fullcourtdefense-cli 1.36.4 → 1.37.0

package/dist/detectorInThread.d.ts

@@ -0,0 +1,15 @@
+import type { DetectorArtifact } from './detectorArtifact';
+import { type DetectorFacts } from './detectorRuntime';
+/** Same contract as detectorModule.compileDetector: a callable detector with dispose(). */
+export declare function compileDetectorInThread(artifact: DetectorArtifact): ((tool: string, args: Record<string, any>) => DetectorFacts) & {
+    dispose(): void;
+};
+/**
+ * Resident daemon only: every detector this process compiles from now on
+ * (the bundled baseline, cached and downloaded updates) is compiled in-thread.
+ * Must run before the first detector is compiled — detectorUpdates activates
+ * the baseline when it loads — so index.ts runs it first (daemonDetectorBoot).
+ */
+export declare function useInThreadDetector(): boolean;
+/** For the heartbeat: whether this process's detector runs in-thread. */
+export declare function inThreadDetectorActive(): boolean;

package/dist/detectorInThread.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileDetectorInThread = compileDetectorInThread;
+exports.useInThreadDetector = useInThreadDetector;
+exports.inThreadDetectorActive = inThreadDetectorActive;
+const vm_1 = require("vm");
+const detectorRuntime_1 = require("./detectorRuntime");
+const detectionData_1 = require("./detectionData");
+/**
+ * The signed detector compiled on the CALLING thread, for the resident daemon.
+ *
+ * detectorModule.compileDetector runs the artifact in a Worker and answers
+ * each inference through Atomics.wait: up to 4 s at compile and 500 ms per
+ * inference with the daemon's only event loop blocked, and a single missed
+ * deadline retired the detector for the rest of the daemon's life (LPTX1110 ran
+ * 2.6 days without it while every fallback process had it — RC7). Inference
+ * itself takes well under a millisecond, so the daemon compiles the same
+ * artifact here instead: same VM context options, same URL bridge, same input
+ * JSON (`[tool, args, detectionData]`), same output JSON, so the facts are
+ * identical to the Worker's (drilled over the whole IDE corpus).
+ *
+ * detectorModule, detectorRuntime and detectorUpdates are byte-identical twins
+ * of backend modules and stay untouched: the daemon swaps the compile factory
+ * those modules call (useInThreadDetector), before the first detector loads.
+ * Revision selection, activation, persistence and status reporting are theirs.
+ */
+/** Largest detector result accepted, in bytes (the Worker's shared output buffer). */
+const MAX_OUTPUT_BYTES = 512 * 1024;
+const MAX_INPUT_BYTES = 256 * 1024;
+/** VM deadline per inference: the Worker's own in-VM bound. Wall time, so it also covers time descheduled by Windows. */
+const INFERENCE_TIMEOUT_MS = 250;
+/** Same contract as detectorModule.compileDetector: a callable detector with dispose(). */
+function compileDetectorInThread(artifact) {
+    const context = (0, vm_1.createContext)(Object.create(null), { codeGeneration: { strings: false, wasm: false } });
+    let evaluate;
+    try {
+        // Expose parsed scalar fields, not Node's host URL constructor or native
+        // exceptions. The wrapper and all values visible to code belong to the VM.
+        const makeUrl = new vm_1.Script('(parse => class URL { constructor(input, base) { const fields=JSON.parse(parse(String(input), base===undefined?undefined:String(base))); if(fields.error)throw new TypeError("Invalid URL"); Object.assign(this,fields); } toString(){return this.href;} })').runInContext(context, { timeout: 1000 });
+        context.URL = makeUrl((input, base) => {
+            try {
+                if (typeof input !== 'string' || input.length > 256 * 1024 || (base !== undefined && (typeof base !== 'string' || base.length > 256 * 1024)))
+                    return '{"error":true}';
+                const value = new URL(input, base);
+                const fields = {};
+                for (const key of ['href', 'origin', 'protocol', 'username', 'password', 'host', 'hostname', 'port', 'pathname', 'search', 'hash'])
+                    fields[key] = value[key];
+                return JSON.stringify(fields);
+            }
+            catch {
+                return '{"error":true}';
+            }
+        });
+        new vm_1.Script(artifact.code).runInContext(context, { timeout: 1000 });
