fullcourtdefense-cli 1.6.7 → 1.6.9

package/dist/commands/deterministicGuard.d.ts

@@ -8,3 +8,4 @@ export interface DeterministicFinding {
 }
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string): DeterministicFinding | undefined;
+export declare function scanDeterministicPrompt(text: string): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
+exports.scanDeterministicPrompt = scanDeterministicPrompt;
 const SECRET_PATTERNS = [
     { label: 'private key material', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i },
     { label: 'AWS access key', re: /\bAKIA[0-9A-Z]{16}\b/ },
@@ -317,3 +318,89 @@ function scanDeterministicTextResponse(text) {
         evidence: evidence(secret.value),
     };
 }
+function looksLikeQuestion(value) {
+    return /^(?:what|why|how|explain|describe|is|are|can you explain)\b/i.test(value.trim());
+}
+function bareOrActionIntent(value, action) {
+    const trimmed = value.trim();
+    if (looksLikeQuestion(trimmed))
+        return false;
+    return action.test(trimmed) || /^[^\n]{1,240}$/.test(trimmed);
+}
+function scanDeterministicPrompt(text) {
+    const trimmed = text.trim();
+    if (!trimmed || looksLikeQuestion(trimmed))
+        return undefined;
+    const secret = findSecret(trimmed);
+    if (secret && OUTBOUND_TOOL_HINT.test(trimmed)) {
+        return {
+            blocked: true,
+            ruleId: 'local-prompt-secret-exfiltration',
+            category: 'secret_exfiltration',
+            reason: `Blocked prompt asking to send ${secret.label}.`,
+            evidence: evidence(secret.value),
+        };
+    }
+    const sensitivePath = containsSensitiveCredentialPath(trimmed);
+    if (sensitivePath && bareOrActionIntent(trimmed, /\b(?:read|open|cat|show|print|copy|upload|send|exfiltrate)\b/i)) {
+        return {
+            blocked: true,
+            ruleId: 'local-prompt-sensitive-credential-path',
+            category: 'sensitive_file',
+            reason: `Blocked prompt targeting ${sensitivePath}.`,
+            evidence: evidence(trimmed),
+        };
+    }
+    if (bareOrActionIntent(trimmed, /\b(?:run|execute|launch|start)\b/i)) {
+        const reverseShell = reverseShellReason(trimmed);
+        if (reverseShell) {
+            return {
+                blocked: true,
+                ruleId: 'local-prompt-reverse-shell',
+                category: 'reverse_shell',
+                reason: `Blocked prompt containing ${reverseShell}.`,
+                evidence: evidence(trimmed),
+            };
+        }
+        const destructive = destructiveCommandReason(trimmed);
+        if (destructive) {
+            return {
+                blocked: true,
+                ruleId: 'local-prompt-destructive-command',
+                category: 'destructive_command',
+                reason: `Blocked prompt containing ${destructive}.`,
+                evidence: evidence(trimmed),
+            };
+        }
+        const infraDestroy = infraDestroyReason(trimmed);
+        if (infraDestroy) {
+            return {
+                blocked: true,
+                ruleId: 'local-prompt-infra-destroy',
+                category: 'infra_destroy',
+                reason: `Blocked prompt containing ${infraDestroy}.`,
+                evidence: evidence(trimmed),
+            };
+        }
+    }
+    const destructiveSql = destructiveSqlReason(trimmed);
+    if (destructiveSql && bareOrActionIntent(trimmed, /\b(?:run|execute|query|apply)\b/i)) {
+        return {
+            blocked: true,
+            ruleId: 'local-prompt-destructive-sql',
+            category: 'destructive_sql',
+            reason: `Blocked prompt containing destructive SQL command: ${destructiveSql}.`,
+            evidence: evidence(trimmed),
+        };
+    }
+    if (containsMetadataEndpoint(trimmed) && /\b(?:fetch|request|curl|open|connect|call)\b/i.test(trimmed)) {
+        return {
+            blocked: true,
+            ruleId: 'local-prompt-cloud-metadata-ssrf',
+            category: 'metadata_ssrf',
+            reason: 'Blocked prompt targeting cloud metadata endpoint.',
+            evidence: evidence(trimmed),
+        };
+    }
+    return undefined;
+}

package/dist/commands/hook.js

@@ -358,6 +358,16 @@ async function hookCommand(args, config) {
         const text = extractPromptText(payload).trim();
         if (!text)
             respond(false);
+        const localBlock = (0, deterministicGuard_1.scanDeterministicPrompt)(text);
+        if (localBlock) {
+            dbg({ phase: 'local_deterministic_prompt_block', event, ruleId: localBlock.ruleId, category: localBlock.category });
+            if (shadow) {
+                respond(false, undefined, `[FullCourtDefense shadow] would block prompt: ${localBlock.reason}`);
+                return;
+            }
+            respond(true, `Blocked by FullCourtDefense local guard — ${localBlock.reason}`, `FullCourtDefense blocked this prompt locally (${localBlock.ruleId}). Do not retry.`);
+            return;
+        }
         await enforceShieldText({
             event, text, payload, apiUrl: apiUrl, shieldId: shieldId, shieldKey,
             shadow, failClosed, timeoutMs, respond,

package/dist/commands/installCursorHook.js

@@ -137,7 +137,7 @@ async function installCursorHookCommand(args, config) {
         const { hookKey, flag, failClosedDefault, timeoutSec } = EVENT_MAP[e];
         const failClosed = e === 'prompt' ? false : (args.failClosed !== undefined ? args.failClosed === 'true' : failClosedDefault);
         const entry = {
-            command: buildHookCommand(flag, { shadow: e === 'prompt' ? true : shadow, failClosed }),
+            command: buildHookCommand(flag, { shadow, failClosed }),
             timeout: timeoutSec,
         };
         if (failClosed)

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.7"
+  "version": "1.6.9"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {