fullcourtdefense-cli 1.6.12 → 1.6.14

package/dist/commands/hook.js

@@ -39,6 +39,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const deterministicGuard_1 = require("./deterministicGuard");
+const taintLedger_1 = require("./taintLedger");
 const DEBUG_LOG = path.join(os.homedir(), '.fullcourtdefense-hook.log');
 /** Append a diagnostic line so we can see exactly what Cursor invoked + the verdict. */
 function dbg(obj) {
@@ -400,6 +401,9 @@ async function hookCommand(args, config) {
         dbg({ phase: 'prompt_text', textLen: text.length, textPreview: text.slice(0, 300) });
         if (!text)
             respond(false);
+        // Record the developer's prompt so taint-tracking can later tell whether a
+        // sensitive action (network/git) was actually requested by the human.
+        (0, taintLedger_1.recordUserPrompt)(sessionId(payload), text);
         const localBlock = (0, deterministicGuard_1.scanDeterministicPrompt)(text);
         if (localBlock) {
             dbg({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
@@ -436,6 +440,24 @@ async function enforceActionPolicy(ctx) {
         respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this ${event} locally (${localBlock.ruleId}). Do not retry.`);
         return;
     }
+    // --- Deterministic taint tracking (local, no backend) ---
+    // Evaluate the sink against the PRIOR ledger state first, BEFORE this event
+    // records its own ingress (so a lone remote pull doesn't self-taint then
+    // self-block). Reads / web / MCP output are never blocked here — only a
+    // sensitive sink the user never requested, after untrusted ingestion.
+    const sessId = sessionId(payload);
+    const taintFinding = (0, taintLedger_1.checkTaintedSink)(sessId, event, call.toolName, call.toolArgs);
+    if (taintFinding) {
+        dbg({ phase: 'local_taint_block', event, tool: call.toolName, ruleId: taintFinding.ruleId, sink: taintFinding.sink.kind, targets: taintFinding.sink.targets });
+        if (shadow) {
+            respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${taintFinding.reason}`);
+            return;
+        }
+        respond(true, `Blocked by FullCourtDefense taint guard — ${taintFinding.reason}`, `FullCourtDefense blocked this ${event} locally (${taintFinding.ruleId}): ${taintFinding.reason} Do not retry.`);
+        return;
+    }
+    // Record untrusted ingress for this event (never blocks).
+    (0, taintLedger_1.noteIngress)(sessId, event, call.toolName, call.toolArgs);
     const headers = { 'Content-Type': 'application/json' };
     if (shieldKey)
         headers['x-shield-key'] = shieldKey;

package/dist/commands/restartNotice.js

@@ -2,108 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.printRestartNotice = printRestartNotice;
 exports.promptRestartNotice = promptRestartNotice;
-const child_process_1 = require("child_process");
 function printRestartNotice(clients = 'Cursor, Claude, Codex, VS Code, Windsurf, Gemini') {
     console.log('');
     console.log('\x1b[33m\x1b[1mACTION REQUIRED: restart your AI clients\x1b[0m');
     console.log(`\x1b[33mRestart/reload ${clients} so they load the protected MCP gateway and hooks.\x1b[0m`);
     console.log('\x1b[2mAlready-running MCP servers may keep using old unprotected processes until the client restarts.\x1b[0m');
-}
-function shouldPrompt() {
-    if (!process.stdin.isTTY || !process.stdout.isTTY)
-        return false;
-    if (process.env.CI === 'true' || process.env.FCD_NO_RESTART_PROMPT === 'true')
-        return false;
-    return true;
-}
-function parseJsonArray(raw) {
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return [];
-    const parsed = JSON.parse(trimmed);
-    const rows = Array.isArray(parsed) ? parsed : [parsed];
-    return rows
-        .map((row) => row)
-        .map((row) => ({
-        pid: Number(row.ProcessId || row.pid),
-        name: String(row.Name || row.name || ''),
-        executablePath: typeof row.ExecutablePath === 'string' ? row.ExecutablePath : undefined,
-    }))
-        .filter((row) => Number.isFinite(row.pid) && row.pid > 0 && row.name);
-}
-function detectWindowsClients() {
-    const script = [
-        "$names=@('Cursor.exe','Claude.exe','Code.exe','Windsurf.exe');",
-        'Get-CimInstance Win32_Process |',
-        'Where-Object { $names -contains $_.Name } |',
-        'Select-Object ProcessId,Name,ExecutablePath |',
-        'ConvertTo-Json -Compress',
-    ].join(' ');