+        new vm_1.Script('if(typeof FcdDetector?.inferToolContext!=="function")throw new Error("Missing export")').runInContext(context, { timeout: 1000 });
+        evaluate = new vm_1.Script('JSON.stringify(FcdDetector.inferToolContext(...JSON.parse(inputJson)))');
+    }
+    catch {
+        throw new Error('Detector initialization failed');
+    }
+    let stopped = false;
+    const dispose = () => { stopped = true; };
+    const invoke = (tool, args) => {
+        if (stopped)
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector worker unavailable');
+        const input = JSON.stringify([tool, args, (0, detectionData_1.getDetectionData)()]);
+        if (Buffer.byteLength(input) > MAX_INPUT_BYTES)
+            throw new Error('Detector input exceeds bound');
+        let text;
+        for (let attempt = 1;; attempt++) {
+            try {
+                context.inputJson = input;
+                text = evaluate.runInContext(context, { timeout: INFERENCE_TIMEOUT_MS });
+                break;
+            }
+            catch (error) {
+                // A missed deadline leaves this context intact (a Worker had to be
+                // terminated). The deadline is wall time, so a thread descheduled by a
+                // busy machine misses it on a sub-millisecond inference: run it once
+                // more. Twice is one failure, and the next action may use the detector
+                // again. (detectorRuntime never forgets failures and retires a
+                // detector at its third, for the daemon's whole life: a scheduling
+                // blip must not count.) Any other fault is a detector bug: retire it,
+                // as the Worker host does.
+                if (error?.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT') {
+                    if (attempt < 2)
+                        continue;
+                    throw new Error('Detector timed out');
+                }
+                dispose();
+                throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector failed');
+            }
+            finally {
+                delete context.inputJson;
+            }
+        }
+        if (typeof text !== 'string' || Buffer.byteLength(text) > MAX_OUTPUT_BYTES) {
+            dispose();
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector output invalid or too large');
+        }
+        return JSON.parse(text);
+    };
+    return Object.assign(invoke, { dispose });
+}
+let swapped = false;
+/**
+ * Resident daemon only: every detector this process compiles from now on
+ * (the bundled baseline, cached and downloaded updates) is compiled in-thread.
+ * Must run before the first detector is compiled — detectorUpdates activates
+ * the baseline when it loads — so index.ts runs it first (daemonDetectorBoot).
+ */
+function useInThreadDetector() {
+    if (swapped)
+        return true;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const host = require('./detectorModule');
+        host.compileDetector = compileDetectorInThread;
+        swapped = host.compileDetector === compileDetectorInThread;
+    }
+    catch {
+        swapped = false;
+    }
+    return swapped;
+}
+/** For the heartbeat: whether this process's detector runs in-thread. */
+function inThreadDetectorActive() {
+    return swapped;
+}

package/dist/distress.d.ts

@@ -70,6 +70,8 @@ export declare const DISTRESS: {
      * stale past the bound and the verdict pipe silent — and recycled it.
      */
     readonly DAEMON_HUNG: "daemon_hung";
+    /** Daemon alive and answering, but rejecting this profile's hooks: its token file was replaced. */
+    readonly IPC_NOT_SERVING: "ipc_not_serving";
     /**
      * The daemon exited itself after repeated uncaught exceptions in a short
      * window (process state suspect); the supervisor restarts it clean.

package/dist/distress.js

@@ -115,6 +115,8 @@ exports.DISTRESS = {
      * stale past the bound and the verdict pipe silent — and recycled it.
      */
     DAEMON_HUNG: 'daemon_hung',
+    /** Daemon alive and answering, but rejecting this profile's hooks: its token file was replaced. */
+    IPC_NOT_SERVING: 'ipc_not_serving',
     /**
      * The daemon exited itself after repeated uncaught exceptions in a short
      * window (process state suspect); the supervisor restarts it clean.

