fullcourtdefense-cli 1.29.0 → 1.30.0

package/dist/actionPolicyEngine.d.ts

@@ -145,6 +145,28 @@ export declare function effectiveApprovalScope(approval: ActionPolicyApproval |
  */
 export declare function deriveToolOperations(toolName: string, declaredActions?: string[]): string[];
 export declare function toolCapabilities(value: string): Set<string>;
+/**
+ * "Contains a secret" means a secret VALUE is present — never that the text
+ * talks about secrets. Source code, docs, grep patterns and commit messages in
+ * any security-minded codebase say "password", "credential", "api_key" and
+ * ".env" all day; treating those words as secrets made `toolArgs.containsSecret`
+ * true for ~77% of routine IDE agent actions (measured), and every org policy
+ * built on that fact blocked developers for editing their own code.
+ *
+ * What counts:
+ *   - known token formats (GitHub, AWS, Google, OpenAI/Anthropic, Slack, JWT)
+ *   - private-key PEM blocks
+ *   - an ASSIGNMENT of a secret-named field to a REAL value:
+ *     `password=Hunter2!2024`, `"api_key": "sk-…"`, `--token abc…` — where the
+ *     value is not a placeholder (`<your-key>`, `xxxx`, `changeme`, `${VAR}`,
+ *     `process.env.X`), not a code expression (`req.body.password`,
+ *     `config.get('token')`) and has real-secret shape (>= 8 chars, >= 2
+ *     character classes).
+ * The kind is exposed as `toolArgs.secretKind` so a Decision Card can say WHAT
+ * matched instead of just "contains secret".
+ */
+export type SecretKind = 'github_token' | 'aws_access_key' | 'google_api_key' | 'openai_key' | 'slack_token' | 'jwt' | 'private_key' | 'assignment' | 'high_entropy' | 'none';
+export declare function detectSecretKind(raw: string): SecretKind;
 /**
  * Check a tool call against action policies.
  * Returns the most restrictive matching verdict (pure — callers do their own logging).

package/dist/actionPolicyEngine.js

@@ -25,6 +25,7 @@ exports.resolveApprovalOptions = resolveApprovalOptions;
 exports.effectiveApprovalScope = effectiveApprovalScope;
 exports.deriveToolOperations = deriveToolOperations;
 exports.toolCapabilities = toolCapabilities;
+exports.detectSecretKind = detectSecretKind;
 exports.evaluateActionPolicies = evaluateActionPolicies;
 exports.inferToolContext = inferToolContext;
 exports.inventoryToolMatchesActionPolicy = inventoryToolMatchesActionPolicy;
@@ -416,7 +417,7 @@ function keywordAppearsAsWord(keyword, haystack) {
  * no concrete action verb was detected from the payload).
  */
 const OPERATION_MATCH_SKIP_FIELDS = new Set([
-    'toolArgs.bytes', 'toolArgs.containsSecret', 'toolArgs.containsPii', 'retry.count', 'fanout.count',
+    'toolArgs.bytes', 'toolArgs.containsSecret', 'toolArgs.secretKind', 'toolArgs.containsPii', 'retry.count', 'fanout.count',
     'toolArgs.bytes1h', 'toolArgs.mb', 'toolArgs.mb1h', 'agent.toolArgsBytes1h', 'agent.toolPayloadMb1h',
     'tool.status', 'operation.status', 'agent.baseline',
     // Identity / metadata — NOT action signals. Excluded so the tool/agent name can never
@@ -429,6 +430,15 @@ const OPERATION_MATCH_SKIP_FIELDS = new Set([
     // The action signal for file ops is the operation (read/write/delete) + path; content
     // safety (secrets, dangerous text) is Local Safety's job, not verb matching.
     'content', 'contents', 'text', 'body', 'data', 'diff', 'patch', 'newText', 'oldText',
+    // IDE edit-tool field names (Cursor StrReplace / Claude Edit / MultiEdit / Write).
+    'new_string', 'old_string', 'new_source', 'old_source', 'new_text', 'old_text', 'edits', 'replacement', 'code_edit', 'instructions',
+    // PROSE — human-readable text a tool carries along (an issue titled "Delete legacy
+    // loader", a commit message, a Slack post, a PR description). What the tool DOES is
+    // its operation/capability; the words a person typed into a title are not a verb.
+    'title', 'subject', 'description', 'message', 'msg', 'comment', 'comments', 'note', 'notes', 'summary', 'reason', 'explanation', 'prompt', 'question', 'answer',
+    'thought', 'thoughts', 'observations', 'caption', 'label', 'labels', 'tags', 'markdown', 'html', 'snippet', 'excerpt', 'transcript', 'log', 'logs', 'output', 'stdout', 'stderr',
+    // Inbound-host facts (where data comes FROM) — a host name is not an action verb.
