fullcourtdefense-cli 1.34.12 → 1.34.15

package/dist/actionPolicyEngine.d.ts

@@ -37,6 +37,13 @@ export interface ResolvedActionPolicyApproval {
     onTimeout: ActionPolicyApprovalOnTimeout;
 }
 export interface ActionPolicyRule {
+    /** Explicit, narrowly scoped permission to relax named role actions only. */
+    roleException?: {
+        roleIds: string[];
+        verbs: string[];
+    };
+    /** Set only by the role compiler; never accepted from policy authors. */
+    roleVerb?: string;
     operations: string[];
     verdict: ActionPolicyVerdict;
     constraints?: ActionPolicyConstraint[];
@@ -45,6 +52,7 @@ export interface ActionPolicyRule {
 }
 /** Reject ambiguous/broad approval exceptions at authoring time; runtime also fails closed on them. */
 export declare function approvalExceptionError(rule: ActionPolicyRule): string | undefined;
+export declare function roleExceptionError(rule: ActionPolicyRule): string | undefined;
 /**
  * The three kinds of machine a fleet policy can be written for:
  *   - `workstation` — laptops / desktops a person uses (default for any machine that does not say otherwise)

package/dist/actionPolicyEngine.js

@@ -35,6 +35,7 @@ __export(actionPolicyEngine_exports, {
   normalizeMachineKind: () => normalizeMachineKind,
   policyTargetsMachineKind: () => policyTargetsMachineKind,
   resolveApprovalOptions: () => resolveApprovalOptions,
+  roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
   toolCapabilities: () => toolCapabilities
 });
@@ -5738,6 +5739,14 @@ function parse3(input, options) {
 }
 
 // src/actionPolicyEngine.ts
+function isFirestoreQueryUrl(target) {
+  try {
+    const url = new URL(target);
+    return url.origin === "https://firestore.googleapis.com" && !url.username && !url.password && !url.search && !url.hash && /^\/v1\/projects\/[^/]+\/databases\/[^/]+\/documents(?:\/[^/]+)*:runQuery$/.test(url.pathname);
+  } catch {
+    return false;
+  }
+}
 function provenJavaScriptReadUrls(code) {
   if (code.length > 32768) return [];
   const literal2 = (value) => ({ kind: "literal", value });
@@ -5758,6 +5767,8 @@ function provenJavaScriptReadUrls(code) {
   const readProperty = (value, key) => {
     if (["constructor", "__proto__", "prototype"].includes(key)) return fail();
     if (value.kind === "object") return value.fields.get(key) || literal2(void 0);
+    if (value.kind === "array" && key === "map") return { kind: "arrayMap", items: value.items };
+    if (value.kind === "promise" && key === "catch") return callable("promise.catch");
     if (value.kind === "response") return ["json", "text"].includes(key) ? callable(`response.${key}`) : { kind: "data" };
     if (value.kind === "credential" && key === "trim") return callable("credential.trim");
     if (value.kind === "string" || value.kind === "literal" && typeof value.value === "string") {
@@ -5822,24 +5833,97 @@ function provenJavaScriptReadUrls(code) {
         const left = ev(node.left);
         const right = ev(node.right);
         if (node.operator !== "+") return fail();
-        if (left.kind === "literal" && right.kind === "literal" && typeof left.value === "string" && typeof right.value === "string") return literal2(left.value + right.value);
+        if (left.kind === "literal" && right.kind === "literal" && typeof left.value === "string" && typeof right.value === "string") {
+          if (left.value.length + right.value.length > 32768) return fail();
+          return literal2(left.value + right.value);
+        }
         if (left.kind === "literal" && left.value === "Bearer " && right.kind === "credential") return { kind: "authorization" };
         return fail();
       }
       case "ArrowFunctionExpression":
       case "FunctionExpression":
-        if (node.params.length || node.generator) return fail();
+        if (node.params.some((param) => param.type !== "Identifier") || node.generator) return fail();
         return { kind: "function", node, env: new Map(env) };
+      case "ForOfStatement": {
+        const items = ev(node.right);
+        if (node.await || items.kind !== "array" || items.items.length > 100 || node.left.type !== "VariableDeclaration" || node.left.kind !== "const" || node.left.declarations.length !== 1) return fail();
+        for (const item of items.items) {
+          const scope = new Map(env);