package/dist/fileWriteCanon.d.ts

@@ -37,6 +37,23 @@ export declare function addedLinesOnly(existing: string, content: string): strin
  * go through this, so every client yields the same canonical `content`.
  */
 export declare function newContentOnly(filePath: string | undefined, content: string): string;
+/** One target file as newContentOnly saw it when the hook ran (see above). */
+export type RecordedFileState = {
+    h: string;
+    l: string[];
+    w: string[];
+} | null;
+/** By path, exactly as the payload names it. */
+export type RecordedFileStates = Record<string, RecordedFileState>;
+/**
+ * Record, before the hook answers, every file a write in this payload targets
+ * (see above). undefined when the payload writes no file; null when it could
+ * not be recorded (the caller then evaluates the call itself). Reads each
+ * target once (as the full evaluation would); never throws.
+ */
+export declare function recordFileStates(payload: unknown): RecordedFileStates | undefined | null;
+/** Run a replay with the files as its hook recorded them (recordFileStates); without a record, as before. */
+export declare function withRecordedFileStates<T>(states: unknown, fn: () => T): T;
 /**
  * For a whole-file write tool (MCP `write_file`, …) with `{ path, content }`
  * arguments, replace `content` with only the added lines. Any other tool or

package/dist/fileWriteCanon.js

@@ -38,7 +38,11 @@ exports.canonicalToolName = canonicalToolName;
 exports.maskTokensAlreadyPresent = maskTokensAlreadyPresent;
 exports.addedLinesOnly = addedLinesOnly;
 exports.newContentOnly = newContentOnly;
+exports.recordFileStates = recordFileStates;
+exports.withRecordedFileStates = withRecordedFileStates;
 exports.canonicalizeFileWriteArgs = canonicalizeFileWriteArgs;
+const async_hooks_1 = require("async_hooks");
+const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 /**
  * Canonicalization of FILE WRITES before any policy decision.
@@ -118,11 +122,148 @@ function addedLinesOnly(existing, content) {
 function newContentOnly(filePath, content) {
     if (!filePath || !content)
         return content;
+    // A replay of a queued hook payload: the file as it was when the hook ran.
+    const recorded = recordedFileStates.getStore();
+    if (recorded && recorded.has(filePath)) {
+        const state = recorded.get(filePath);
+        return state ? newContentFromRecord(state, content) : content;
+    }
     const existing = readExisting(filePath);
     if (existing === undefined)
         return content;
     return maskTokensAlreadyPresent(existing, addedLinesOnly(existing, content));
 }
+const recordedFileStates = new async_hooks_1.AsyncLocalStorage();
+/** Keys a file write names its target by (mapBuiltinToolPayload, buildToolCall 'file', canonicalizeFileWriteArgs). */
+const FILE_PATH_KEYS = new Set(['file_path', 'notebook_path', 'path', 'filePath', 'target_file']);
+/** Keys a file write carries its text in, next to the path (same readers). */
+const FILE_CONTENT_KEYS = new Set(['content', 'contents', 'new_string', 'newString', 'newText', 'new_str', 'new_text', 'edits', 'new_source', 'code', 'text']);
+const MAX_RECORDED_FILES = 16;
+const MAX_PAYLOAD_DEPTH = 10;
+function digest(text) {
+    return crypto.createHash('sha256').update(text, 'utf8').digest('hex').slice(0, 32);
+}
+/** newContentOnly against a recorded file: the same reduction, asked of the record. */
+function newContentFromRecord(state, content) {
+    if (digest(content) === state.h)
+        return '';
+    const known = new Set(state.l);
+    const added = content.split(/\r?\n/).filter(line => {
+        const t = line.trim();
+        return t && !known.has(digest(t));
+    }).join('\n');
+    if (!added)
+        return added;
+    const present = new Set(state.w);
+    const credentialWord = new RegExp(`${CREDENTIAL_WORD_CLASS}{${CREDENTIAL_WORD_MIN},}`, 'g');
+    return added.replace(credentialWord, word => (present.has(digest(word)) ? exports.UNCHANGED_TOKEN_MARK : word));
+}
+/**
+ * Record, before the hook answers, every file a write in this payload targets
+ * (see above). undefined when the payload writes no file; null when it could
+ * not be recorded (the caller then evaluates the call itself). Reads each
+ * target once (as the full evaluation would); never throws.
+ */
+function recordFileStates(payload) {
+    try {
+        const targets = new Set();
+        const lines = new Set();
