fullstackgtm 0.48.0 → 0.49.0

package/dist/publicHttp.d.ts

@@ -0,0 +1,28 @@
+export declare const DEFAULT_PUBLIC_HTTP_MAX_BYTES = 5000000;
+export type PublicAddress = {
+    address: string;
+    family: number;
+};
+export type PublicLookup = (hostname: string) => Promise<PublicAddress[]>;
+export declare function ipIsPrivate(ip: string): boolean;
+/** Resolve once and reject the entire hostname if any answer is non-public. */
+export declare function resolvePublicAddresses(hostname: string, lookup?: PublicLookup): Promise<PublicAddress[]>;
+export declare function assertPublicUrl(rawUrl: string, lookup?: PublicLookup): Promise<URL>;
+export type PublicHttpResult = {
+    status: number;
+    headers: Headers;
+    body: Uint8Array;
+    finalUrl: string;
+};
+type HopResult = Omit<PublicHttpResult, "finalUrl">;
+export type PublicRequestHop = (url: URL, addresses: PublicAddress[], headers: Record<string, string>, timeoutMs: number, maxBytes: number) => Promise<HopResult>;
+/** Public-only GET with DNS pinning, bounded bodies, and per-hop redirect validation. */
+export declare function publicHttpGet(rawUrl: string, options?: {
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    maxBytes?: number;
+    maxRedirects?: number;
+    lookup?: PublicLookup;
+    requestHop?: PublicRequestHop;
+}): Promise<PublicHttpResult>;
+export {};

