fullcourtdefense-cli 1.6.6 → 1.6.7

package/dist/commands/deterministicGuard.d.ts

@@ -0,0 +1,10 @@
+export type DeterministicDirection = 'request' | 'response';
+export interface DeterministicFinding {
+    blocked: true;
+    ruleId: string;
+    category: 'sensitive_file' | 'metadata_ssrf' | 'destructive_command' | 'destructive_sql' | 'infra_destroy' | 'reverse_shell' | 'secret_exfiltration';
+    reason: string;
+    evidence: string;
+}
+export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>): DeterministicFinding | undefined;
+export declare function scanDeterministicTextResponse(text: string): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -0,0 +1,319 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanDeterministicToolCall = scanDeterministicToolCall;
+exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
+const SECRET_PATTERNS = [
+    { label: 'private key material', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i },
+    { label: 'AWS access key', re: /\bAKIA[0-9A-Z]{16}\b/ },
+    { label: 'GitHub token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/ },
+    { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/ },
+    { label: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+    { label: 'OpenAI project key', re: /\bsk-proj-[A-Za-z0-9_-]{20,}\b/ },
+    { label: 'OpenAI API key', re: /\bsk-[A-Za-z0-9_-]{32,}\b/ },
+    { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/ },
+    { label: 'Stripe live key', re: /\b[rs]k_live_[0-9a-zA-Z]{24,}\b/ },
+    { label: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+    { label: 'HuggingFace token', re: /\bhf_[A-Za-z0-9]{30,}\b/ },
+    { label: 'database URL with password', re: /\b(?:postgres(?:ql)?|mongodb(?:\+srv)?|mysql):\/\/[^/\s'":]+:[^@\s'"]+@/i },
+];
+const METADATA_ENDPOINTS = [
+    '169.254.169.254',
+    'metadata.google.internal',
+    'metadata.azure.com',
+    '100.100.100.200',
+];
+const OUTBOUND_TOOL_HINT = /(?:http|fetch|request|curl|wget|webhook|upload|send|email|mail|slack|discord|teams|post|put|publish|notify)/i;
+const COMMAND_TOOL_HINT = /(?:shell|bash|command|cmd|powershell|terminal|exec|subprocess|run|script)/i;
+const SQL_TOOL_HINT = /(?:sql|query|database|postgres|mysql|sqlite|snowflake|bigquery|db)/i;
+const COMMAND_KEYS = new Set([
+    'command',
+    'cmd',
+    'script',
+    'shell',
+    'bash',
+    'powershell',
+    'args.command',
+    'toolArgs.command',
+]);
+const SQL_KEYS = new Set([
+    'query',
+    'sql',
+    'statement',
+    'migration',
+    'args.query',
+    'args.sql',
+    'toolArgs.query',
+    'toolArgs.sql',
+]);
+function evidence(value) {
+    const compact = value.replace(/\s+/g, ' ').trim();
+    return compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
+}
+function decodeLoosely(value) {
+    let out = value;
+    for (let i = 0; i < 2; i++) {
+        try {
+            const decoded = decodeURIComponent(out);
+            if (decoded === out)
+                break;
+            out = decoded;
+        }
+        catch {
+            break;
+        }
+    }
+    return out;
+}
+function normalizeForPath(value) {
+    return decodeLoosely(value)
+        .replace(/\\/g, '/')
+        .replace(/\/+/g, '/')
+        .toLowerCase();
+}
+function normalizeForCommand(value) {
+    return decodeLoosely(value).replace(/\s+/g, ' ').trim();
+}
+function collectStrings(value, keyPath = 'args', out = [], depth = 0) {
+    if (depth > 6 || value === null || value === undefined)
+        return out;
+    if (typeof value === 'string') {
+        out.push({ keyPath, value });
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        out.push({ keyPath, value: String(value) });
+        return out;
+    }
+    if (Array.isArray(value)) {
+        value.slice(0, 50).forEach((item, index) => collectStrings(item, `${keyPath}.${index}`, out, depth + 1));
+        return out;
+    }
+    if (typeof value === 'object') {
+        for (const [key, nested] of Object.entries(value).slice(0, 100)) {
+            collectStrings(nested, `${keyPath}.${key}`, out, depth + 1);
+        }
+    }
+    return out;
+}
+function findSecret(value) {
+    for (const pattern of SECRET_PATTERNS) {
+        const match = value.match(pattern.re);
+        if (match?.[0])
+            return { label: pattern.label, value: match[0] };
+    }
+    return undefined;
+}