+        const visit = (value, depth) => {
+            if (depth > MAX_PAYLOAD_DEPTH)
+                return;
+            if (typeof value === 'string') {
+                for (const line of value.split(/\r?\n/))
+                    lines.add(line);
+                // A JSON-encoded argument object (Cursor's tool_input), read as the hook reads it.
+                const trimmed = value.trim();
+                if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+                    try {
+                        visit(JSON.parse(trimmed), depth + 1);
+                    }
+                    catch { /* plain text */ }
+                }
+                return;
+            }
+            if (Array.isArray(value)) {
+                for (const item of value)
+                    visit(item, depth + 1);
+                return;
+            }
+            if (!value || typeof value !== 'object')
+                return;
+            const record = value;
+            if (Object.keys(record).some(key => FILE_CONTENT_KEYS.has(key))) {
+                for (const key of FILE_PATH_KEYS) {
+                    if (typeof record[key] === 'string' && record[key])
+                        targets.add(record[key]);
+                }
+                if (Array.isArray(record.files)) {
+                    const joined = record.files.map(f => (typeof f === 'string' ? f : '')).filter(Boolean).join(', ');
+                    if (joined)
+                        targets.add(joined);
+                }
+            }
+            for (const item of Object.values(record))
+                visit(item, depth + 1);
+        };
+        visit(payload, 0);
+        if (targets.size === 0)
+            return undefined;
+        const credentialWord = new RegExp(`${CREDENTIAL_WORD_CLASS}{${CREDENTIAL_WORD_MIN},}`, 'g');
+        const words = new Set();
+        for (const line of lines)
+            for (const word of line.match(credentialWord) || [])
+                words.add(word);
+        const states = new Map();
+        for (const target of Array.from(targets).slice(0, MAX_RECORDED_FILES)) {
+            const existing = readExisting(target);
+            if (existing === undefined) {
+                states.set(target, null);
+                continue;
+            }
+            const known = new Set(existing.split(/\r?\n/).map(line => line.trim()).filter(Boolean));
+            const present = new Set(Array.from(words).filter(word => existing.includes(word)));
+            const l = new Set();
+            for (const line of lines) {
+                const t = line.trim();
+                if (t && known.has(t))
+                    l.add(digest(t));
+                // maskTokensAlreadyPresent, per line (a word never spans a line).
+                const masked = existing ? line.replace(credentialWord, word => (present.has(word) ? exports.UNCHANGED_TOKEN_MARK : word)) : line;
+                const mt = masked.trim();
+                if (masked !== line && mt && known.has(mt))
+                    l.add(digest(mt));
+            }
+            states.set(target, { h: digest(existing), l: Array.from(l), w: Array.from(present, digest) });
+        }
+        return Object.fromEntries(states);
+    }
+    catch {
+        return null;
+    }
+}
+/** A queued record read back: only well-formed entries (anything else is read from the disk, as before). */
+function recordedStatesMap(states) {
+    if (!states || typeof states !== 'object' || Array.isArray(states))
+        return undefined;
+    const map = new Map();
+    const strings = (v) => Array.isArray(v) && v.every(s => typeof s === 'string');
+    for (const [target, state] of Object.entries(states)) {
+        if (state === null) {
+            map.set(target, null);
+            continue;
+        }
+        const s = state;
+        if (s && typeof s === 'object' && typeof s.h === 'string' && strings(s.l) && strings(s.w))
+            map.set(target, { h: s.h, l: s.l, w: s.w });
+    }
+    return map.size ? map : undefined;
+}
+/** Run a replay with the files as its hook recorded them (recordFileStates); without a record, as before. */
+function withRecordedFileStates(states, fn) {
+    const map = recordedStatesMap(states);
+    return map ? recordedFileStates.run(map, fn) : fn();
+}
 /**
  * For a whole-file write tool (MCP `write_file`, …) with `{ path, content }`
  * arguments, replace `content` with only the added lines. Any other tool or

