fullcourtdefense-cli 1.36.0 → 1.36.2

package/dist/commands/discoverPaths.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizedPath = normalizedPath;
 exports.pathIsWithin = pathIsWithin;
 exports.isExcludedPath = isExcludedPath;
+exports.truncationReason = truncationReason;
 exports.uniqueNormalizedPaths = uniqueNormalizedPaths;
 exports.compactScanRoots = compactScanRoots;
 exports.claudeDesktopMsixCandidates = claudeDesktopMsixCandidates;
@@ -67,6 +68,15 @@ function pathIsWithin(candidate, root) {
 function isExcludedPath(candidate, excludedRoots = []) {
     return excludedRoots.some(root => root.trim() && pathIsWithin(candidate, root));
 }
+function truncationReason(depthLimited, countLimited) {
+    if (depthLimited && countLimited)
+        return 'depth_and_count';
+    if (depthLimited)
+        return 'depth';
+    if (countLimited)
+        return 'count';
+    return undefined;
+}
 function uniqueNormalizedPaths(values) {
     const out = new Map();
     for (const value of values) {
@@ -353,7 +363,15 @@ function scanRootsForProjectConfigs(roots, options = {}) {
             queue.push({ dir: path.join(dir, name), depth: depth + 1 });
         }
     }
-    return { candidates, scannedDirs, excludedDirs, truncated: depthLimited || queue.length > 0, maxDepth, maxDirs };
+    return {
+        candidates,
+        scannedDirs,
+        excludedDirs,
+        truncated: depthLimited || queue.length > 0,
+        truncatedReason: truncationReason(depthLimited, queue.length > 0),
+        maxDepth,
+        maxDirs,
+    };
 }
 /** Non-dev home folders that only add noise to the console folder picker. */
 const CATALOG_SKIP_HOME_DIRS = new Set([

package/dist/commands/discoverProjectRoots.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Project folders the installed AI clients say the developer works in. A
+ * developer's real work often sits far below the home folder (OneDrive
+ * Desktop, nested client folders) with no `.cursor` / `.claude` directory in
+ * it, so the bounded home walk never reaches it. The clients' own project
+ * lists are the ground truth:
+ *
+ *   - Claude Code: `~/.claude.json` → `projects` keys, and the `cwd` recorded
+ *     in `~/.claude/projects/<encoded-path>/*.jsonl` (the folder name encoding
+ *     is lossy, so the recorded cwd is read instead of decoding the name);
+ *   - Cursor / VS Code: `User/workspaceStorage/<id>/workspace.json` `folder` URIs;
+ *   - Codex: `[projects."<path>"]` tables with `trust_level = "trusted"`.
+ *
+ * Only paths leave this module — never file contents. Every read is size-
+ * and count-capped; network shares, the home folder itself (and its
+ * ancestors), drive roots and operating-system folders are never returned.
+ */
+export type AiClientRootSource = 'claude_code_project' | 'cursor_workspace' | 'vscode_workspace' | 'codex_trusted_project';
+export interface AiClientProjectRoot {
+    path: string;
+    source: AiClientRootSource;
+}
+export interface AiClientProjectRootsResult {
+    roots: AiClientProjectRoot[];
+    stats: {
+        candidates: number;
+        skippedMissing: number;
+        skippedUnsafe: number;
+        skippedNetwork: number;
+        skippedDisabled: number;
+        capped: number;
+    };
+}
+export declare const AI_CLIENT_ROOT_LIMITS: {
+    maxRoots: number;
+    maxWorkspaceDirs: number;
+    maxClaudeTranscriptDirs: number;
+    transcriptHeadBytes: number;
+    maxSmallFileBytes: number;
+};
+/** True when a path is an operating-system folder (daemon/scheduled-task cwd), never a real project. */
+export declare function isOsSystemFolder(dir: string, platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): boolean;
+export declare function isNetworkPath(value: string): boolean;
+export declare function claudeTranscriptProjectRoots(home: string): string[];
+/** `folder` of each Cursor / VS Code workspace.json; multi-root and remote workspaces are skipped. */
+export declare function workspaceStorageRoots(storageDir: string): string[];
+/** `[projects."<path>"]` tables of a Codex config.toml whose `trust_level` is `trusted`. */
+export declare function codexTrustedProjectRoots(configToml: string): string[];
+/** Raw candidates per client, in client order (no filtering yet). */
+export declare function readAiClientProjectCandidates(home?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): Record<AiClientRootSource, string[]>;
+/**
+ * Filter + dedupe + cap the raw candidates. Round-robin across clients so one
+ * client with hundreds of old workspaces cannot crowd out the others.
+ */
+export declare function selectAiClientProjectRoots(candidates: Partial<Record<AiClientRootSource, string[]>>, options?: {
+    home?: string;
+    disabledRoots?: string[];
+    /** Network shares are skipped unless they sit inside one of these (admin-picked) roots. */
+    allowedNetworkRoots?: string[];
+    maxRoots?: number;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    isDirectory?: (dir: string) => boolean;
+}): AiClientProjectRootsResult;
+/** Read every installed AI client's project list and return the safe, existing roots. */
+export declare function collectAiClientProjectRoots(options?: {
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    disabledRoots?: string[];
+    allowedNetworkRoots?: string[];
+}): AiClientProjectRootsResult;

package/dist/commands/discoverProjectRoots.js

@@ -0,0 +1,327 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_CLIENT_ROOT_LIMITS = void 0;
+exports.isOsSystemFolder = isOsSystemFolder;
+exports.isNetworkPath = isNetworkPath;
+exports.claudeTranscriptProjectRoots = claudeTranscriptProjectRoots;
+exports.workspaceStorageRoots = workspaceStorageRoots;
+exports.codexTrustedProjectRoots = codexTrustedProjectRoots;
+exports.readAiClientProjectCandidates = readAiClientProjectCandidates;
+exports.selectAiClientProjectRoots = selectAiClientProjectRoots;
+exports.collectAiClientProjectRoots = collectAiClientProjectRoots;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const url_1 = require("url");
+const discoverAgentFiles_1 = require("./discoverAgentFiles");
+const discoverPaths_1 = require("./discoverPaths");
+exports.AI_CLIENT_ROOT_LIMITS = {
+    maxRoots: 50,
+    maxWorkspaceDirs: 300,
+    maxClaudeTranscriptDirs: 200,
+    transcriptHeadBytes: 64 * 1024,
+    maxSmallFileBytes: 256 * 1024,
+};
+/** True when a path is an operating-system folder (daemon/scheduled-task cwd), never a real project. */
+function isOsSystemFolder(dir, platform = process.platform, env = process.env) {
+    if (platform === 'win32') {
+        const normalized = path.win32.resolve(dir).toLowerCase();
+        const windir = (env.SystemRoot || 'C:\\Windows').toLowerCase();
+        return normalized === windir || normalized.startsWith(`${windir}\\`) || /^[a-z]:\\$/.test(normalized);
+    }
+    const normalized = path.posix.resolve(dir);
+    return normalized === '/' || ['/usr', '/bin', '/sbin', '/etc', '/var'].some(root => normalized === root || normalized.startsWith(`${root}/`));
+}
+/** Program and system data folders: never a developer project, and never worth a walk. */
+function isSystemLocation(dir, env, platform) {
+    if (isOsSystemFolder(dir, platform, env))
+        return true;
+    if (platform === 'win32') {
+        const programDirs = [env.ProgramFiles || 'C:\\Program Files', env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', env.ProgramData || 'C:\\ProgramData'];
+        return programDirs.some(root => (0, discoverPaths_1.pathIsWithin)(dir, root));
+    }
+    return ['/System', '/Library', '/Applications', '/opt/homebrew', '/proc', '/sys', '/dev'].some(root => (0, discoverPaths_1.pathIsWithin)(dir, root));
+}
+function isNetworkPath(value) {
+    return /^[\\/]{2}/.test(value);
+}
+function readSmallFile(file, maxBytes = exports.AI_CLIENT_ROOT_LIMITS.maxSmallFileBytes) {
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile() || stat.size > maxBytes)
+            return undefined;
+        return fs.readFileSync(file, 'utf8').replace(/^\uFEFF/, '');
+    }
+    catch {
+        return undefined;
+    }
+}
+function readHead(file, bytes) {
+    let fd;
+    try {
+        fd = fs.openSync(file, 'r');
+        const buffer = Buffer.alloc(bytes);
+        const read = fs.readSync(fd, buffer, 0, bytes, 0);
+        return buffer.subarray(0, read).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* ignore */ }
+    }
+}
+/** Subdirectories of `dir`, most recently modified first, at most `limit`. */
+function recentSubdirs(dir, limit) {
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const dirs = [];
+    for (const name of names) {
+        const full = path.join(dir, name);
+        try {
+            const stat = fs.statSync(full);
+            if (stat.isDirectory())
+                dirs.push({ full, mtime: stat.mtimeMs });
+        }
+        catch { /* vanished or unreadable */ }
+    }
+    return dirs.sort((a, b) => b.mtime - a.mtime).slice(0, limit).map(entry => entry.full);
+}
+/** The `cwd` Claude Code recorded in the newest session transcript of one project folder. */
+function claudeTranscriptCwd(projectDir) {
+    let newest;