-    try {
-        return parseJsonArray((0, child_process_1.execFileSync)('powershell.exe', ['-NoProfile', '-Command', script], { encoding: 'utf8' }));
-    }
-    catch {
-        return [];
-    }
-}
-function detectRestartableClients() {
-    if (process.platform === 'win32')
-        return detectWindowsClients();
-    return [];
-}
-async function askRestart(clients) {
-    const names = [...new Set(clients.map(client => client.name.replace(/\.exe$/i, '')))].join(', ');
-    return new Promise((resolve) => {
-        process.stdout.write(`\n\x1b[1mRestart detected AI clients now (${names})? Press r then Enter to restart, or Enter to skip.\x1b[0m `);
-        process.stdin.resume();
-        process.stdin.once('data', (chunk) => {
-            process.stdin.pause();
-            resolve(String(chunk).trim().toLowerCase() === 'r');
-        });
-    });
-}
-async function restartWindowsClients(clients) {
-    const launchPaths = [...new Set(clients.map(client => client.executablePath).filter((value) => !!value))];
-    for (const client of clients) {
-        try {
-            (0, child_process_1.execFileSync)('taskkill.exe', ['/PID', String(client.pid), '/T', '/F'], { stdio: 'ignore' });
-        }
-        catch {
-            // The process may already be gone.
-        }
-    }
-    await new Promise(resolve => setTimeout(resolve, 1200));
-    for (const exePath of launchPaths) {
-        try {
-            const child = (0, child_process_1.spawn)(exePath, [], { detached: true, stdio: 'ignore' });
-            child.unref();
-            console.log(`Restarted ${exePath}`);
-        }
-        catch (error) {
-            console.log(`Could not restart ${exePath}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-}
-async function restartClients(clients) {
-    if (process.platform === 'win32') {
-        await restartWindowsClients(clients);
-        return;
-    }
-    console.log('Automatic restart is not supported on this OS yet. Please restart your AI clients manually.');
+    console.log('\x1b[2mClose and reopen each client you use, then run: fullcourtdefense discover --surface mcp\x1b[0m');
 }
 async function promptRestartNotice(clients = 'Cursor, Claude, Codex, VS Code, Windsurf, Gemini') {
     printRestartNotice(clients);
-    if (!shouldPrompt())
-        return;
-    const runningClients = detectRestartableClients();
-    if (runningClients.length === 0) {
-        console.log('\n\x1b[2mNo running GUI AI clients detected. Start them again to load protection.\x1b[0m');
-        return;
-    }
-    if (await askRestart(runningClients)) {
-        await restartClients(runningClients);
-    }
-    else {
-        console.log('Skipped automatic restart. Protection applies after you restart/reload the clients.');
-    }
 }

package/dist/commands/taintLedger.d.ts

@@ -0,0 +1,58 @@
+export type TaintSourceType = 'mcp_output' | 'web_fetch' | 'external_file' | 'remote_pull';
+export interface TaintSource {
+    type: TaintSourceType;
+    detail: string;
+    at: string;
+}
+export interface TaintLedger {
+    sessionId: string;
+    tainted: boolean;
+    sources: TaintSource[];
+    userPrompts: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface TaintSink {
+    kind: 'network' | 'git_push' | 'git_remote_add' | 'mcp_outbound';
+    /** External hosts/destinations referenced by the action. */
+    targets: string[];
+    detail: string;
+}
+export interface TaintFinding {
+    blocked: true;
+    ruleId: string;
+    reason: string;
+    evidence: string;
+    source: TaintSource;
+    sink: TaintSink;
+}
+/** Whether taint tracking is enabled (opt-out via env). */
+export declare function taintEnabled(): boolean;
+export declare function loadLedger(sessionId: string): TaintLedger;
+/** Record the developer's prompt text so sink actions can be checked against it. */
+export declare function recordUserPrompt(sessionId: string, text: string): void;
+/** Mark the session as having ingested untrusted content. Reading is never blocked. */
+export declare function markTaint(sessionId: string, source: TaintSource): void;
+type EventKind = 'prompt' | 'shell' | 'mcp' | 'file' | 'read' | 'unknown';
+/** Extract hostnames from any URLs / git/scp targets present in a string. */
+export declare function extractHosts(text: string): string[];
+/**
+ * Classify an event as untrusted INGRESS. Returns the source to record, or
+ * undefined if this event does not ingest untrusted content.