+          const id = node.left.declarations[0].id;
+          if (id.type === "Identifier") scope.set(id.name, item);
+          else if (id.type === "ArrayPattern" && item.kind === "array" && id.elements.length === item.items.length) {
+            id.elements.forEach((element, index) => {
+              if (element?.type !== "Identifier") fail();
+              scope.set(element.name, item.items[index]);
+            });
+          } else return fail();
+          evaluate(node.body, scope, depth + 1);
+        }
+        return literal2(void 0);
+      }
+      case "AssignmentExpression": {
+        if (node.operator !== "=" || node.left.type !== "MemberExpression" || node.left.computed || node.left.object.type !== "Identifier" || node.left.object.name !== "process" || env.has("process") || node.left.property.name !== "exitCode" || ev(node.right).kind !== "literal" || node.right.type !== "Literal" || node.right.value !== 1) return fail();
+        return literal2(void 0);
+      }
+      case "NewExpression": {
+        const constructor = ev(node.callee);
+        if (constructor.kind !== "call" || constructor.name !== "GoogleAuth" || node.arguments.length !== 1) return fail();
+        const options = ev(node.arguments[0]);
+        if (options.kind !== "object" || options.fields.size !== 1) return fail();
+        const scopes = options.fields.get("scopes");
+        if (scopes?.kind !== "array" || scopes.items.length !== 1 || string(scopes.items[0]) !== "https://www.googleapis.com/auth/datastore") return fail();
+        return object([["getClient", callable("google.getClient")]]);
+      }
       case "ReturnStatement":
         return node.argument ? ev(node.argument) : literal2(void 0);
       case "CallExpression": {
         const callee = ev(node.callee);
         const args = node.arguments.map(ev);
         if (callee.kind === "function") {
-          if (args.length) return fail();
-          return evaluate(callee.node.body, new Map(callee.env), depth + 1);
+          if (args.length !== callee.node.params.length) return fail();
+          const scope = new Map(callee.env);
+          args.forEach((value, index) => scope.set(callee.node.params[index].name, value));
+          const result = evaluate(callee.node.body, scope, depth + 1);
+          return callee.node.async ? { kind: "promise" } : result;
+        }
+        if (callee.kind === "arrayMap") {
+          if (args.length !== 1 || args[0].kind !== "function" || args[0].node.params.length !== 1 || args[0].node.async) return fail();
+          const fn = args[0];
+          return { kind: "array", items: callee.items.map((item) => {
+            const scope = new Map(fn.env);
+            scope.set(fn.node.params[0].name, item);
+            return evaluate(fn.node.body, scope, depth + 1);
+          }) };
         }
         if (callee.kind !== "call") return fail();
+        if (callee.name === "google.getClient") {
+          if (args.length) return fail();
+          return object([["request", callable("google.request")]]);
+        }
+        if (callee.name === "google.request") {
+          if (args.length !== 1 || args[0].kind !== "object") return fail();
+          const fields = args[0].fields;
+          if ([...fields.keys()].some((key) => !["url", "method", "data"].includes(key))) return fail();
+          const target = string(fields.get("url") || fail());
+          if (!isFirestoreQueryUrl(target) || string(fields.get("method") || fail()).toUpperCase() !== "POST") return fail();
+          const body = fields.get("data");
+          const passive = (value) => {
+            if (--budget < 0) return false;
+            if (value.kind === "literal") return true;
+            if (value.kind === "object") return [...value.fields.values()].every(passive);
+            return value.kind === "array" && value.items.every(passive);
+          };
+          if (body?.kind !== "object" || !body.fields.has("structuredQuery") || [...body.fields.keys()].some((key) => !["structuredQuery", "readTime", "transaction"].includes(key)) || !passive(body)) return fail();
+          urls.push(target);
+          return { kind: "data" };
+        }
+        if (callee.name === "promise.catch") {
+          if (args.length !== 1 || args[0].kind !== "function" || args[0].node.params.length !== 1) return fail();