+    try {
+        for (const name of fs.readdirSync(projectDir)) {
+            if (!name.endsWith('.jsonl'))
+                continue;
+            const file = path.join(projectDir, name);
+            const mtime = fs.statSync(file).mtimeMs;
+            if (!newest || mtime > newest.mtime)
+                newest = { file, mtime };
+        }
+    }
+    catch {
+        return undefined;
+    }
+    if (!newest)
+        return undefined;
+    const head = readHead(newest.file, exports.AI_CLIENT_ROOT_LIMITS.transcriptHeadBytes);
+    const match = head?.match(/"cwd"\s*:\s*("(?:\\.|[^"\\])*")/);
+    if (!match)
+        return undefined;
+    try {
+        const cwd = JSON.parse(match[1]);
+        return typeof cwd === 'string' && cwd ? cwd : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function claudeTranscriptProjectRoots(home) {
+    const out = [];
+    for (const dir of recentSubdirs(path.join(home, '.claude', 'projects'), exports.AI_CLIENT_ROOT_LIMITS.maxClaudeTranscriptDirs)) {
+        const cwd = claudeTranscriptCwd(dir);
+        if (cwd)
+            out.push(cwd);
+    }
+    return out;
+}
+/** `folder` of each Cursor / VS Code workspace.json; multi-root and remote workspaces are skipped. */
+function workspaceStorageRoots(storageDir) {
+    const out = [];
+    for (const dir of recentSubdirs(storageDir, exports.AI_CLIENT_ROOT_LIMITS.maxWorkspaceDirs)) {
+        const content = readSmallFile(path.join(dir, 'workspace.json'), 64 * 1024);
+        if (!content)
+            continue;
+        try {
+            const folder = JSON.parse(content)?.folder;
+            if (typeof folder !== 'string' || !/^file:\/\//i.test(folder))
+                continue;
+            out.push((0, url_1.fileURLToPath)(folder));
+        }
+        catch { /* malformed JSON or URI */ }
+    }
+    return out;
+}
+function parseTomlKey(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+        try {
+            return JSON.parse(trimmed);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (trimmed.startsWith("'") && trimmed.endsWith("'"))
+        return trimmed.slice(1, -1);
+    return trimmed || undefined;
+}
+/** `[projects."<path>"]` tables of a Codex config.toml whose `trust_level` is `trusted`. */
+function codexTrustedProjectRoots(configToml) {
+    const out = [];
+    let current;
+    let trusted = false;
+    const flush = () => { if (current && trusted)
+        out.push(current); };
+    for (const rawLine of configToml.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        if (line.startsWith('[')) {
+            flush();
+            const header = line.match(/^\[\s*projects\.((?:"(?:\\.|[^"\\])*")|(?:'[^']*'))\s*\]$/);
+            current = header ? parseTomlKey(header[1]) : undefined;
+            trusted = false;
+            continue;
+        }
+        if (!current)
+            continue;
+        const kv = line.match(/^trust_level\s*=\s*(.+?)\s*(?:#.*)?$/);
+        if (kv)
+            trusted = parseTomlKey(kv[1]) === 'trusted';
+    }
+    flush();
+    return out;
+}
+function appConfigDir(appName, home, env, platform) {
+    if (platform === 'win32')
+        return path.join(env.APPDATA || path.join(home, 'AppData', 'Roaming'), appName);
+    if (platform === 'darwin')
+        return path.join(home, 'Library', 'Application Support', appName);
+    return path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), appName);
+}
+/** Raw candidates per client, in client order (no filtering yet). */
+function readAiClientProjectCandidates(home = os.homedir(), env = process.env, platform = process.platform) {
+    const codexHome = env.CODEX_HOME || path.join(home, '.codex');
+    const codexConfig = readSmallFile(path.join(codexHome, 'config.toml'), 1024 * 1024);
+    return {