+    'source.domain', 'source.type', 'url.risk',
     // Search PATTERNS — text being looked for, not an action (see search-intent handling
     // in inferToolContext). Searching for "DROP TABLE" is a read.
     'search.pattern',
@@ -442,11 +452,18 @@ function buildOperationMatchText(_toolName, context) {
     for (const [key, value] of Object.entries(context)) {
         if (OPERATION_MATCH_SKIP_FIELDS.has(key))
             continue;
-        if (typeof value === 'string' && value.length > 0 && value.length <= 2000)
-            parts.push(`${key} ${value}`);
+        if (typeof value !== 'string' || value.length === 0 || value.length > 2000)
+            continue;
+        // On a command line, quoted text is an argument VALUE (a commit message, a grep
+        // pattern, a description) — never a command word. `git commit -m "delete old
+        // loader"` must not satisfy a DELETE rule; `systemctl restart api` still
+        // satisfies RESTART because the verb is an unquoted command word.
+        const text = COMMAND_LINE_FIELDS.has(key) ? value.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, ' ') : value;
+        parts.push(`${key} ${text}`);
     }
     return parts.join(' ');
 }
+const COMMAND_LINE_FIELDS = new Set(['command', 'cmd', 'commandLine', 'script', 'args']);
 function stringifyArgs(args) {
     try {
         return JSON.stringify(args || {});
@@ -455,36 +472,416 @@ function stringifyArgs(args) {
         return String(args || '');
     }
 }
+/**
+ * Shannon entropy in bits per character. Random secrets sit around 4-5.5;
+ * words, identifiers, paths and placeholders sit well below 3.5. Generic —
+ * it needs no list of vendors or field names.
+ */
+function shannonEntropy(value) {
+    if (!value)
+        return 0;
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) || 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/**
+ * A standalone token that has the STATISTICS of a secret: long, mixed
+ * character classes, high entropy, and not something else that is also random-
+ * looking (a content hash / integrity string, a UUID, a git SHA, a lockfile
+ * checksum, a base64 image). Those exclusions are structural, not vocabulary.
+ */
+/** The body of a known-format token must itself look random (no `xxxx…`, `0000…`, `ABCDEF…` placeholders). */
+function plausibleTokenBody(body) {
+    if (/(.)\1{4,}/.test(body))
+        return false;
+    if (/^(?:[A-Za-z]+|[0-9]+)$/.test(body) && /^(?:abc|xyz|0123|1234|test|example|your|fake|dummy|sample)/i.test(body))
+        return false;
+    return shannonEntropy(body) >= 3.0;
+}
+function isHighEntropySecretToken(token) {
+    if (token.length < 24 || token.length > 512)
+        return false;
+    // Any URI (postgres://, redis://, amqp://, https://…) is configuration; only
+    // the password inside its userinfo can be a secret — judged as a value.
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
+        return looksLikeSecretValue(token);
+    if (/^[0-9a-f]+$/i.test(token))
+        return false; // hex digest / git sha
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token))
+        return false; // uuid
+    if (/^sha(?:1|256|384|512)-/i.test(token))
+        return false; // sri / lockfile integrity
+    if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token))
+        return false; // embedded binary
+    if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token))
+        return false; // url / path
+    if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token))
+        return false; // camelCase / snake_case identifiers
+    let classes = 0;
+    if (/[a-z]/.test(token))
+        classes++;
+    if (/[A-Z]/.test(token))
+        classes++;
+    if (/[0-9]/.test(token))
+        classes++;
+    if (/[^A-Za-z0-9]/.test(token))
+        classes++;
+    if (classes < 3)
+        return false;
+    return shannonEntropy(token) >= 4.0;
+}
+const SECRET_NAME = String.raw `(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key|secret|password|passwd|pwd|credentials?|private[_-]?key|token)`;
+// name, optional quotes/JSON escapes, = or : or =>, optional quotes/escapes, value (stops at whitespace, quotes, delimiters, backslash from JSON escaping).
+// The name may carry a prefix (`JWT_SECRET`, `STRIPE_SECRET_KEY`, `db.password`) — it is the suffix that says "this is a credential".