+          const scope = new Map(args[0].env);
+          scope.set(args[0].node.params[0].name, { kind: "data" });
+          evaluate(args[0].node.body, scope, depth + 1);
+          return { kind: "data" };
+        }
         if (callee.name === "fetch") {
           if (args.length < 1 || args.length > 2) return fail();
           const target = string(args[0]);
@@ -5866,6 +5950,7 @@ function provenJavaScriptReadUrls(code) {
           return { kind: "response" };
         }
         if (callee.name === "require") {
+          if (args.length === 1 && string(args[0]) === "google-auth-library") return object([["GoogleAuth", callable("GoogleAuth")]]);
           if (args.length !== 1 || !["node:child_process", "child_process"].includes(string(args[0]))) return fail();
           return object([["execFileSync", callable("execFileSync")]]);
         }
@@ -5888,7 +5973,7 @@ function provenJavaScriptReadUrls(code) {
           if (args.length !== 1 || !jsonSafe(args[0])) return fail();
           return { kind: "string" };
         }
-        if (callee.name === "console.log") return literal2(void 0);
+        if (callee.name === "console.log" || callee.name === "console.error") return literal2(void 0);
         if (callee.name === "string.trim") {
           if (args.length) return fail();
           return { kind: "string" };
@@ -5913,14 +5998,14 @@ function provenJavaScriptReadUrls(code) {
       ["fetch", callable("fetch")],
       ["require", callable("require")],
       ["JSON", object([["stringify", callable("JSON.stringify")]])],
-      ["console", object([["log", callable("console.log")]])]
+      ["console", object([["log", callable("console.log")], ["error", callable("console.error")]])]
     ]));
     return urls;
   } catch {
     return [];
   }
 }
-function provenInlineJavaScriptRead(command, detectedUrl) {
+function provenInlineJavaScriptReadUrls(command) {
   const urls = [];
   for (const segment of splitShellSegments(command)) {
     const here = segment.match(/^\s*@'\r?\n([\s\S]*?)\r?\n'@\s*\|\s*node(?:\.exe)?(?:\s+-)?\s*$/i);
@@ -5928,16 +6013,201 @@ function provenInlineJavaScriptRead(command, detectedUrl) {
     const code = here?.[1] ?? inline?.[1];
     if (code !== void 0) {
       const proven = provenJavaScriptReadUrls(code);
-      if (!proven.length) return false;
+      if (!proven.length) return [];
       urls.push(...proven);
     } else {
       const lead = shellSegmentLead(segment);
-      if (!(SHELL_READ_PROGRAMS.has(lead) || ["git", "gh", "cd", "set-location"].includes(lead)) || classifyShellCommandOperation(segment) !== "read" || /https?:\/\//i.test(segment)) return false;
+      if (!(SHELL_READ_PROGRAMS.has(lead) || ["git", "gh", "cd", "set-location"].includes(lead)) || classifyShellCommandOperation(segment) !== "read" || /https?:\/\//i.test(segment)) return [];
     }
   }
-  return urls.includes(detectedUrl);
+  return urls;
+}
+function provenPowerShellQueryUrls(command) {
+  if (command.length > 32768) return [];
+  const prefix = /^\s*(?:git\s+status(?:\s+--short)?(?:\s+--branch)?|(?:cd|Set-Location)\s+(?:[A-Za-z]:[\\/][A-Za-z0-9_./\\-]+|'[A-Za-z]:[\\/][A-Za-z0-9_ ./\\-]+'))\s*(?:&&|;)\s*/i;
+  for (let count = 0; count < 8 && prefix.test(command); count++) command = command.replace(prefix, "");
+  const credential = Object.freeze({ credential: 1 });
+  const authorization = Object.freeze({ authorization: 1 });
+  const urls = [];
+  const env = /* @__PURE__ */ new Map();
+  const tokens = [];
+  const fail = () => {
+    throw new Error("Unsupported PowerShell query");
+  };
+  const lexer = /[ \t]+|\r?\n|@\{|@\(|'(?:[^']|'')*'|"[^"`]*"|\$[A-Za-z_][A-Za-z0-9_]*|-[A-Za-z]+|[A-Za-z_][A-Za-z0-9_-]*|\d+|[{}();=+|,]/gy;
+  let offset2 = 0;
+  let budget = 8e3;
+  let pos = 0;
+  const take = () => {
+    if (--budget < 0 || pos >= tokens.length) return fail();
+    return tokens[pos++];
+  };
+  const peek = () => tokens[pos];
+  const expect = (token) => {
+    if (take().toLowerCase() !== token.toLowerCase()) fail();
+  };
+  const separators = () => {
+    while (peek() === ";") take();
+  };
+  const passive = (value) => {
+    if (--budget < 0 || value === credential || value === authorization) return false;
+    if (typeof value !== "object") return true;
+    return Object.values(value).every(passive);
+  };
+  const expression = () => {