+        claude_code_project: [...(0, discoverAgentFiles_1.claudeProjectRoots)(home), ...claudeTranscriptProjectRoots(home)],
+        cursor_workspace: workspaceStorageRoots(path.join(appConfigDir('Cursor', home, env, platform), 'User', 'workspaceStorage')),
+        vscode_workspace: workspaceStorageRoots(path.join(appConfigDir('Code', home, env, platform), 'User', 'workspaceStorage')),
+        codex_trusted_project: codexConfig ? codexTrustedProjectRoots(codexConfig) : [],
+    };
+}
+const SOURCE_ORDER = ['claude_code_project', 'cursor_workspace', 'vscode_workspace', 'codex_trusted_project'];
+/**
+ * Filter + dedupe + cap the raw candidates. Round-robin across clients so one
+ * client with hundreds of old workspaces cannot crowd out the others.
+ */
+function selectAiClientProjectRoots(candidates, options = {}) {
+    const home = options.home ?? os.homedir();
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const maxRoots = options.maxRoots ?? exports.AI_CLIENT_ROOT_LIMITS.maxRoots;
+    const isDirectory = options.isDirectory ?? ((dir) => {
+        try {
+            return fs.statSync(dir).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+    const stats = { candidates: 0, skippedMissing: 0, skippedUnsafe: 0, skippedNetwork: 0, skippedDisabled: 0, capped: 0 };
+    const roots = [];
+    const seen = new Set();
+    const queues = SOURCE_ORDER.map(source => ({ source, items: [...(candidates[source] || [])] }));
+    const accept = (raw, source) => {
+        if (typeof raw !== 'string' || !raw.trim())
+            return;
+        const value = raw.trim();
+        if (!path.isAbsolute(value) && !isNetworkPath(value)) {
+            stats.skippedUnsafe += 1;
+            return;
+        }
+        const resolved = path.resolve(value);
+        const key = (0, discoverPaths_1.normalizedPath)(resolved);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        stats.candidates += 1;
+        if (isNetworkPath(value) && !(options.allowedNetworkRoots || []).some(root => (0, discoverPaths_1.pathIsWithin)(resolved, root))) {
+            stats.skippedNetwork += 1;
+            return;
+        }
+        // The home folder itself (or any ancestor, e.g. C:\Users) is already the default
+        // root; drive roots and system folders would turn a project walk into a disk walk.
+        if ((0, discoverPaths_1.pathIsWithin)(home, resolved) || path.parse(resolved).root === resolved || isSystemLocation(resolved, env, platform)) {
+            stats.skippedUnsafe += 1;
+            return;
+        }
+        if ((0, discoverPaths_1.isExcludedPath)(resolved, options.disabledRoots || [])) {
+            stats.skippedDisabled += 1;
+            return;
+        }
+        if (!isDirectory(resolved)) {
+            stats.skippedMissing += 1;
+            return;
+        }
+        if (roots.length >= maxRoots) {
+            stats.capped += 1;
+            return;
+        }
+        roots.push({ path: resolved, source });
+    };
+    while (queues.some(queue => queue.items.length > 0)) {
+        for (const queue of queues) {
+            const next = queue.items.shift();
+            if (next !== undefined)
+                accept(next, queue.source);
+        }
+    }
+    return { roots, stats };
+}
+/** Read every installed AI client's project list and return the safe, existing roots. */
+function collectAiClientProjectRoots(options = {}) {
+    const home = options.home ?? os.homedir();
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    try {
+        return selectAiClientProjectRoots(readAiClientProjectCandidates(home, env, platform), { ...options, home, env, platform });
+    }
+    catch {
+        return { roots: [], stats: { candidates: 0, skippedMissing: 0, skippedUnsafe: 0, skippedNetwork: 0, skippedDisabled: 0, capped: 0 } };
+    }
+}