+const SECRET_ASSIGNMENT_RE = new RegExp(String.raw `(?:^|[^\w])[\w.-]*?${SECRET_NAME}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{8,})`, 'gi');
+// CLI flag form: --password X / --password=X / --token X / --api-key X
+const SECRET_FLAG_RE = /--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>]{8,})/gi;
+const SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an|some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
+// Code expressions are references to a secret, not the secret: req.body.password, config.get("token"), os.environ["KEY"], getSecret(), env.API_KEY
+const SECRET_CODE_EXPR_RE = /^(?:[A-Za-z_$][\w$]*(?:[.\[][^\s=]*)+|[A-Za-z_$][\w$]*\(.*\)?|process\.env\.\w+|os\.environ.*|env(?:iron)?\.\w+|new\s+\w+.*|await\s+.*|require\(.*)$/;
+function looksLikeSecretValue(raw) {
+    const value = raw.replace(/[\\"'`]+$/, '');
+    if (value.length < 8)
+        return false;
+    // `API_KEY=` (empty) followed by the next line `DATABASE_URL=…` is two assignments, not a value.
+    if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value))
+        return false;
+    if (SECRET_PLACEHOLDER_RE.test(value))
+        return false;
+    if (SECRET_CODE_EXPR_RE.test(value))
+        return false;
+    // A URL, path or hostname as a "password" value is configuration, not a credential value.
+    if (/^(?:https?:\/\/|[a-z]:\\|\.{0,2}\/|~\/)/i.test(value))
+        return false;
+    // A connection string is a secret only if the password INSIDE it is one
+    // (`postgres://user:password@localhost/app` in an example file is not).
+    const conn = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^:@\/\s]+:([^@\/\s]+)@)?/i);
+    if (conn)
+        return conn[1] ? looksLikeSecretValue(conn[1]) : false;
+    // Plain dictionary-ish word (letters only) is a description, not a secret, unless long.
+    if (/^[a-z]+$/i.test(value) && value.length < 16)
+        return false;
+    // Structural placeholder shapes: a run of one repeated character (xxxx, 0000,
+    // aaaa), a hyphen/underscore-joined phrase of plain words (unit-test-secret-not-
+    // real, change-me, your-token-here), or a "fake/test/example/..." prefix.
+    if (/(.)\1{4,}/.test(value))
+        return false;
+    if (/^[a-z]+(?:[-_.][a-z]+)+$/i.test(value))
+        return false;
+    if (/^(?:change|replace|your|my|our|example|sample|dummy|fake|test|mock|placeholder|not[-_]?real|do[-_]?not[-_]?use|insert|enter|put|paste)[-_]/i.test(value))
+        return false;
+    let classes = 0;
+    if (/[a-z]/.test(value))
+        classes++;
+    if (/[A-Z]/.test(value))
+        classes++;
+    if (/[0-9]/.test(value))
+        classes++;
+    if (/[^A-Za-z0-9]/.test(value))
+        classes++;
+    if (classes < 2)
+        return false;
+    // Real credential values are random; prose-like values are not. 3.0 bits/char
+    // separates "Tr0ub4dor&3" (3.3) from "devpassword" (2.9) deterministically.
+    return shannonEntropy(value) >= 3.0;
+}
+/** Args arrive JSON-stringified: `\n` / `\t` are two characters and `\"` is an escaped quote. Undo that so line ends and quotes terminate values. */
+function unescapeArgsText(text) {
+    return text.replace(/\\[nrt]/g, ' ').replace(/\\(["'\\/])/g, '$1');
+}
+function detectSecretKind(raw) {
+    if (!raw)
+        return 'none';
+    const value = unescapeArgsText(raw);
+    if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(value))
+        return 'private_key';
+    // Known token formats: the prefix says WHAT it is, the body must still LOOK
+    // random. `ghp_xxxxxxxxxxxxxxxxxxxx` and `AKIAXXXXXXXXXXXXXXXX` in a README
+    // are documentation, not credentials.
+    const KNOWN = [
+        ['aws_access_key', /\bAKIA([0-9A-Z]{16})\b/g],
+        ['google_api_key', /\bAIza([0-9A-Za-z_-]{30,})/g],
+        ['github_token', /\bgh[pousr]_([A-Za-z0-9_]{20,})\b/g],
+        ['openai_key', /\bsk-(?:proj-|ant-|live-|test-)?([A-Za-z0-9_-]{20,})\b/g],
+        ['slack_token', /\bxox[baprs]-([A-Za-z0-9-]{10,})\b/g],
+        ['jwt', /\beyJ[A-Za-z0-9_-]{8,}\.(eyJ[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{8,}\b/g],
+    ];
+    for (const [kind, re] of KNOWN) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(value)) !== null) {
+            if (plausibleTokenBody(m[1]))
+                return kind;
+        }
+    }
+    for (const re of [SECRET_ASSIGNMENT_RE, SECRET_FLAG_RE]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(value)) !== null) {
+            if (looksLikeSecretValue(m[1]))
+                return 'assignment';
+        }
+    }
+    // Generic: ANY field / flag / auth header whose value has the statistics of
+    // a secret — catches vendors and field names nobody listed. Position matters
+    // (a value being assigned or sent), so prose and code identifiers never qualify.