package/dist/gateReports.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Deferred gate reports — the audit of a native hook's block-mode local-first
+ * ALLOW (Codex, Gemini CLI, Windsurf, Kiro).
+ *
+ * That allow is reported to check-tool-call. The native process used to send
+ * the report fire-and-forget and stay alive until it settled: up to 4 s after
+ * its verdict on a stalled API, with the IDE waiting for the process to exit.
+ * The report also fed later decisions:
+ *   - any HTTP answer ended the gate-failure streak (policyGateHealth.ts),
+ *     which decides the 60 s fast-probe skip (inside it an org approval is
+ *     denied offline) and the fail-closed count;
+ *   - the server recorded the action in the agent's behavior baseline, whose
+ *     facts (tool.status, agent.baseline, toolArgs.mb1h) its later gate
+ *     verdicts read.
+ * The native process now exits with its verdict and queues the SAME request
+ * here, one file each (0600, under ~/.fullcourtdefense). It is sent off the
+ * verdict path, with the old semantics:
+ *   - by the detached flusher (drainSpool), and
+ *   - by the next evaluation that reads gate health or calls the gate, BEFORE
+ *     it does (settleGateReports below — the hook, the MCP gateway and the
+ *     HTTP gateway): the old report had landed before its process exited, so
+ *     before any later evaluation on this machine.
+ * Any HTTP answer → the streak ends (recordGateReportAnswered). A network
+ * failure → the allow is spooled ("gate report failed — spooled"), as before.
+ * A report is sent at most once: a deliverer claims it by an atomic rename.
+ *
+ * The queue is a user-writable directory: a file in it is DATA, never a
+ * destination or a credential. Where a report goes and with which key comes
+ * only from the configuration of the process that sends it (its sender: the
+ * hook's, the flusher's, the gateway's own enrollment — and for a resident
+ * gateway, the machine's enrollment its hooks use), each key only to the API
+ * URL configured with it. The file names one thing, the body's shield, and a
+ * report is sent only by a sender OF that shield: never with another shield's
+ * key, never to a URL the file names (an `apiUrl`, `shieldKey` or any other
+ * field in it is ignored). A report no sender of this process may send stays
+ * queued for its own shield's process; the flusher, the last deliverer,
+ * spools it (the spool uploads to its own configured endpoint). A 401/403
+ * answer (the server refused the report) also spools it: the allow is not
+ * lost. An entry that is not a well-formed report (schema, size, a decision
+ * time that disagrees with its name) is dropped unsent.
+ */
+/** The fire-and-forget report's timeout. */
+export declare const GATE_REPORT_TIMEOUT_MS = 4000;
+/**
+ * One queued report on disk, at most. A larger allow is spooled at once by the
+ * queueing hook; a larger file is not a report and is dropped unread.
+ */
+export declare const MAX_GATE_REPORT_BYTES: number;
+export interface QueuedGateReport<E = unknown> {
+    /** When the verdict was decided — the moment the report used to be sent. Equals the file name's prefix. */
+    decidedAt: number;
+    /**
+     * The exact check-tool-call body: a JSON object naming its shield
+     * (`shieldId`). Never the shield key: the sender adds its own.
+     */
+    body: string;
+    /** The spool record written when the report cannot be delivered (a `verdict` allow). */
+    fallback: E;
+}
+/**
+ * Configured credentials a process sends reports with: only reports of
+ * `shieldId`, only to `apiUrl`, only with `shieldKey`. Never built from the queue.
+ */
+export interface GateReportSender {
+    shieldId?: string;
+    apiUrl: string;
+    shieldKey?: string;
+}
+/** Queue one report. False when it could not be queued: the caller spools the allow instead. */