+    const token = take();
+    let value;
+    if (token.startsWith("'")) value = token.slice(1, -1).replace(/''/g, "'");
+    else if (token.startsWith('"')) {
+      const text = token.slice(1, -1);
+      const bearer = text.match(/^Bearer (\$[A-Za-z_][A-Za-z0-9_]*)$/);
+      if (bearer && env.get(bearer[1].toLowerCase()) === credential) value = authorization;
+      else {
+        if (/[$`]/.test(text)) return fail();
+        value = text;
+      }
+    } else if (token.startsWith("$")) value = env.get(token.toLowerCase()) ?? fail();
+    else if (/^\d+$/.test(token)) value = Number(token);
+    else if (token === "(") {
+      value = expression();
+      expect(")");
+    } else if (token === "@(") {
+      const items = [];
+      separators();
+      while (peek() !== ")") {
+        items.push(expression());
+        separators();
+        if (peek() !== ")") expect(",");
+      }
+      expect(")");
+      value = items;
+    } else if (token === "@{") {
+      const fields = /* @__PURE__ */ Object.create(null);
+      separators();
+      while (peek() !== "}") {
+        const key = take();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || Object.hasOwn(fields, key)) return fail();
+        expect("=");
+        fields[key] = expression();
+        if (peek() !== "}") expect(";");
+        separators();
+      }
+      expect("}");
+      value = fields;
+    } else if (token.toLowerCase() === "if") {
+      expect("(");
+      const left = expression();
+      expect("-eq");
+      const right = expression();
+      expect(")");
+      if (typeof left === "object" || typeof right === "object") return fail();
+      expect("{");
+      const yes = expression();
+      expect("}");
+      expect("else");
+      expect("{");
+      const no = expression();
+      expect("}");
+      value = left === right ? yes : no;
+    } else if (token.toLowerCase() === "gcloud") {
+      expect("auth");
+      expect("print-access-token");
+      value = credential;
+    } else return fail();
+    while (peek() === "+") {
+      take();
+      const right = expression();
+      if (typeof value !== "string" || typeof right !== "string" || value.length + right.length > 32768) return fail();
+      value += right;
+    }
+    if (peek() === "|") {
+      take();
+      expect("ConvertTo-Json");
+      expect("-Depth");
+      const depth = take();
+      if (!/^\d+$/.test(depth) || Number(depth) > 100 || !passive(value)) return fail();
+    }
+    return value;
+  };
+  const statement = () => {
+    if (peek()?.startsWith("$")) {
+      const name = take().toLowerCase();
+      expect("=");
+      if (["$env", "$psdefaultparametervalues", "$executioncontext", "$erroractionpreference", "$home", "$profile"].includes(name)) return fail();
+      env.set(name, expression());
+      return;
+    }
+    if (peek()?.toLowerCase() === "foreach") {
+      take();
+      expect("(");
+      const name = take().toLowerCase();
+      if (!/^\$[a-z_][a-z0-9_]*$/.test(name)) return fail();
+      expect("in");
+      const items = expression();
+      expect(")");
+      expect("{");
+      if (!Array.isArray(items) || !items.length || items.length > 100) return fail();
+      const start = pos;
+      for (const item of items) {
+        env.set(name, item);
+        pos = start;
+        separators();
+        while (peek() !== "}") {
+          statement();
+          if (peek() !== "}") expect(";");
+          separators();
+        }
+        expect("}");
+      }
+      return;
+    }
+    expect("Invoke-RestMethod");
+    const options = /* @__PURE__ */ new Map();
+    while (peek()?.startsWith("-")) {
+      const flag = take().toLowerCase();
+      if (options.has(flag)) return fail();
+      options.set(flag, flag === "-method" ? take() : expression());
+    }
+    if ([...options.keys()].some((key) => !["-method", "-uri", "-headers", "-contenttype", "-body"].includes(key))) return fail();
+    const target = options.get("-uri");
+    if (typeof target !== "string") return fail();
+    if (!isFirestoreQueryUrl(target) || String(options.get("-method")).toUpperCase() !== "POST" || options.get("-contenttype") !== "application/json") return fail();
+    const headers = options.get("-headers");
+    const body = options.get("-body");