+    for (const re of [GENERIC_VALUE_RE, AUTH_HEADER_RE]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(value)) !== null) {
+            if (isHighEntropySecretToken(m[1].replace(/[\\"'`]+$/, '')))
+                return 'high_entropy';
+        }
+    }
+    return 'none';
+}
+const GENERIC_VALUE_RE = /\b[A-Za-z_][\w.-]{1,63}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{24,})/g;
+const AUTH_HEADER_RE = /\b(?:bearer|basic|token|apikey|x-api-key)\s+([A-Za-z0-9._~+/=-]{24,})/gi;
 function hasSecretLikeValue(value) {
-    return /(AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,}|gh[pousr]_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|api[_-]?key|access[_-]?token|secret|password|credential|\.env)/i.test(value);
+    return detectSecretKind(value) !== 'none';
 }
-function hasPiiLikeValue(value) {
-    return /([A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}|\+?\d[\d\s().-]{8,}\d)/i.test(value);
+/**
+ * "Contains PII" means a real person's contact data is present. Excludes the
+ * addresses every codebase is full of (example.com, noreply, localhost, test
+ * domains) and digit runs that are not phone numbers (timestamps, IPs,
+ * versions, ISO dates, hashes): a phone number needs phone punctuation and
+ * 9-15 digits.
+ */
+const PII_EMAIL_RE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
+const PII_EMAIL_IGNORE_RE = /(?:@(?:example\.(?:com|org|net)|test\.[a-z]+|localhost(?:\.[a-z]+)?|[\w.-]*\.(?:invalid|test|local|localdomain|example)|users\.noreply\.github\.com|noreply\.[\w.-]+)$|^(?:no-?reply|noreply|do-?not-?reply|test\d*|example|user\d*|admin|root|foo|bar|baz|someone|somebody|you|me|name|first\.last|john\.doe|jane\.doe|email)@)/i;
+const PII_PHONE_RE = /(?:^|[^\w.@/:-])(\+?\(?\d{1,4}\)?[\s-]\(?\d{2,4}\)?[\s-]\d{2,4}(?:[\s-]\d{2,4}){0,2})(?![\w.@/:-])/g;
+function hasPiiLikeValue(raw) {
+    if (!raw)
+        return false;
+    const value = unescapeArgsText(raw);
+    PII_EMAIL_RE.lastIndex = 0;
+    let m;
+    while ((m = PII_EMAIL_RE.exec(value)) !== null) {
+        if (PII_EMAIL_IGNORE_RE.test(m[0]))
+            continue;
+        // `user:pass@host` inside a URI (`postgres://app:pw@db.internal`, `https://key@o0.ingest.sentry.io`)
+        // is connection userinfo, not a person's address.
+        const before = value.slice(Math.max(0, m.index - 64), m.index);
+        if (/[a-z][a-z0-9+.-]*:\/\/[^\s@]*$/i.test(before))
+            continue;
+        return true;
+    }
+    PII_PHONE_RE.lastIndex = 0;
+    while ((m = PII_PHONE_RE.exec(value)) !== null) {
+        const candidate = m[1].trim();
+        if (/^\d{4}-\d{2}-\d{2}/.test(candidate))
+            continue; // ISO date
+        const digits = candidate.replace(/\D/g, '');
+        if (/^(\d)\1+$/.test(digits) || /^(?:0123456789|1234567890|555)/.test(digits))
+            continue; // 000-000-0000, 555 fixtures
+        if (digits.length >= 9 && digits.length <= 15)
+            return true;
+    }
+    return false;
 }
-function extractUrl(args, argsText) {
-    const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href;
+/**
+ * The destination of an action is a typed URL argument, or a URL in the
+ * command line / request target of the call. It is NOT a link that happens to
+ * appear inside file content, a document body or a code edit — a README that
+ * mentions https://example.com is not an egress to example.com (that misread
+ * turned every `edit_file` into `write + destination.type=external`, which an
+ * egress-block policy then stopped).
+ */
+const URL_ACTION_FIELDS = ['command', 'cmd', 'script', 'input', 'target', 'address', 'host', 'server', 'baseUrl', 'base_url', 'apiUrl', 'api_url', 'remote', 'repo', 'repository', 'source', 'destination'];
+function extractUrl(args, _argsText) {
+    const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href || args.link;
     if (typeof direct === 'string' && direct.trim())
         return direct.trim();
-    return argsText.match(/https?:\/\/[^\s"'<>]+/i)?.[0] || '';
+    for (const field of URL_ACTION_FIELDS) {
+        const value = args[field];
+        if (typeof value !== 'string')
+            continue;
+        // Web URLs first; storage / transfer schemes (s3://, gs://, ftp://) are
+        // destinations too when they appear on a command line.
+        const found = value.match(/https?:\/\/[^\s"'<>]+/i)?.[0] || value.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>]+/i)?.[0];
+        if (found)
+            return found;
+    }
+    return '';
 }
-function classifyShellCommandOperation(command) {
-    const value = command.trim().toLowerCase();
+/**
+ * A recursive removal whose EVERY target is a plain relative path inside the
+ * working tree (`rm -rf node_modules dist`, `Remove-Item -Recurse -Force .\build`,
+ * `del /s /q coverage`) is routine developer work. Anything that could reach
+ * outside the repo — an absolute path, a drive, `~`/`$HOME`/`%USERPROFILE%`,
+ * a parent reference, a bare `*` or `.`, or a shell variable whose value we
+ * cannot see — is NOT workspace-scoped and stays a destructive DELETE.
+ * Deterministic: decided from the command's own tokens, never from a guess.
+ */
+function isWorkspaceScopedRemoval(command) {
+    // Only the removal segment: `npm run build && rm -rf dist` → `rm -rf dist`.
+    const segments = command.split(/\s*(?:&&|\|\||;|\|)\s*/);
+    const removal = segments.find(seg => /\b(rm|del|remove-item|rmdir)\b/i.test(seg)) || command;
+    const tokens = removal.trim().split(/\s+/).slice(1);
+    const targets = tokens.filter(t => !/^-/.test(t) && !/^\/[fqs]$/i.test(t) && !/^-(?:recurse|force|literalpath|path|erroraction)$/i.test(t));
+    if (targets.length === 0)
+        return false;
+    return targets.every(raw => {
+        const t = raw.replace(/^["']|["']$/g, '');
+        if (!t || t === '*' || t === '.' || t === '..' || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t))
+            return false;
+        if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t))
+            return false; // absolute / drive / home
+        if (/\$|%|\$\{|\$\(|`/.test(t))
+            return false; // variable or subshell we cannot see
+        if (/(^|[\/\\])\.\.([\/\\]|$)/.test(t))
+            return false; // climbs out of the tree
+        if (/^\*\*?$|^[\/\\]?\*$/.test(t))
+            return false;
+        return true;
+    });
+}
+/**
+ * Shell classification model — Process → Command → Arguments → Target:
+ *
+ *   1. A command line is a list of SEGMENTS (`a && b`, `a; b`, `a || b`, newlines).
+ *      Each segment is classified on its own; the line takes the most severe
+ *      result (DELETE > write > SHELL > read).
+ *   2. Inside a segment the LEADING PROGRAM decides what happens. Arguments to a
+ *      program that does not execute them are data: `grep "DROP TABLE"`,
+ *      `git commit -m "delete old loader"`, `echo rm -rf` never destroy anything.
+ *      Programs that DO execute their argument (sql clients with -c/-e, `bash -c`,
+ *      `| sh`) are classified by that argument.
+ *   3. Destructive scope is decided from the target tokens (see
+ *      isWorkspaceScopedRemoval): the same `rm -rf` is a workspace write on
+ *      `node_modules` and a DELETE on `/`, `~`, a drive or a variable.
+ *
+ * Deterministic and explainable; the Local Safety catalog (regex on the exact
+ * dangerous forms) remains the hard-block layer underneath this.
+ */
+const SHELL_OP_RANK = {
+    DELETE: 4, DROP: 4, TRUNCATE: 4,
+    write: 3, INSERT: 3, UPDATE: 3, CREATE: 3, ALTER: 3, GRANT: 3, REVOKE: 3,
+    SHELL: 2,
+    read: 1, SELECT: 1, SHOW: 1, DESCRIBE: 1, EXPLAIN: 1,
+};
+const SHELL_READ_PROGRAMS = new Set([
+    'pwd', 'ls', 'dir', 'echo', 'whoami', 'cat', 'head', 'tail', 'less', 'more', 'rg', 'grep', 'egrep', 'fgrep', 'ag', 'find', 'fd', 'which', 'where', 'type', 'tree', 'stat',
+    'wc', 'env', 'printenv', 'file', 'du', 'df', 'ps', 'top', 'date', 'sort', 'uniq', 'cut', 'jq', 'yq', 'diff', 'cmp', 'md5sum', 'sha256sum',
+    'get-childitem', 'get-content', 'get-item', 'get-location', 'select-string', 'test-path', 'get-process', 'get-date', 'measure-object', 'get-command', 'resolve-path', 'gci', 'gc', 'sls',
+]);
+const SHELL_SQL_CLIENTS = new Set(['psql', 'mysql', 'mariadb', 'sqlcmd', 'sqlite3', 'mongo', 'mongosh', 'clickhouse-client', 'bq', 'cockroach', 'usql', 'pgcli', 'mycli']);
+const SHELL_NEUTRAL_BUILTINS = new Set(['cd', 'pushd', 'popd', 'export', 'set', 'unset', 'setx', 'alias', 'unalias', 'clear', 'cls', 'exit', 'true', 'false', 'sleep', 'wait', 'set-location', 'sl', 'push-location', 'pop-location', 'write-host', 'write-output']);
+function shellSegmentLead(segment) {
+    const tokens = segment.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    // `FOO=bar cmd`, `sudo cmd`, `time cmd`, `nohup cmd`, `command cmd`, `env cmd`
+    while (i < tokens.length && (/^[A-Za-z_][\w]*=/.test(tokens[i]) || /^(?:sudo|time|nohup|command|builtin|exec|nice|env)$/i.test(tokens[i])))
+        i++;
+    const lead = (tokens[i] || '').toLowerCase().replace(/^["']|["']$/g, '');
+    return lead.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat|ps1)$/i, '');
+}
+function classifyShellSegment(segment) {
+    const value = segment.trim().toLowerCase();
     if (!value)
+        return 'read';
+    const lead = shellSegmentLead(segment);
+    // Shell navigation / session builtins do nothing to the machine on their own.
+    if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead))
+        return 'read';
+    // Piping into an interpreter executes whatever came before — unknown code.
+    const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
+    // A SQL client executes the statement it is given (`psql -c "DROP TABLE x"`,
+    // `mysql -e …`, `echo "TRUNCATE …" | psql`). The exact SQL verb is the
+    // operation, so DROP / TRUNCATE / DELETE / SELECT rules stay precise.
+    const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(value);
+    if (sqlClient) {
+        const verb = segment.match(/(?<!-)\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b(?!-)/i);
+        if (verb)
+            return verb[1].toUpperCase();
         return 'SHELL';
-    if (/\b(rm\s+-rf|del\s+\/[fq]|remove-item\b.*\b-recurse\b|drop\s+(database|table|schema)|truncate\s+table|git\s+reset\s+--hard|git\s+clean\s+-fd|kubectl\s+delete|terraform\s+destroy)\b/.test(value)) {
-        return 'DELETE';
     }
-    if (/\b(git\s+status|git\s+diff|git\s+log|git\s+show|pwd|ls|dir|echo|whoami|python\s+--version|python3\s+--version|node\s+--version|npm\s+--version|gcloud\s+run\s+services\s+describe|gcloud\s+run\s+services\s+logs\s+read)\b/.test(value)) {
+    if (/\b(curl|wget|invoke-restmethod|invoke-webrequest|iwr|irm)\b/.test(value)) {
+        // Before the read programs so `cat .env | curl -d @- https://…` is still an
+        // egress WRITE. The HTTP method comes from the method flag or a request-body
+        // flag — never from the word "delete"/"post" appearing inside a URL.
+        const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
+        const hasBody = /\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file|--json|-body|-infile)\b/i.test(segment);
+        if (explicitMethod || hasBody)
+            return 'write';
+        return pipesIntoInterpreter ? 'SHELL' : 'read';
+    }
+    // Leading program that only reads/prints: its arguments are text, not actions
+    // — unless the output is redirected into a file or piped into an interpreter.
+    if (SHELL_READ_PROGRAMS.has(lead)) {
+        if (pipesIntoInterpreter)
+            return 'SHELL';
+        const redirect = value.match(/(?:^|[^>0-9])>{1,2}\s*([^\s&|;]+)/);
+        if (redirect && !/^\/dev\/null$|^nul$/i.test(redirect[1]))
+            return 'write';
         return 'read';
     }
-    if (/\b(git\s+add|git\s+commit|git\s+push|npm\s+install|pnpm\s+install|yarn\s+add|pip\s+install|gcloud\s+run\s+deploy|firebase\s+deploy|terraform\s+apply|kubectl\s+apply|docker\s+push)\b/.test(value)) {
+    // Resetting or cleaning the working tree only ever touches the repo the
+    // developer is standing in — a workspace write, not a destructive delete.
+    if (lead === 'git' && /\bgit\s+(reset\s+--hard|clean\s+-[a-z]*f[a-z]*)\b/.test(value))
         return 'write';
+    if (lead === 'git' && /\bgit\s+(?:status|diff|log|show|blame|clone|fetch|pull|ls-files|remote|branch(?!\s+-[dD])|describe|rev-parse|stash\s+(?:list|show)|tag$)\b/.test(value))
+        return 'read';
+    if (lead === 'gh' && /\bgh\s+(?:pr|issue|repo|run|release|workflow)\s+(?:view|list|status|checks|diff|download)\b/.test(value))
+        return 'read';
+    if (lead === 'gh' && /\bgh\s+auth\s+status\b/.test(value) && !/--show-token|\s-t\b/.test(value))
+        return 'read';
+    if (/^(?:gcloud\s+run\s+services\s+(?:describe|logs\s+read)|kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value))
+        return 'read';
+    if (/\b(rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r|del\s+\/[fqs]|remove-item\b.*\b-recurse\b|rmdir\s+\/s)\b/.test(value)) {
+        return isWorkspaceScopedRemoval(segment) ? 'write' : 'DELETE';
     }
-    if (/\b(curl|wget|invoke-restmethod|invoke-webrequest)\b/.test(value)) {
-        return /\b(-x|--request)\s*(post|put|patch|delete)|\b(post|put|patch|delete)\b/i.test(command) ? 'write' : 'read';
+    if (/\b(drop\s+(database|table|schema)|truncate\s+table|kubectl\s+delete|terraform\s+destroy|gcloud\s+(?:sql\s+instances|compute\s+instances|projects|run\s+services)\s+delete|az\s+(?:group|vm|sql\s+server)\s+delete|aws\s+(?:s3\s+rb|rds\s+delete-db-instance|ec2\s+terminate-instances)|docker\s+(?:system\s+prune|volume\s+rm|rm\s+-f)|mkfs|dd\s+if=)\b/.test(value)) {
+        return 'DELETE';
+    }
+    // File transfers: the LAST operand is where the data goes. Remote last = upload
+    // (egress write); remote first = download (read). `aws s3 cp x s3://b/`,
+    // `gsutil cp x gs://b/`, `scp x user@host:`, `rsync x host:/path`.
+    const xfer = value.match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
+    if (xfer) {
+        if (/az\s+storage\s+blob\s+upload/.test(value))
+            return 'write';
+        // Operands = tokens that are not flags and not the value of a `--flag value` pair.
+        const tokens = xfer[1].split(/\s+/).filter(Boolean);
+        const operands = [];
+        for (let i = 0; i < tokens.length; i++) {
+            if (tokens[i].startsWith('-')) {
+                if (!tokens[i].includes('=') && /^--?(?:profile|region|endpoint-url|sse|acl|storage-class|exclude|include|i|P|o|e|l)$/.test(tokens[i]))
+                    i++;
+                continue;
+            }
+            operands.push(tokens[i]);
+        }
+        const isRemote = (t) => /^(?:s3|gs|az|ftp|sftp|smb):\/\/|^[\w.-]+@[\w.-]+:|^[\w.-]+:(?:[\/~]|$)/.test(t);
+        const remoteIdx = operands.findIndex(isRemote);
+        const localIdx = operands.findIndex(t => !isRemote(t));
+        if (remoteIdx < 0)
+            return 'write'; // local→local copy still changes files
+        return localIdx >= 0 && remoteIdx > localIdx ? 'write' : 'read'; // remote LAST = upload
+    }
+    if (/\b(git\s+(?:add|commit|push|merge|rebase|cherry-pick|stash|checkout|switch|restore|tag\s+\S)|npm\s+(?:install|ci|i|uninstall|update|publish)|pnpm\s+(?:install|add|i)|yarn(?:\s+add|\s+install)?|pip3?\s+install|poetry\s+(?:install|add)|cargo\s+(?:build|install)|go\s+(?:build|install|get|mod)|gcloud\s+run\s+deploy|firebase\s+deploy|terraform\s+apply|kubectl\s+apply|docker\s+(?:push|build|compose\s+up)|helm\s+(?:install|upgrade))\b/.test(value)) {
+        return 'write';
     }
     return 'SHELL';
 }
+function classifyShellCommandOperation(command) {
+    const segments = command.split(/\s*(?:&&|\|\||;|\r?\n)\s*/).map(s => s.trim()).filter(Boolean);
+    if (segments.length === 0)
+        return 'SHELL';
+    let worst = 'read';
+    for (const segment of segments) {
+        const op = classifyShellSegment(segment);
+        if ((SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[worst] || 0))
+            worst = op;
+    }
+    return worst;
+}
 function isInternalHost(hostname) {
     const host = hostname.toLowerCase();
     if (!host || host === 'localhost' || host === '::1' || host.endsWith('.local') || host.endsWith('.internal'))
@@ -635,7 +1032,9 @@ function inferToolContext(toolName, args) {
     const fanoutCount = Number(args.fanoutCount ?? args.recipientCount ?? args.childCalls ?? (Array.isArray(args.recipients) ? args.recipients.length : 0));
     const burstCount = Math.max(Number.isFinite(retryCount) ? retryCount : 0, Number.isFinite(fanoutCount) ? fanoutCount : 0);
     context['toolArgs.bytes'] = String(Buffer.byteLength(argsText, 'utf8'));
-    context['toolArgs.containsSecret'] = hasSecretLikeValue(argsText) ? 'true' : 'false';
+    const secretKind = detectSecretKind(argsText);
+    context['toolArgs.containsSecret'] = secretKind !== 'none' ? 'true' : 'false';
+    context['toolArgs.secretKind'] = secretKind;
     context['toolArgs.containsPii'] = hasPiiLikeValue(argsText) ? 'true' : 'false';
     context['retry.count'] = String(burstCount);
     context['fanout.count'] = String(burstCount);
@@ -669,7 +1068,12 @@ function inferToolContext(toolName, args) {
     // and CLI flags (`--delete-branch`) must not classify as SELECT/DELETE — real SQL never
     // hyphenates these verbs. Misclassifying also poisons context.query, which would count
     // ordinary shell pipes against database session budgets.
-    const sqlArg = args.query || args.sql || args.statement || args.command || args.code || args.script || args.input || '';
+    // Shell / code-execution tools are classified by the shell model below, never
+    // by a SQL verb sniffed out of the command line — `git commit -m "delete old
+    // loader"` and `grep "DROP TABLE"` are not DELETE/DROP. A SQL client invoked
+    // from a shell (`psql -c "DROP TABLE x"`) is still caught by the shell model.
+    const isCodeExecTool = operation === toolName && /\b(node[_-]?repl|repl|shell|exec|terminal|command|run[_-]?code|bash|powershell|cmd)\b/i.test(toolName);
+    const sqlArg = args.query || args.sql || args.statement || (isCodeExecTool ? '' : (args.command || args.code || args.script || args.input)) || '';
     if (!isSearchTool && typeof sqlArg === 'string' && sqlArg.length > 0) {
         const sqlMatch = sqlArg.match(/(?<!-)\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b(?!-)/i);
         if (sqlMatch) {
@@ -681,7 +1085,9 @@ function inferToolContext(toolName, args) {
     // but classify common command text first so safe internal reads (git status, pwd, ls)
     // do not get blocked as high-impact execution.
     if (operation === toolName && /\b(node[_-]?repl|repl|shell|exec|terminal|command|run[_-]?code)\b/i.test(toolName)) {
-        operation = classifyShellCommandOperation(String(args.command || args.code || args.script || args.input || argsText || ''));
+        // Only the command text is classified — never the whole args JSON, which
+        // would let a file body or a comment turn a shell call into DELETE.
+        operation = classifyShellCommandOperation(String(args.command || args.code || args.script || args.input || ''));
     }
     // File path detection
     const pathArg = args.path || args.filepath || args.file || args.filename || '';
@@ -709,9 +1115,27 @@ function inferToolContext(toolName, args) {
         context.url = detectedUrl;
         try {
             const parsed = new URL(detectedUrl);
+            const hostType = isInternalHost(parsed.hostname) ? 'internal' : 'external';
+            // DIRECTION is the fact an egress policy means. Data flows OUT when the
+            // action writes/sends/posts; it flows IN when the action reads/fetches/
+            // clones/downloads. `destination.type` is only set for outbound flows —
+            // `curl https://api.github.com/…`, `git clone https://…`, an MCP `fetch`
+            // are sources, not destinations (blocking them as "egress" stopped every
+            // download). The host is always recorded (`destination.domain`, `url.risk`)
+            // so reach and host-based rules keep working in both directions.
+            const inbound = operation === 'read'
+                || ['GET', 'HEAD', 'OPTIONS', 'SELECT', 'SHOW', 'DESCRIBE', 'EXPLAIN'].includes(operation)
+                || (operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords)
+                    && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords));
             context['destination.domain'] = parsed.hostname;
-            context['destination.type'] = isInternalHost(parsed.hostname) ? 'internal' : 'external';
-            context['url.risk'] = isInternalHost(parsed.hostname) ? 'internal' : 'external';
+            context['url.risk'] = hostType;
+            if (inbound) {
+                context['source.domain'] = parsed.hostname;
+                context['source.type'] = hostType;
+            }
+            else {
+                context['destination.type'] = hostType;
+            }
         }
         catch {
             context['url.risk'] = 'invalid';