+ */
+export declare function classifyIngress(event: EventKind, toolName: string, toolArgs: Record<string, unknown>, workspacePath?: string): TaintSource | undefined;
+/**
+ * Detect whether an event is a SENSITIVE SINK (an action that can exfiltrate or
+ * reach attacker-controlled infrastructure). Returns sink info or undefined.
+ */
+export declare function detectSink(event: EventKind, toolName: string, toolArgs: Record<string, unknown>): TaintSink | undefined;
+/**
+ * The deterministic 3-rule check, evaluated against the CURRENT ledger state
+ * (call this BEFORE recording any ingress for the same event):
+ *
+ *   block IF  session.tainted  AND  is_sensitive_sink  AND  NOT user_authorized
+ */
+export declare function checkTaintedSink(sessionId: string, event: EventKind, toolName: string, toolArgs: Record<string, unknown>): TaintFinding | undefined;
+/** Record ingress for an event if applicable. Safe to call on every event. */
+export declare function noteIngress(sessionId: string, event: EventKind, toolName: string, toolArgs: Record<string, unknown>, workspacePath?: string): TaintSource | undefined;
+export {};

package/dist/commands/taintLedger.js

@@ -0,0 +1,370 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taintEnabled = taintEnabled;
+exports.loadLedger = loadLedger;
+exports.recordUserPrompt = recordUserPrompt;
+exports.markTaint = markTaint;
+exports.extractHosts = extractHosts;
+exports.classifyIngress = classifyIngress;
+exports.detectSink = detectSink;
+exports.checkTaintedSink = checkTaintedSink;
+exports.noteIngress = noteIngress;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Deterministic taint tracking for local IDE coding agents.
+ *
+ * Models indirect prompt injection as an information-flow problem, the same way
+ * Microsoft FIDES / Tessera / ShisaD do — but local and zero-backend. The idea:
+ *
+ *   1. INGRESS  — when the agent reads UNTRUSTED content (web fetch, MCP tool
+ *                 output, a file outside the workspace), the session is marked
+ *                 "tainted". Reading is NEVER blocked.
+ *   2. SINK     — when the agent later performs a SENSITIVE action (network
+ *                 command, git push, new remote) that the USER never asked for,
+ *                 AND the session is tainted, the action is blocked.
+ *
+ * Trust is "min-trust" (Tessera): one untrusted source drags the whole session
+ * to the floor, after which the agent may only do what the human explicitly
+ * authorized in their prompt — not what the ingested data suggests.
+ *
+ * Everything here is pure local logic over a per-session JSON file under
+ * ~/.fullcourtdefense/taint/<sessionId>.json. No model, no network call.
+ */
+const LEDGER_TTL_MS = 24 * 60 * 60 * 1000; // sessions older than 24h are pruned
+const MAX_PROMPTS = 30;
+const MAX_SOURCES = 50;
+/** Whether taint tracking is enabled (opt-out via env). */
+function taintEnabled() {
+    return process.env.FCD_TAINT_DISABLED !== 'true' && process.env.FCD_TAINT_DISABLED !== '1';
+}
+function taintDir() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'taint');
+}
+function ledgerPath(sessionId) {
+    return path.join(taintDir(), `${safeSessionFile(sessionId)}.json`);
+}
+/** Make a session id safe to use as a filename. */
+function safeSessionFile(sessionId) {
+    const cleaned = sessionId.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 120);
+    return cleaned || 'default-session';
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+function emptyLedger(sessionId) {
+    const ts = nowIso();
+    return { sessionId, tainted: false, sources: [], userPrompts: [], createdAt: ts, updatedAt: ts };
+}
+/** Best-effort prune of stale ledger files so old sessions don't pile up. */
+function pruneStale() {
+    try {
+        const dir = taintDir();
+        if (!fs.existsSync(dir))
+            return;
+        const cutoff = Date.now() - LEDGER_TTL_MS;
+        for (const name of fs.readdirSync(dir)) {
+            const file = path.join(dir, name);
+            try {
+                const stat = fs.statSync(file);
+                if (stat.mtimeMs < cutoff)
+                    fs.unlinkSync(file);
+            }
+            catch { /* ignore individual file errors */ }
+        }
+    }
+    catch { /* ignore */ }
+}
+function loadLedger(sessionId) {
+    const file = ledgerPath(sessionId);
+    try {
+        if (!fs.existsSync(file))
+            return emptyLedger(sessionId);
+        const stat = fs.statSync(file);
+        if (Date.now() - stat.mtimeMs > LEDGER_TTL_MS)
+            return emptyLedger(sessionId);
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return {
+            sessionId,
+            tainted: Boolean(parsed.tainted),
+            sources: Array.isArray(parsed.sources) ? parsed.sources.slice(-MAX_SOURCES) : [],
+            userPrompts: Array.isArray(parsed.userPrompts) ? parsed.userPrompts.slice(-MAX_PROMPTS) : [],
+            createdAt: typeof parsed.createdAt === 'string' ? parsed.createdAt : nowIso(),
+            updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : nowIso(),
+        };
+    }
+    catch {
+        return emptyLedger(sessionId);
+    }
+}
+function saveLedger(ledger) {
+    try {
+        const dir = taintDir();
+        fs.mkdirSync(dir, { recursive: true });
+        ledger.updatedAt = nowIso();
+        fs.writeFileSync(ledgerPath(ledger.sessionId), JSON.stringify(ledger, null, 2), 'utf8');
+        pruneStale();
+    }
+    catch { /* best effort — never break the hook on disk errors */ }
+}
+/** Record the developer's prompt text so sink actions can be checked against it. */
+function recordUserPrompt(sessionId, text) {
+    if (!taintEnabled())
+        return;
+    const trimmed = (text || '').trim();
+    if (!trimmed)
+        return;
+    const ledger = loadLedger(sessionId);
+    ledger.userPrompts.push(trimmed.slice(0, 4000));
+    if (ledger.userPrompts.length > MAX_PROMPTS)
+        ledger.userPrompts = ledger.userPrompts.slice(-MAX_PROMPTS);
+    saveLedger(ledger);
+}
+/** Mark the session as having ingested untrusted content. Reading is never blocked. */
+function markTaint(sessionId, source) {
+    if (!taintEnabled())
+        return;
+    const ledger = loadLedger(sessionId);
+    ledger.tainted = true;
+    ledger.sources.push(source);
+    if (ledger.sources.length > MAX_SOURCES)
+        ledger.sources = ledger.sources.slice(-MAX_SOURCES);
+    saveLedger(ledger);
+}
+// ---------------------------------------------------------------------------
+// Ingress + sink classification
+// ---------------------------------------------------------------------------
+const WEB_MCP_TOOL_HINT = /(?:web|fetch|browse|browser|http|url|scrape|crawl|search|google|bing|read[_-]?page|open[_-]?url|wikipedia|news)/i;
