledRoots })
         : undefined;
     const agentFiles = agentFileScan?.findings;
     // Fail-open: an unreadable IDE folder drops the extension inventory (the
@@ -960,6 +960,13 @@ async function discoverCommand(args, config) {
     ];
     const compactedScannedPaths = (0, discoverPaths_1.compactScanRoots)(scannedRootCandidates.map(entry => entry.path));
     const scannedRoots = compactedScannedPaths.map(root => scannedRootCandidates.find(entry => path.resolve(entry.path).toLowerCase() === path.resolve(root).toLowerCase()));
+    const listedRootKeys = new Set(scannedRoots.map(root => (0, discoverPaths_1.normalizedPath)(root.path)));
+    for (const root of aiClientRoots.roots) {
+        if (listedRootKeys.has((0, discoverPaths_1.normalizedPath)(root.path)))
+            continue;
+        listedRootKeys.add((0, discoverPaths_1.normalizedPath)(root.path));
+        scannedRoots.push({ path: root.path, source: root.source });
+    }
     // Shallow folder tree for the console folder picker (names only, no contents).
     const folderCatalog = surfaces.has('posture') || surfaces.has('secrets')
         ? (0, discoverPaths_1.buildFolderCatalog)({ extraRoots: adminScanRoots })
@@ -986,6 +993,9 @@ async function discoverCommand(args, config) {
                 `Credential stores and shell history under ${home}`,
                 `Environment files under ${cwd}, ${path.join(home, 'dev')}, ${path.join(home, 'repos')}, ${path.join(home, 'projects')}, ${path.join(home, 'Documents')}, and ${path.join(home, 'code')}`,
                 ...adminScanRoots.map(root => `Admin-selected folder: ${root} (bounded descendant scan; exclusions and limits below)`),
+                ...(aiClientRoots.roots.length > 0
+                    ? [`Project folders listed by the AI clients on this machine (Claude Code, Cursor, VS Code, Codex): ${aiClientRoots.roots.length}, each scanned from its own top level within the same limits`]
+                    : []),
             ],
             excluded: [
                 'Unrelated project folders outside the listed roots',
@@ -998,6 +1008,7 @@ async function discoverCommand(args, config) {
             limits: {
                 projectMaxDepth: sweep.maxDepth,
                 projectMaxDirectories: sweep.maxDirs,
+                secretMaxDepth: secrets?.limits?.maxDepth,
                 secretMaxFileBytes: secrets?.limits?.maxFileBytes,
                 secretMaxCandidateFiles: secrets?.limits?.maxEnvFiles,
                 secretMaxFindings: secrets?.limits?.maxFindings,
@@ -1010,8 +1021,12 @@ async function discoverCommand(args, config) {
             stats: {
                 projectDirectoriesScanned: sweep.scannedDirs,
                 projectConfigsFound: sweep.candidates.length,
-                projectRootsFound: sweepProjectRoots.length,
+                projectRootsFound: postureProjectRoots.length,
+                aiClientProjectRootsFound: aiClientRoots.roots.length,
+                aiClientProjectRootsSkipped: aiClientRoots.stats.skippedMissing + aiClientRoots.stats.skippedUnsafe
+                    + aiClientRoots.stats.skippedNetwork + aiClientRoots.stats.skippedDisabled + aiClientRoots.stats.capped,
                 rootsScanned: scannedRoots.length,
+                cloudPlaceholdersSkipped: secrets?.stats?.cloudPlaceholdersSkipped ?? 0,
                 secretCandidateFilesScanned: secrets?.scannedFiles ?? 0,
                 secretFindingsFound: secrets?.findings.length ?? 0,
                 secretFindingsUploaded: secrets?.findings.length ?? 0,
@@ -1026,6 +1041,14 @@ async function discoverCommand(args, config) {
                 agentFiles: agentFileScan?.truncated ?? false,
                 ideExtensions: ideExtensions?.truncated ?? false,
             },
+            // Which limit stopped each list (`depth` vs `count`); `truncated` above stays for old consoles.
+            truncatedReasons: Object.fromEntries(Object.entries({
+                projectDirectories: sweep.truncatedReason,
+                secretCandidates: secrets?.truncatedReasons?.candidateFiles,
+                secretFindings: secrets?.truncated?.findings ? 'count' : undefined,
+                agentFiles: agentFileScan?.truncatedReason,
+                ideExtensions: ideExtensions?.truncated ? 'count' : undefined,
+            }).filter(([, reason]) => reason !== undefined)),
         },
     };
     async function maybeUpload() {

package/dist/commands/discoverAgentFiles.d.ts

@@ -1,3 +1,4 @@
+import { type ScanTruncationReason } from './discoverPaths';
 export type AgentFileKind = 'rules' | 'skills' | 'instructions' | 'hooks' | 'memory' | 'other';
 export interface AgentFileFinding {
     id: string;
@@ -22,6 +23,7 @@ export interface AgentFilesScanResult {
         excludedPaths: number;
     };
     truncated: boolean;
+    truncatedReason?: ScanTruncationReason;
 }
 export type ClaudeHooksOffSwitch = 'disableAllHooks' | 'allowManagedHooksOnly';
 /**

package/dist/commands/discoverAgentFiles.js

@@ -444,6 +444,7 @@ function scanAgentFilesWithMetadata(options = {}) {
         limits: { maxFiles: MAX_FILES, maxFileBytes: MAX_FILE_BYTES, maxDepth: 4 },
         stats: { scannedFiles: out.length, excludedPaths: stats.excludedPaths },
         truncated: stats.depthLimited || out.length >= MAX_FILES,
+        truncatedReason: (0, discoverPaths_1.truncationReason)(stats.depthLimited, out.length >= MAX_FILES),
     };
 }
 /** Backward-compatible findings-only API used by existing callers/tests. */

package/dist/commands/discoverPaths.d.ts

@@ -13,6 +13,9 @@ export declare function normalizedPath(value: string): string;
 /** True for the excluded root itself and every descendant (segment-safe). */
 export declare function pathIsWithin(candidate: string, root: string): boolean;
 export declare function isExcludedPath(candidate: string, excludedRoots?: string[]): boolean;
+/** Why a bounded walk stopped early: its depth limit, its file/folder cap, or both. */
+export type ScanTruncationReason = 'depth' | 'count' | 'depth_and_count';
+export declare function truncationReason(depthLimited: boolean, countLimited: boolean): ScanTruncationReason | undefined;
 export declare function uniqueNormalizedPaths(values: string[]): string[];
 /**
  * Keep only the shallowest non-overlapping scan roots. If C:\dev is present,
@@ -50,6 +53,7 @@ export declare function scanRootsForProjectConfigs(roots: string[], options?: {
     scannedDirs: number;
     excludedDirs: number;
     truncated: boolean;
+    truncatedReason?: ScanTruncationReason;
     maxDepth: number;
     maxDirs: number;
 };