+export declare function queueGateReport(report: QueuedGateReport): boolean;
+/** Decision times of the reports not yet delivered (being sent included). */
+export declare function queuedGateReports(): number[];
+/** A report a flusher could send now: queued, or claimed by a deliverer that died. */
+export declare function hasQueuedGateReports(): boolean;
+/** Same check without blocking the caller's event loop (resident daemon timer). */
+export declare function hasQueuedGateReportsAsync(): Promise<boolean>;
+export interface DeliverGateReportsInput<E> {
+    /** This process's configured enrollment: the destination and key for reports of its shield. */
+    apiUrl: string;
+    shieldId?: string;
+    shieldKey?: string;
+    /**
+     * Resident gateways: the machine's enrollment (~/.fullcourtdefense.yml and
+     * the environment — what the hooks that queue reports resolve), for reports
+     * of that shield when the gateway runs for another one. Resolved from this
+     * process's configuration, never from the queue; called only when such a
+     * report is waiting.
+     */
+    machineSender?: () => GateReportSender | undefined;
+    /** Only reports decided at or after this time (default: all). */
+    decidedFrom?: number;
+    /** Also wait, bounded, for matching reports another live process is sending. */
+    waitForOthers?: boolean;
+    /** Network failure: the allow goes to the spool. */
+    spool: (fallback: E) => void;
+    /** The machine id for a body queued without one (the queueing process never reads it natively). */
+    machineId?: () => string | undefined;
+    /**
+     * A report of a shield no sender of this process serves: left queued for
+     * its own shield's process (default), or spooled — the flusher, the last
+     * deliverer.
+     */
+    unmatched?: 'leave' | 'spool';
+}
+export interface DeliverGateReportsResult {
+    answered: number;
+    failed: number;
+    /** Entries that were not well-formed reports: removed, never sent. */
+    dropped: number;
+}
+/**
+ * Send the queued reports (claimed by this call) in parallel, each with the
+ * old 4 s timeout. With `waitForOthers`, also wait until the matching reports
+ * other processes claimed are gone; the whole call stays within ~4.5 s.
+ */
+export declare function deliverGateReports<E>(input: DeliverGateReportsInput<E>): Promise<DeliverGateReportsResult>;
+export interface SettleGateReportsInput<E> {
+    /** The evaluation's configured enrollment: reports of its shield go here with its key. */
+    apiUrl: string;
+    shieldId?: string;
+    /** Resolved only when a report is queued. */
+    shieldKey?: string | (() => string | undefined);
+    /** Resident gateways: see DeliverGateReportsInput.machineSender. */
+    machineSender?: () => GateReportSender | undefined;
+    /** The caller calls the gate next unless it is recently down (fast-probe skip). */
+    forGateCall: boolean;
+    /** Network failure: the allow goes to the spool. */
+    spool: (fallback: E) => void;
+    machineId?: () => string | undefined;
+    /** Diagnostics, once per delivery round. */
+    onSettled?: (scope: 'streak' | 'baseline', outcome: DeliverGateReportsResult) => void;
+}
+/**
+ * Queued native allow reports used to be sent before those processes exited,
+ * i.e. before any later evaluation on this machine. An evaluation about to
+ * read gate health or call the gate lets them land first:
+ *   - reports decided after the streak's last failure: their answer may end
+ *     the streak (fast-probe skip, fail-closed count);
+ *   - `forGateCall` and the gate will be called: the rest too, since the
+ *     server's verdict reads the behavior baseline they feed.
+ * Bounded by the reports' own 4 s timeout; one readdir when none is queued.
+ * Never throws: the evaluation continues as it would have.
+ */
+export declare function settleGateReports<E>(input: SettleGateReportsInput<E>): Promise<void>;