+const NETWORK_CMD_HINT = /\b(?:curl|wget|nc|ncat|netcat|telnet|ftp|sftp|scp|ssh|socat|http|httpie|invoke-webrequest|invoke-restmethod|iwr|irm)\b/i;
+const REMOTE_PULL_HINT = /\b(?:curl|wget|git\s+clone|git\s+fetch|git\s+pull|svn\s+checkout|npx|pip\s+install|npm\s+install)\b/i;
+/** Pull every string value out of an args object (shallow-ish, bounded). */
+function collectStringValues(value, out = [], depth = 0) {
+    if (depth > 5 || value === null || value === undefined)
+        return out;
+    if (typeof value === 'string') {
+        if (value.trim())
+            out.push(value);
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        out.push(String(value));
+        return out;
+    }
+    if (Array.isArray(value)) {
+        for (const v of value.slice(0, 40))
+            collectStringValues(v, out, depth + 1);
+        return out;
+    }
+    if (typeof value === 'object') {
+        for (const v of Object.values(value).slice(0, 60))
+            collectStringValues(v, out, depth + 1);
+    }
+    return out;
+}
+/** Extract hostnames from any URLs / git/scp targets present in a string. */
+function extractHosts(text) {
+    const hosts = new Set();
+    if (!text)
+        return [];
+    const urlRe = /\bhttps?:\/\/([^/\s'"`)]+)/gi;
+    let m;
+    while ((m = urlRe.exec(text)) !== null) {
+        const host = m[1].replace(/^.*@/, '').replace(/:.*$/, '').toLowerCase();
+        if (host)
+            hosts.add(host);
+    }
+    // git@host:path  and  scp user@host:path
+    const sshRe = /\b[\w.-]+@([\w.-]+):/g;
+    while ((m = sshRe.exec(text)) !== null) {
+        const host = m[1].toLowerCase();
+        if (host)
+            hosts.add(host);
+    }
+    return [...hosts].filter(h => !isLocalHost(h));
+}
+function isLocalHost(host) {
+    return host === 'localhost'
+        || host === '127.0.0.1'
+        || host === '::1'
+        || host === '0.0.0.0'
+        || host.endsWith('.local');
+}
+/** Strip a host to its registrable-ish tail (last two labels) for loose matching. */
+function registrableDomain(host) {
+    const parts = host.split('.').filter(Boolean);
+    if (parts.length <= 2)
+        return host;
+    return parts.slice(-2).join('.');
+}
+function workspaceRoot(workspacePath) {
+    return workspacePath || process.env.WORKSPACE_PATH || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+}
+function isExternalFile(filePath, workspacePath) {
+    try {
+        const root = path.resolve(workspaceRoot(workspacePath));
+        const resolved = path.resolve(root, filePath);
+        const rel = path.relative(root, resolved);
+        return rel === '' ? false : (rel.startsWith('..') || path.isAbsolute(rel));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Classify an event as untrusted INGRESS. Returns the source to record, or
+ * undefined if this event does not ingest untrusted content.
+ */
+function classifyIngress(event, toolName, toolArgs, workspacePath) {
+    const at = nowIso();
+    if (event === 'read') {
+        const p = typeof toolArgs.path === 'string' ? toolArgs.path : '';
+        if (p && isExternalFile(p, workspacePath)) {
+            return { type: 'external_file', detail: p.slice(0, 200), at };
+        }
+        return undefined;
+    }
+    if (event === 'mcp') {
+        if (WEB_MCP_TOOL_HINT.test(toolName)) {
+            const strings = collectStringValues(toolArgs);
+            const hosts = strings.flatMap(extractHosts);
+            const detail = hosts.length ? `${toolName} -> ${hosts.join(', ')}` : toolName;
+            return { type: 'web_fetch', detail: detail.slice(0, 200), at };
+        }
+        return undefined;
+    }
+    if (event === 'shell') {
+        const command = typeof toolArgs.command === 'string' ? toolArgs.command : collectStringValues(toolArgs).join(' ');
+        if (REMOTE_PULL_HINT.test(command) && extractHosts(command).length > 0) {
+            return { type: 'remote_pull', detail: command.slice(0, 200), at };
+        }
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Detect whether an event is a SENSITIVE SINK (an action that can exfiltrate or
+ * reach attacker-controlled infrastructure). Returns sink info or undefined.