package/dist/publicHttp.js

@@ -0,0 +1,143 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+export const DEFAULT_PUBLIC_HTTP_MAX_BYTES = 5_000_000;
+function ipv4IsPrivate(ip) {
+    const parts = ip.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return true;
+    const [a, b, c] = parts;
+    return a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && (c === 0 || c === 2)) || (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||
+        (a === 203 && b === 0 && c === 113) || a >= 224;
+}
+function embeddedIpv4IsPrivate(high, low) {
+    const hi = Number.parseInt(high, 16);
+    const lo = Number.parseInt(low, 16);
+    if (!Number.isInteger(hi) || !Number.isInteger(lo) || hi > 0xffff || lo > 0xffff)
+        return true;
+    return ipv4IsPrivate(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+}
+export function ipIsPrivate(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return ipv4IsPrivate(ip);
+    if (family !== 6)
+        return true;
+    const lower = ip.toLowerCase();
+    if (lower === "::" || lower === "::1")
+        return true;
+    const embedded = lower.match(/^::(?:ffff:)?([0-9a-f]+):([0-9a-f]+)$/);
+    if (embedded)
+        return embeddedIpv4IsPrivate(embedded[1], embedded[2]);
+    const embeddedDotted = lower.match(/^::(?:ffff:)?(.+\..+)$/);
+    if (embeddedDotted)
+        return ipv4IsPrivate(embeddedDotted[1]);
+    const nat64 = lower.match(/^64:ff9b::([0-9a-f]+):([0-9a-f]+)$/);
+    if (nat64)
+        return embeddedIpv4IsPrivate(nat64[1], nat64[2]);
+    const sixToFour = lower.match(/^2002:([0-9a-f]+):([0-9a-f]+):/);
+    if (sixToFour)
+        return embeddedIpv4IsPrivate(sixToFour[1], sixToFour[2]);
+    return /^(?:fc|fd)/.test(lower) || /^(?:fe8|fe9|fea|feb)/.test(lower) ||
+        lower.startsWith("ff") || lower.startsWith("100:") ||
+        lower.startsWith("2001:db8:") || lower.startsWith("2001:0:") ||
+        lower.startsWith("2001:10:") || lower.startsWith("3fff:") ||
+        lower.startsWith("64:ff9b:1:");
+}
+const systemLookup = async (hostname) => (await dnsLookup(hostname, { all: true, verbatim: true })).map(({ address, family }) => ({ address, family }));
+/** Resolve once and reject the entire hostname if any answer is non-public. */
+export async function resolvePublicAddresses(hostname, lookup = systemLookup) {
+    const literal = hostname.replace(/^\[|\]$/g, "");
+    const family = isIP(literal);
+    const addresses = family ? [{ address: literal, family }] : await lookup(literal);
+    if (addresses.length === 0)
+        throw new Error(`public HTTP: ${literal} did not resolve to an address.`);
+    for (const { address } of addresses) {
+        if (ipIsPrivate(address))
+            throw new Error(`public HTTP refuses ${literal} — it resolves to private/internal address ${address} (SSRF guard).`);
+    }
+    return addresses;
+}
+export async function assertPublicUrl(rawUrl, lookup = systemLookup) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`market capture: "${rawUrl}" is not a valid URL.`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`market capture refuses ${url.protocol} URLs (only http/https): ${rawUrl}`);
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (isIP(host) && ipIsPrivate(host)) {
+        throw new Error(`market capture refuses private/loopback address ${host} (SSRF guard).`);
+    }
+    const addresses = await resolvePublicAddresses(host, lookup);
+    // Keep the resolved set available to the request path without changing the public API.
+    Object.defineProperty(url, "__publicAddresses", { value: addresses });
+    return url;
+}
+const requestHop = (url, addresses, headers, timeoutMs, maxBytes) => new Promise((resolve, reject) => {
+    let cursor = 0;
+    const options = {
+        protocol: url.protocol, hostname: url.hostname, port: url.port || undefined,
+        path: `${url.pathname}${url.search}`, method: "GET", headers,
+        lookup: (_hostname, options, callback) => {
+            const requestedFamily = typeof options === "number" ? options : options?.family;
+            const eligible = requestedFamily ? addresses.filter((a) => a.family === requestedFamily) : addresses;
+            const selected = eligible[cursor++ % eligible.length];
+            if (!selected)
+                return callback(new Error("public HTTP: no validated address matches the requested family"), "", 0);
+            callback(null, selected.address, selected.family);
+        },
+    };
+    const req = (url.protocol === "https:" ? httpsRequest : httpRequest)(options, (res) => {
+        if (maxBytes === 0) {
+            resolve({ status: res.statusCode ?? 0, headers: new Headers(res.headers), body: new Uint8Array() });
+            res.destroy();
+            return;
+        }
+        const chunks = [];
+        let total = 0;
+        res.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > maxBytes) {
+                req.destroy(new Error(`public HTTP response exceeds ${maxBytes} bytes`));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        res.on("end", () => resolve({ status: res.statusCode ?? 0, headers: new Headers(res.headers), body: Buffer.concat(chunks) }));
+    });
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`public HTTP request timed out after ${timeoutMs}ms`)));
+    req.on("error", reject);
+    req.end();
+});
+const SENSITIVE_HEADERS = new Set(["authorization", "cookie", "proxy-authorization"]);
+/** Public-only GET with DNS pinning, bounded bodies, and per-hop redirect validation. */
+export async function publicHttpGet(rawUrl, options = {}) {
+    let current = rawUrl;
+    let headers = { ...(options.headers ?? {}) };
+    const maxRedirects = options.maxRedirects ?? 5;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+        const url = await assertPublicUrl(current, options.lookup);
+        const addresses = url.__publicAddresses;
+        const result = await (options.requestHop ?? requestHop)(url, addresses, headers, options.timeoutMs ?? 15_000, options.maxBytes ?? DEFAULT_PUBLIC_HTTP_MAX_BYTES);
+        const location = result.headers.get("location");
+        if (result.status >= 300 && result.status < 400 && location) {
+            const next = new URL(location, url);
+            if (next.origin !== url.origin) {
+                headers = Object.fromEntries(Object.entries(headers).filter(([key]) => !SENSITIVE_HEADERS.has(key.toLowerCase())));
+            }
+            current = next.toString();
+            continue;
+        }
+        return { ...result, finalUrl: current };
+    }
+    throw new Error(`public HTTP: too many redirects (>${maxRedirects}) for ${rawUrl}`);
+}