package/dist/commands/discoverProxy.d.ts

@@ -36,7 +36,7 @@ export declare function extractServerMap(parsed: any): Record<string, any>;
  * Every entry named `serverName` across this machine's AI-client MCP configs
  * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
  * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
- * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * alias clients such as Codex expose (`contoso-bank` -> `contoso_bank`).
  * Unreadable / unparsable files are skipped, never thrown.
  */
 export declare function findClientMcpServers(serverName: string, cwd?: string, clientKey?: string): ProxyClassifiableServer[];

package/dist/commands/discoverProxy.js

@@ -108,7 +108,7 @@ function sanitizedServerAlias(name) {
  * Every entry named `serverName` across this machine's AI-client MCP configs
  * (Cursor, Claude Code incl. per-project maps in ~/.claude.json, Codex TOML,
  * VS Code, Windsurf, Gemini, ...). Matches the exact name or the sanitized
- * alias clients such as Codex expose (`patria-bank` -> `patria_bank`).
+ * alias clients such as Codex expose (`contoso-bank` -> `contoso_bank`).
  * Unreadable / unparsable files are skipped, never thrown.
  */
 function findClientMcpServers(serverName, cwd = process.cwd(), clientKey) {

package/dist/commands/discoverSecrets.d.ts

@@ -1,3 +1,4 @@
+import { type ScanTruncationReason } from './discoverPaths';
 export type SecretSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
 export type SecretCategory = 'env_file' | 'credential_store' | 'config' | 'shell_history' | 'ssh_key' | 'other';
 export interface SecretFinding {
@@ -26,16 +27,59 @@ export interface SecretsScanResult {
     stats?: {
         candidateFiles: number;
         excludedFiles: number;
+        cloudPlaceholdersSkipped?: number;
     };
     truncated?: {
         candidateFiles: boolean;
         findings: boolean;
     };
+    /** Which limit cut the candidate file walk short; absent when it finished. */
+    truncatedReasons?: {
+        candidateFiles?: ScanTruncationReason;
+    };
 }
+/**
+ * Whether ~/.docker/config.json holds credentials itself. `auths` entries that
+ * only name a registry are metadata when `credsStore` / `credHelpers` keep the
+ * secret in the OS store (Docker Desktop on Windows: `credsStore: desktop` =
+ * Windows Credential Manager). Counts only; never returns a value.
+ */
+export declare function dockerConfigCredentialFacts(content: string): {
+    inlineRegistries: number;
+    usesCredentialStore: boolean;
+};
+export declare function isCloudPlaceholderAttributes(attributes: number): boolean;
+/** True for paths inside a OneDrive folder (by env root or a "OneDrive…" path segment). */
+export declare function isCloudSyncedPath(filePath: string, env?: NodeJS.ProcessEnv): boolean;
+export type FileAttributeProbe = (files: string[]) => Array<number | undefined> | null;
+/**
+ * One PowerShell call reads the attributes of every candidate (no file is
+ * opened, so nothing is downloaded). Paths go in base64 on stdin so non-ASCII
+ * folder names survive the console code page; one integer per line comes back
+ * in input order. Returns null when PowerShell is unavailable or times out.
+ */
+export declare const probeWindowsFileAttributes: FileAttributeProbe;
+/**
+ * Drop OneDrive online-only placeholders before any read. Only files under a
+ * OneDrive folder are probed; a failed probe keeps every file (the per-file
+ * size cap still bounds what is read).
+ */
+export declare function dropCloudPlaceholders(files: string[], options?: {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    probe?: FileAttributeProbe;
+}): {
+    files: string[];
+    skipped: number;
+};
 export declare function scanSecrets(options?: {
     cwd?: string;
     maxEnvDepth?: number;
     extraRoots?: string[];
     disabledRoots?: string[];
     configFiles?: string[];
+    /** Test seams for the OneDrive placeholder check; production uses the real platform/env/probe. */
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    probeFileAttributes?: FileAttributeProbe;
 }): SecretsScanResult;