+function containsMetadataEndpoint(value) {
+    const normalized = decodeLoosely(value).toLowerCase();
+    return METADATA_ENDPOINTS.some(endpoint => normalized.includes(endpoint));
+}
+function containsSensitiveCredentialPath(value) {
+    const text = normalizeForPath(value);
+    const traversal = /(?:^|\/)\.\.(?:\/|$)/.test(text) || /%2e/i.test(value);
+    const checks = [
+        { label: 'SSH private key', re: /(?:^|\/)\.ssh\/id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[/?#\s'"])/ },
+        { label: 'SSH config', re: /(?:^|\/)\.ssh\/config(?:$|[/?#\s'"])/ },
+        { label: 'AWS credentials', re: /(?:^|\/)\.aws\/(?:credentials|config)(?:$|[/?#\s'"])/ },
+        { label: 'Kubernetes config', re: /(?:^|\/)\.kube\/config(?:$|[/?#\s'"])/ },
+        { label: 'Docker auth config', re: /(?:^|\/)\.docker\/config\.json(?:$|[/?#\s'"])/ },
+        { label: 'npm credentials', re: /(?:^|\/)\.npmrc(?:$|[/?#\s'"])/ },
+        { label: 'PyPI credentials', re: /(?:^|\/)\.pypirc(?:$|[/?#\s'"])/ },
+        { label: 'netrc credentials', re: /(?:^|\/)\.netrc(?:$|[/?#\s'"])/ },
+        { label: 'GCP ADC credentials', re: /application_default_credentials\.json(?:$|[/?#\s'"])/ },
+        { label: 'Linux shadow file', re: /(?:^|\/)etc\/(?:shadow|sudoers)(?:$|[/?#\s'"])/ },
+        { label: 'PowerShell history', re: /powershell\/psreadline\/consolehost_history\.txt(?:$|[/?#\s'"])/ },
+        { label: 'browser credential store', re: /(?:login data|cookies|key4\.db|logins\.json)(?:$|[/?#\s'"])/ },
+    ];
+    for (const check of checks) {
+        if (check.re.test(text))
+            return check.label;
+    }
+    if (traversal && /(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[/?#\s'"])/.test(text)) {
+        return 'environment file via path traversal';
+    }
+    return undefined;
+}
+function destructiveCommandReason(value) {
+    const text = normalizeForCommand(value);
+    const lower = text.toLowerCase();
+    if (/\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?\/["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        return 'recursive force delete of filesystem root';
+    if (/\bsudo\s+rm\s+-[a-z]*r[a-z]*f[a-z]*\s+(?:["']?\/["']?|\*)(?:\s|$|[;&|])/.test(lower))
+        return 'recursive force delete of filesystem root';
+    if (/\b(?:del|erase)\s+\/[a-z]*s[a-z]*\s+\/[a-z]*q[a-z]*\s+[a-z]:\\(?:\s|$)/i.test(text))
+        return 'recursive Windows drive delete';
+    if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force') && /[a-z]:\\?(?:\s|$)/i.test(text))
+        return 'recursive Windows drive delete';
+    if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
+        return 'fork bomb';
+    if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
+        return 'filesystem format command';
+    if (/\bdd\b(?=.*\bof=\/dev\/(?:sd|xvd|hd|nvme|disk))/i.test(text))
+        return 'raw disk overwrite command';
+    if (/\bchmod\s+-r\s+777\s+\/(?:\s|$)/i.test(text))
+        return 'recursive permission change on root';
+    return undefined;
+}
+function reverseShellReason(value) {
+    const text = normalizeForCommand(value);
+    if (/\bbash\s+-i\b.*\/dev\/tcp\//i.test(text))
+        return 'bash reverse shell';
+    if (/\b(?:nc|ncat|netcat)\b.*\s-e\s+(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
+        return 'netcat reverse shell';
+    if (/\bsocat\b.*\bexec:(?:\/bin\/)?(?:sh|bash)\b/i.test(text))
+        return 'socat reverse shell';
+    if (/\b(?:curl|wget)\b[^|;&]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash)\b/i.test(text))
+        return 'remote script piped to shell';
+    if (/\bpython(?:3)?\s+-c\b(?=.*socket)(?=.*subprocess)/i.test(text))
+        return 'python reverse shell';
+    return undefined;
+}
+function destructiveSqlReason(value) {
+    const text = normalizeForCommand(value);
+    if (/\bdrop\s+database\b/i.test(text))
+        return 'DROP DATABASE';
+    if (/\bdrop\s+schema\b/i.test(text))
+        return 'DROP SCHEMA';
+    return undefined;
+}
+function infraDestroyReason(value) {
+    const text = normalizeForCommand(value);
+    if (/\bterraform\s+destroy\b(?=.*--auto-approve)/i.test(text))
+        return 'terraform destroy with auto-approve';
+    if (/\bpulumi\s+destroy\b(?=.*(?:--yes|-y))/i.test(text))
+        return 'pulumi destroy with auto-approve';