package/dist/secureFile.d.ts

@@ -0,0 +1,15 @@
+export declare class UnsafeManagedPathError extends Error {
+    constructor(message: string);
+}
+export declare function assertNoSymlinkComponents(path: string): void;
+/** Read a managed file through a no-follow descriptor and require a regular file. */
+export declare function readSecureRegularFile(path: string, options?: {
+    tightenMode?: number;
+    onModeTightened?: (previousMode: number) => void;
+}): string;
+/**
+ * Atomically replace a private file without ever opening the destination.
+ * Existing destination and parent symlinks are rejected. The temporary file
+ * is created exclusively beside the destination so rename remains atomic.
+ */
+export declare function writeSecureFileAtomic(path: string, contents: string | Uint8Array): void;

package/dist/secureFile.js

@@ -0,0 +1,164 @@
+import { randomBytes } from "node:crypto";
+import { chmodSync, closeSync, constants, fsyncSync, fchmodSync, fstatSync, lstatSync, openSync, renameSync, unlinkSync, writeFileSync, readFileSync, } from "node:fs";
+import { dirname, isAbsolute, parse, resolve } from "node:path";
+export class UnsafeManagedPathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsafeManagedPathError";
+    }
+}
+export function assertNoSymlinkComponents(path) {
+    const absolute = isAbsolute(path) ? path : resolve(path);
+    const root = parse(absolute).root;
+    const relative = absolute.slice(root.length);
+    let current = root;
+    for (const component of relative.split(/[\\/]+/).filter(Boolean)) {
+        current = resolve(current, component);
+        let stat;
+        try {
+            stat = lstatSync(current);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to use unsafe path containing a symbolic link: ${current}`);
+        }
+    }
+}
+/** Read a managed file through a no-follow descriptor and require a regular file. */
+export function readSecureRegularFile(path, options = {}) {
+    const absolute = resolve(path);
+    assertNoSymlinkComponents(dirname(absolute));
+    try {
+        if (lstatSync(absolute).isSymbolicLink()) {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDONLY | noFollow);
+        const stat = fstatSync(fd);
+        if (!stat.isFile()) {
+            throw new UnsafeManagedPathError(`Refusing to read non-regular file: ${absolute}`);
+        }
+        if (options.tightenMode !== undefined) {
+            const previousMode = stat.mode & 0o777;
+            if ((previousMode & ~options.tightenMode) !== 0) {
+                try {
+                    fchmodSync(fd, options.tightenMode);
+                    options.onModeTightened?.(previousMode);
+                }
+                catch {
+                    // Windows and some non-POSIX filesystems do not implement chmod.
+                }
+            }
+        }
+        return readFileSync(fd, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ELOOP") {
+            throw new UnsafeManagedPathError(`Refusing to read symbolic link: ${absolute}`);
+        }
+        throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * Atomically replace a private file without ever opening the destination.
+ * Existing destination and parent symlinks are rejected. The temporary file
+ * is created exclusively beside the destination so rename remains atomic.
+ */
+export function writeSecureFileAtomic(path, contents) {
+    const destination = resolve(path);
+    const parent = dirname(destination);
+    assertNoSymlinkComponents(parent);
+    try {
+        if (lstatSync(destination).isSymbolicLink()) {
+            throw new Error(`Refusing to replace symbolic link: ${destination}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let temporary = "";
+    let fd;
+    try {
+        for (let attempt = 0; attempt < 10; attempt++) {
+            temporary = `${destination}.tmp-${process.pid}-${randomBytes(8).toString("hex")}`;
+            try {
+                const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+                fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+        }
+        if (fd === undefined)
+            throw new Error(`Unable to create an exclusive temporary file for ${destination}`);
+        writeFileSync(fd, contents);
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        try {
+            chmodSync(temporary, 0o600);
+        }
+        catch {
+            // Windows and some non-POSIX filesystems do not implement chmod.
+        }
+        // Recheck immediately before replacement. rename replaces a symlink rather
+        // than following it, but rejecting one makes managed-path policy explicit.
+        try {
+            if (lstatSync(destination).isSymbolicLink()) {
+                throw new Error(`Refusing to replace symbolic link: ${destination}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        assertNoSymlinkComponents(parent);
+        renameSync(temporary, destination);
+        temporary = "";
+        // Persist the directory entry where supported. Opening/fsyncing a
+        // directory is not available on Windows, so this durability enhancement is
+        // deliberately best-effort there.
+        let directoryFd;
+        try {
+            directoryFd = openSync(parent, constants.O_RDONLY);
+            fsyncSync(directoryFd);
+        }
+        catch {
+            // Unsupported by the platform/filesystem.
+        }
+        finally {
+            if (directoryFd !== undefined)
+                closeSync(directoryFd);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (temporary) {
+            try {
+                unlinkSync(temporary);
+            }
+            catch {
+                // Best-effort cleanup after a failed write.
+            }
+        }
+    }
+}