+ */
+function detectSink(event, toolName, toolArgs) {
+    if (event === 'shell') {
+        const command = typeof toolArgs.command === 'string' ? toolArgs.command : collectStringValues(toolArgs).join(' ');
+        if (/\bgit\s+remote\s+add\b/i.test(command)) {
+            return { kind: 'git_remote_add', targets: extractHosts(command), detail: command.slice(0, 200) };
+        }
+        if (/\bgit\s+push\b/i.test(command) && extractHosts(command).length > 0) {
+            return { kind: 'git_push', targets: extractHosts(command), detail: command.slice(0, 200) };
+        }
+        if (NETWORK_CMD_HINT.test(command)) {
+            const targets = extractHosts(command);
+            if (targets.length > 0)
+                return { kind: 'network', targets, detail: command.slice(0, 200) };
+        }
+        return undefined;
+    }
+    if (event === 'mcp') {
+        const outboundTool = /(?:http|fetch|request|curl|wget|webhook|upload|send|email|mail|slack|discord|teams|post|put|publish|notify|sms|message)/i.test(toolName);
+        if (!outboundTool)
+            return undefined;
+        const strings = collectStringValues(toolArgs);
+        const targets = strings.flatMap(extractHosts);
+        if (targets.length > 0)
+            return { kind: 'mcp_outbound', targets, detail: `${toolName} -> ${targets.join(', ')}`.slice(0, 200) };
+        return undefined;
+    }
+    return undefined;
+}
+/** Did the developer's prompt authorize reaching this target host? */
+function authorizedByPrompt(ledger, targets) {
+    if (targets.length === 0)
+        return true; // no external target to authorize
+    const haystack = ledger.userPrompts.join('\n').toLowerCase();
+    if (!haystack)
+        return false;
+    // Authorized only if EVERY external target the action contacts was mentioned
+    // by the user (host or its registrable domain appears in some prompt).
+    return targets.every(host => {
+        const h = host.toLowerCase();
+        return haystack.includes(h) || haystack.includes(registrableDomain(h));
+    });
+}
+/**
+ * The deterministic 3-rule check, evaluated against the CURRENT ledger state
+ * (call this BEFORE recording any ingress for the same event):
+ *
+ *   block IF  session.tainted  AND  is_sensitive_sink  AND  NOT user_authorized
+ */
+function checkTaintedSink(sessionId, event, toolName, toolArgs) {
+    if (!taintEnabled())
+        return undefined;
+    const sink = detectSink(event, toolName, toolArgs);
+    if (!sink)
+        return undefined;
+    const ledger = loadLedger(sessionId);
+    if (!ledger.tainted)
+        return undefined;
+    if (authorizedByPrompt(ledger, sink.targets))
+        return undefined;
+    const source = ledger.sources[ledger.sources.length - 1] || { type: 'mcp_output', detail: 'untrusted content', at: nowIso() };
+    const targetText = sink.targets.join(', ') || 'an external destination';
+    return {
+        blocked: true,
+        ruleId: 'local-taint-unrequested-sink',
+        reason: `Blocked ${describeSink(sink)} to ${targetText} that you did not request, after the agent `
+            + `ingested untrusted content (${source.type}: ${source.detail}). Likely indirect prompt injection.`,
+        evidence: sink.detail,
+        source,
+        sink,
+    };
+}
+function describeSink(sink) {
+    switch (sink.kind) {
+        case 'git_push': return 'a git push';
+        case 'git_remote_add': return 'a new git remote';
+        case 'mcp_outbound': return 'an outbound MCP action';
+        case 'network':
+        default: return 'a network command';
+    }
+}
+/** Record ingress for an event if applicable. Safe to call on every event. */
+function noteIngress(sessionId, event, toolName, toolArgs, workspacePath) {
+    if (!taintEnabled())
+        return undefined;
+    const source = classifyIngress(event, toolName, toolArgs, workspacePath);
+    if (source)
+        markTaint(sessionId, source);
+    return source;
+}

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.12"
+  "version": "1.6.14"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.6.12",
+  "version": "1.6.14",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
+    "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "prepublishOnly": "npm run build"
   },
   "keywords": [