+    if (/\bkubectl\s+delete\s+(?:namespace|clusterrole|secret)\b/i.test(text))
+        return 'destructive kubectl delete';
+    if (/\bkubectl\s+delete\s+all\b(?=.*--all)/i.test(text))
+        return 'broad kubectl delete all';
+    if (/\bgcloud\s+projects\s+delete\b/i.test(text))
+        return 'GCP project deletion';
+    if (/\bgcloud\s+sql\s+instances\s+delete\b/i.test(text))
+        return 'GCP SQL instance deletion';
+    if (/\baws\s+s3\s+rm\s+s3:\/\/\S+\s+--recursive\b/i.test(text))
+        return 'recursive S3 deletion';
+    if (/\baws\s+cloudformation\s+delete-stack\b/i.test(text))
+        return 'CloudFormation stack deletion';
+    if (/\baws\s+iam\s+attach-user-policy\b(?=.*AdministratorAccess)/i.test(text))
+        return 'IAM administrator privilege grant';
+    if (/\baws\s+iam\s+create-access-key\b/i.test(text))
+        return 'IAM access key creation';
+    if (/\baz\s+group\s+delete\b(?=.*(?:--yes|-y))/i.test(text))
+        return 'Azure resource group deletion';
+    return undefined;
+}
+function isOutboundContext(toolName, candidates) {
+    if (OUTBOUND_TOOL_HINT.test(toolName))
+        return true;
+    return candidates.some(candidate => /(?:url|uri|webhook|endpoint|recipient|channel|email|to|body|payload|message|content)/i.test(candidate.keyPath));
+}
+function isCommandContext(toolName, candidate) {
+    const lastKey = candidate.keyPath.split('.').pop() || '';
+    return COMMAND_TOOL_HINT.test(toolName) || COMMAND_KEYS.has(lastKey) || COMMAND_KEYS.has(candidate.keyPath);
+}
+function isSqlContext(toolName, candidate) {
+    const lastKey = candidate.keyPath.split('.').pop() || '';
+    return SQL_TOOL_HINT.test(toolName) || SQL_KEYS.has(lastKey) || SQL_KEYS.has(candidate.keyPath);
+}
+function scanDeterministicToolCall(toolName, toolArgs) {
+    const candidates = collectStrings(toolArgs);
+    const outbound = isOutboundContext(toolName, candidates);
+    for (const candidate of candidates) {
+        const sensitivePath = containsSensitiveCredentialPath(candidate.value);
+        if (sensitivePath) {
+            return {
+                blocked: true,
+                ruleId: 'local-sensitive-credential-path',
+                category: 'sensitive_file',
+                reason: `Blocked local agent access to ${sensitivePath}.`,
+                evidence: evidence(candidate.value),
+            };
+        }
+    }
+    for (const candidate of candidates) {
+        if (containsMetadataEndpoint(candidate.value)) {
+            return {
+                blocked: true,
+                ruleId: 'local-cloud-metadata-ssrf',
+                category: 'metadata_ssrf',
+                reason: 'Blocked request to cloud metadata endpoint.',
+                evidence: evidence(candidate.value),
+            };
+        }
+    }
+    for (const candidate of candidates) {
+        if (!isCommandContext(toolName, candidate))
+            continue;
+        const reverseShell = reverseShellReason(candidate.value);
+        if (reverseShell) {
+            return {
+                blocked: true,
+                ruleId: 'local-reverse-shell',
+                category: 'reverse_shell',
+                reason: `Blocked ${reverseShell}.`,
+                evidence: evidence(candidate.value),
+            };
+        }
+        const destructive = destructiveCommandReason(candidate.value);
+        if (destructive) {
+            return {
+                blocked: true,
+                ruleId: 'local-destructive-command',
+                category: 'destructive_command',
+                reason: `Blocked ${destructive}.`,
+                evidence: evidence(candidate.value),
+            };
+        }
+        const infraDestroy = infraDestroyReason(candidate.value);
+        if (infraDestroy) {
+            return {
+                blocked: true,
+                ruleId: 'local-infra-destroy',
+                category: 'infra_destroy',
+                reason: `Blocked ${infraDestroy}.`,
+                evidence: evidence(candidate.value),
+            };
+        }
+    }
+    for (const candidate of candidates) {
+        if (!isSqlContext(toolName, candidate))
+            continue;
+        const destructiveSql = destructiveSqlReason(candidate.value);
+        if (destructiveSql) {
+            return {
+                blocked: true,
+                ruleId: 'local-destructive-sql',