package/dist/types.d.ts

@@ -7,7 +7,7 @@
  */
 export type CrmProvider = "salesforce" | "hubspot" | "mock" | "unknown" | (string & {});
 export type RiskLevel = "low" | "medium" | "high";
-export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "rejected" | "applied";
+export type ApprovalStatus = "draft" | "needs_approval" | "approved" | "applying" | "rejected" | "applied";
 export type GtmObjectType = "account" | "contact" | "deal" | "user" | "activity";
 export type GtmEvidenceSourceSystem = "salesforce" | "hubspot" | "gong" | "chorus" | "fathom" | "manual" | "csv" | "mock" | "web" | "unknown";
 export type PatchOperationType = "set_field" | "clear_field" | "link_record" | "archive_record" | "create_task" | "create_record" | "merge_records";

package/docs/api.md

@@ -62,6 +62,12 @@ release.
 
 - `fullstackgtm.config.json`: `{ policy?, rules?: { enabled?, disabled? }, rulePackages? }`.
 - Rule packages export `rules: GtmAuditRule[]`.
+- Rule packages are executable code and are fail-closed. CLI execution requires
+  an explicit `--config <path> --allow-plugins`; `--no-plugins` applies only
+  declarative policy/rule filters. An implicitly discovered config never grants
+  plugin trust.
+- MCP never executes rule packages. Mutable tool-call paths are not accepted as
+  a durable code-trust boundary; use the reviewed CLI plugin flow instead.
 - Precedence: CLI flags > config file > defaults.
 
 ## CLI
@@ -283,6 +289,23 @@ domain stamped — so the acquired account is immediately signal-watchable
 `CanonicalContact.linkedin` (mapped from HubSpot `hs_linkedin_url`) is the
 strong dedup key across all of the above.
 
+## Apply recovery
+
+Store-backed applies persist an apply-attempt claim before provider I/O. If the
+process exits without a completed run, the plan remains `applying`: the CLI
+cannot know whether a remote write landed and will not replay it. Inspect the
+attempt with `fullstackgtm plans show <id>` and reconcile the named provider's
+records. Only then run:
+
+```bash
+fullstackgtm plans recover <id> --acknowledge-uncertain-writes
+```
+
+Recovery performs no provider calls. It clears the old approvals and returns
+the plan to `needs_approval`, requiring a fresh review and signed approval
+before another apply. Provider APIs do not all expose idempotency keys, so this
+operator reconciliation remains necessary after a timeout or crash.
+
 ## Schedule
 
 The horizontal scheduler: a declarative schedule-entry store, a
@@ -347,8 +370,12 @@ the stored capture it cites before a set is accepted; failed captures read as
 Tools: `fullstackgtm_capabilities` (the machine-readable server contract —
 tool inventory with per-tool CRM-write flags, derived from the server's own
 registration table), `fullstackgtm_audit`, `fullstackgtm_rules`,
-`fullstackgtm_apply` (requires explicit `approvedOperationIds`),
+`fullstackgtm_apply` (accepts only a stored `planId`; approved operation ids and
+placeholder values come exclusively from the HMAC-signed plan store),
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`, `fullstackgtm_resolve`,
 `fullstackgtm_market_worksheet`, `fullstackgtm_market_observe` (validates,
 verifies quoted spans against the stored captures, appends, returns front
-states). Input schemas are stable.
+states). Input schemas are stable. MCP never executes rule packages and cannot
+accept external plan files or caller-supplied approvals/value overrides. An
+uncertain apply is reconciled with the CLI `plans recover` workflow and is
+never replayed automatically.

package/docs/architecture.md

@@ -27,14 +27,22 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
                          plans approve  (planStore.ts + integrity.ts: HMAC-signed)
                                       │
                                       ▼
+                    atomic apply claim + durable attempt journal
+                                      │
+                                      ▼
                     applyPatchPlan (connector.ts): for each APPROVED op —
                     compare-and-set vs live value, precondition + guard recheck,
                     irreversible-op drift guard → connector.applyOperation()
                                       │
                                       ▼
-                               PatchPlanRun  (the audit record; auditLog.ts exports it)
+                               PatchPlanRun  (claim-bound audit record)
 ```
 
+An interrupted provider attempt stays `applying`/uncertain. Recovery never
+replays automatically: reconcile provider state, then `plans recover ...
+--acknowledge-uncertain-writes` clears approvals and returns the plan to
+`needs_approval` for a fresh signed review.
+
 ## Module map (`src/`)
 
 **Contracts & model**
@@ -49,12 +57,15 @@ provider  ──fetchSnapshot()──►  CanonicalGtmSnapshot
 - `audit.ts` — runs rules over a snapshot into a `PatchPlan`.
 - `suggest.ts` — derives concrete values for `requires_human_*` placeholders from
   snapshot evidence, with confidence + reasons.
-- `planStore.ts` — durable plan lifecycle (save / approve / record runs), 0600.
+- `planStore.ts` — durable plan lifecycle (save / approve / atomic claim /
+  attempt journal / no-replay recovery / claim-bound runs), atomic 0600 files.
 - `integrity.ts` — HMAC-signs approvals (per-install key) and verifies at apply.
 - `connector.ts` — `applyPatchPlan`: the safety contract (approval filter,
   placeholder refusal, CAS, precondition/guard recheck, irreversible-op drift
   guard). Provider-agnostic.
 - `auditLog.ts` — hash-chained, signed export of every apply run.
+- `secureFile.ts` — atomic no-follow sensitive-file reads/writes.
+- `publicHttp.ts` — DNS-pinned, redirect-validating, bounded public-only HTTP.
 
 **Governed write verbs (each builds a plan; never writes directly)**
 - `bulkUpdate.ts`, `dedupe.ts`, `reassign.ts`, `route.ts` — filtered,

package/llms.txt

@@ -10,6 +10,13 @@ CLI quick check: `fullstackgtm doctor --json`. Zero-credential demo:
 explicitly approved operation ids. Exit codes: 0 success, 1 error, 2 findings
 at/above `--fail-on`.
 
+MCP apply accepts only a stored `planId`; approvals and concrete values come
+from the HMAC-signed plan store, never the tool caller. MCP never executes rule
+packages or external plans. Store-backed apply is single-owner and journaled;
+an interrupted provider attempt remains uncertain and is never auto-replayed.
+After reconciling provider state, `plans recover <id>
+--acknowledge-uncertain-writes` clears approvals for a fresh human review.
+
 ## Docs
 
 - [README](https://github.com/fullstackgtm/core/blob/main/README.md): install, five-minute loop, auth ladder, MCP setup, programmatic use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",
@@ -45,10 +45,12 @@
     "DATA-FLOWS.md"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "clean": "node scripts/clean.mjs",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
     "pretest": "test -d tests || { echo 'No tests/ in this directory. In the published mirror, tests live here and `npm test` works. In the monorepo, run package tests from the repo ROOT: `node --experimental-strip-types --test tests/fullstackgtm*.test.ts` (the tests live at the monorepo root tests/).' >&2; exit 1; }",
     "test": "node --experimental-strip-types --test tests/*.test.ts",
-    "prepublishOnly": "npm run build && npm pack --dry-run && node dist/bin.js --help && node dist/mcp-bin.js --help"
+    "verify:package": "npm run build && node scripts/verify-packed-install.mjs --with-peers",
+    "prepublishOnly": "npm run verify:package"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/skills/fullstackgtm/SKILL.md

@@ -85,10 +85,16 @@ npx -y fullstackgtm-mcp
 
 Tools over stdio: `fullstackgtm_audit` (read-only), `fullstackgtm_rules`,
 `fullstackgtm_suggest`, `fullstackgtm_call_parse`,
-`fullstackgtm_apply` (requires `approvedOperationIds`),
+`fullstackgtm_apply` (stored `planId` only; approvals and values come from the
+HMAC-signed plan store and cannot be supplied by the MCP caller),
 `fullstackgtm_resolve`, `fullstackgtm_market_worksheet`,
 `fullstackgtm_market_observe`.
 
+MCP never executes rule packages or external plans. An uncertain apply is
+never replayed automatically: reconcile provider state, then use
+`fullstackgtm plans recover <id> --acknowledge-uncertain-writes`, which clears
+approvals and requires a fresh review.
+
 ## Composing the primitives into plays
 
 This CLI ships governed **primitives** — there is no `outbound` mega-command.

package/src/cli/audit.ts

@@ -3,7 +3,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { auditSnapshot, defaultPolicy } from "../audit.ts";
-import { loadConfig, mergePolicy, resolveConfiguredRules } from "../config.ts";
+import { loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli } from "../config.ts";
 import { getCredential, resolveHubspotConnection } from "../credentials.ts";
 import { patchPlanToMarkdown } from "../format.ts";
 import { appendHealthEntry, computeHealth, healthToMarkdown, readHealthTimeline, saveWorkspaceSnapshot, summarizeHealth, activeWorkspaceProfile, type HealthRollup } from "../health.ts";
@@ -174,8 +174,9 @@ async function registerHubspotWithBroker(): Promise<void> {
 
 export async function audit(args: string[]) {
   const threshold = failOnThreshold(args);
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = selectedRules(args, await resolveConfiguredRules(loaded));
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = selectedRules(args, await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig)));
   const snapshot = await readSnapshot(args);
 
   const policy = mergePolicy(defaultPolicy(), loaded?.config);
@@ -371,8 +372,9 @@ function shortDay(at: string): string {
  * re-fetching (useful for a plan produced earlier or by another machine).
  */
 export async function reportCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const configuredRules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const configuredRules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
 
   let plan: PatchPlan;
   let snapshot: CanonicalGtmSnapshot | undefined;
@@ -424,8 +426,9 @@ export async function reportCommand(args: string[]) {
 }
 
 export async function rulesCommand(args: string[]) {
-  const loaded = loadConfig(option(args, "--config") ?? undefined);
-  const rules = await resolveConfiguredRules(loaded);
+  const explicitConfig = option(args, "--config") ?? undefined;
+  const loaded = loadConfig(explicitConfig);
+  const rules = await resolveConfiguredRules(loaded, undefined, rulePackageTrustFromCli(args, explicitConfig));
   if (args.includes("--json")) {
     console.log(
       JSON.stringify(

package/src/cli/auth.ts

@@ -3,7 +3,7 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { DEFAULT_LOOPBACK_PORT, openInBrowser, runHubspotLoopbackLogin, validateHubspotToken } from "../connectors/hubspotAuth.ts";
-import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceToken } from "../connectors/salesforceAuth.ts";
+import { pollSalesforceDeviceLogin, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken } from "../connectors/salesforceAuth.ts";
 import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, storeCredential, type StoredCredential } from "../credentials.ts";
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.ts";
 import { resolveLlmCredential, validateLlmKey } from "../llm.ts";
@@ -252,7 +252,10 @@ async function salesforceLogin(args: string[]) {
       await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
       return;
     }
-    const loginUrl = option(args, "--login-url") ?? undefined;
+    const loginUrlInput = option(args, "--login-url") ?? undefined;
+    const loginUrl = loginUrlInput
+      ? validateSalesforceOrigin(loginUrlInput, "Salesforce --login-url")
+      : undefined;
     const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
     console.error(
       `\nPairing code: ${authorization.userCode}\n\nConfirm this code at:\n\n  ${authorization.verificationUri}\n`,
@@ -282,8 +285,8 @@ async function salesforceLogin(args: string[]) {
     return;
   }
 
-  const instanceUrl = option(args, "--instance-url");
-  if (!instanceUrl) {
+  const instanceUrlInput = option(args, "--instance-url");
+  if (!instanceUrlInput) {
     await guidedProviderLogin(
       "salesforce",
       args,
@@ -291,6 +294,7 @@ async function salesforceLogin(args: string[]) {
     );
     return;
   }
+  const instanceUrl = validateSalesforceOrigin(instanceUrlInput, "Salesforce --instance-url");
   const token = await readSecret("Salesforce access token");
   if (!token) throw new Error("No access token provided.");
   if (!args.includes("--no-validate")) {