+                category: 'destructive_sql',
+                reason: `Blocked destructive SQL command: ${destructiveSql}.`,
+                evidence: evidence(candidate.value),
+            };
+        }
+    }
+    if (outbound) {
+        for (const candidate of candidates) {
+            const secret = findSecret(candidate.value);
+            if (secret) {
+                return {
+                    blocked: true,
+                    ruleId: 'local-secret-exfiltration',
+                    category: 'secret_exfiltration',
+                    reason: `Blocked outbound data containing ${secret.label}.`,
+                    evidence: evidence(secret.value),
+                };
+            }
+        }
+    }
+    return undefined;
+}
+function scanDeterministicTextResponse(text) {
+    const secret = findSecret(text);
+    if (!secret)
+        return undefined;
+    return {
+        blocked: true,
+        ruleId: 'local-secret-in-tool-response',
+        category: 'secret_exfiltration',
+        reason: `Blocked tool response containing ${secret.label}.`,
+        evidence: evidence(secret.value),
+    };
+}

package/dist/commands/hook.js

@@ -38,6 +38,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
+const deterministicGuard_1 = require("./deterministicGuard");
 const DEBUG_LOG = path.join(os.homedir(), '.fullcourtdefense-hook.log');
 /** Append a diagnostic line so we can see exactly what Cursor invoked + the verdict. */
 function dbg(obj) {
@@ -373,6 +374,16 @@ async function enforceActionPolicy(ctx) {
         respond(false);
         return;
     }
+    const localBlock = (0, deterministicGuard_1.scanDeterministicToolCall)(call.toolName, call.toolArgs);
+    if (localBlock) {
+        dbg({ phase: 'local_deterministic_block', event, tool: call.toolName, ruleId: localBlock.ruleId, category: localBlock.category });
+        if (shadow) {
+            respond(false, undefined, `[FullCourtDefense shadow] would block ${call.toolName}: ${localBlock.reason}`);
+            return;
+        }
+        respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this ${event} locally (${localBlock.ruleId}). Do not retry.`);
+        return;
+    }
     const headers = { 'Content-Type': 'application/json' };
     if (shieldKey)
         headers['x-shield-key'] = shieldKey;

package/dist/commands/mcpGateway.js

@@ -52,6 +52,7 @@ const child_process_1 = require("child_process");
 const config_1 = require("../config");
 const discoverPaths_1 = require("./discoverPaths");
 const discover_1 = require("./discover");
+const deterministicGuard_1 = require("./deterministicGuard");
 const DEFAULT_API_URL = 'https://api.fullcourtdefense.ai';
 const MANAGED_SERVER_NAME = 'agentguard-gateway';
 const INSTALL_GATEWAY_ARGS = { includeShieldKey: false };
@@ -588,6 +589,9 @@ class McpGatewayServer {
         let approvalActionId;
         let operation;
         try {
+            const localBlock = (0, deterministicGuard_1.scanDeterministicToolCall)(toolName, toolArgs);
+            if (localBlock)
+                throw new Error(`${localBlock.reason} (${localBlock.ruleId}: ${localBlock.evidence})`);
             const preflight = await this.api.checkToolCall({ toolName, toolArgs });
             operation = preflight.operation;
             if (!preflight.allowed) {
@@ -604,6 +608,9 @@ class McpGatewayServer {
                 }
             }
             const rawResult = await this.downstream.callTool(toolName, toolArgs);
+            const localResponseBlock = (0, deterministicGuard_1.scanDeterministicTextResponse)(contentToText(rawResult));
+            if (localResponseBlock)
+                throw new Error(`${localResponseBlock.reason} (${localResponseBlock.ruleId}: ${localResponseBlock.evidence})`);
             const finalResult = this.gatewayConfig.scanResponse
                 ? await this.api.scanToolResponse({ toolName, operation, toolArgs, result: rawResult })
                 : rawResult;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.6"
+  "version": "1.6.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.6.6",
+  "version": "1.6.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -14,6 +14,7 @@
   ],
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
+    "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "prepublishOnly": "npm run build"
   },
   "keywords": [