+    if (!headers || typeof headers !== "object" || Array.isArray(headers) || Object.keys(headers).length !== 1 || headers.Authorization !== authorization) return fail();
+    if (!body || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, "structuredQuery") || Object.keys(body).some((key) => !["structuredQuery", "transaction", "readTime"].includes(key)) || !passive(body)) return fail();
+    urls.push(target);
+    if (peek() === "|") {
+      take();
+      expect("ConvertTo-Json");
+      expect("-Depth");
+      if (!/^\d+$/.test(take())) fail();
+    }
+  };
+  try {
+    while (offset2 < command.length) {
+      lexer.lastIndex = offset2;
+      const match = lexer.exec(command);
+      if (!match) return [];
+      offset2 = lexer.lastIndex;
+      const token = match[0];
+      if (/^[ \t]+$/.test(token)) continue;
+      tokens.push(/\r?\n/.test(token) && token.length <= 2 ? ";" : token);
+    }
+    separators();
+    while (pos < tokens.length) {
+      statement();
+      if (pos < tokens.length) expect(";");
+      separators();
+    }
+    return urls;
+  } catch {
+    return [];
+  }
 }
 function approvalExceptionError(rule) {
+  const roleError = roleExceptionError(rule);
+  if (roleError) return roleError;
   const ids = rule.approval?.replacesPolicyIds;
   if (ids === void 0) return void 0;
   if (!Array.isArray(ids) || ids.length > 50 || ids.some((id) => typeof id !== "string" || !id.trim())) {
@@ -5952,6 +6222,19 @@ function approvalExceptionError(rule) {
   }
   return void 0;
 }
+function roleExceptionError(rule) {
+  const exception = rule.roleException;
+  if (exception === void 0) return void 0;
+  if (!exception || rule.verdict !== "allow") return "A role exception must use Allow.";
+  const valid = (values, permitted) => Array.isArray(values) && values.length > 0 && values.length <= permitted.length && values.every((value) => typeof value === "string" && permitted.includes(value));
+  if (!valid(exception.roleIds, ["read_only", "standard", "power", "unrestricted"]) || !valid(exception.verbs, ["read", "write", "delete", "drop", "deploy", "export", "send", "payment"])) {
+    return "Select valid roles and role actions for the exception.";
+  }
+  if (!["agentName", "toolName"].every((field) => rule.constraints?.some((c) => c.field === field && c.operator === "equals" && typeof c.value === "string" && c.value.trim() && !/[?*]/.test(c.value)))) {
+    return "A role exception must identify an exact agent and exact tool.";
+  }
+  return void 0;
+}
 var MACHINE_KINDS = ["workstation", "ci", "workload"];
 function normalizeMachineKind(value) {
   const kind = (value || "").trim().toLowerCase();
@@ -6445,6 +6728,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "destination.domain",
   "destination.host",
   "destination.type",
+  "destination.repository",
   "destinationHost",
   "host",
   "hostname",
@@ -6643,6 +6927,63 @@ function hasPiiLikeValue(raw) {
   return false;
 }
 var URL_ACTION_FIELDS = ["command", "cmd", "script", "input", "target", "address", "host", "server", "baseUrl", "base_url", "apiUrl", "api_url", "remote", "repo", "repository", "source", "destination"];
+function explicitGitHubWriteRepository(command) {
+  if (command.length > 65536 || /[%!]/.test(command)) return void 0;
+  const segments = splitShellSegments(command);
+  if (segments.length !== 1) return void 0;
+  const segment = segments[0];
+  const tokens = [];
+  const token = /[ \t]*(?:'([^'\r\n]*)'|"([^"$`\\\r\n]*)"|([^\s'"$`\\|;&<>(){}\r\n]+))/gy;
+  let offset2 = 0;
+  while (offset2 < segment.length) {
+    token.lastIndex = offset2;
+    const match = token.exec(segment);
+    if (!match || token.lastIndex < segment.length && !/[ \t]/.test(segment[token.lastIndex])) return void 0;
+    if (match[3] !== void 0 && (!/^[a-z0-9_./:@=+-]+$/i.test(match[3]) || match[3].startsWith("@"))) return void 0;
+    if (match[1] !== void 0 && /[|;&<>()$`^]/.test(match[1])) return void 0;
+    tokens.push(match[1] ?? match[2] ?? match[3]);
+    offset2 = token.lastIndex;
+  }
+  if (!/^gh(?:\.exe)?$/i.test(tokens[0] || "")) return void 0;
+  let repository;
+  let resource;
+  let operation;
+  let positional;
+  const canonical = (value) => {
+    const match = /^([a-z0-9][a-z0-9.-]*\.[a-z0-9-]+)\/([a-z0-9][a-z0-9-]*)\/([a-z0-9_.-]+)$/i.exec(value);
+    if (!match || /^(?:\.|\.\.)$/.test(match[3]) || /\.git$/i.test(match[3])) return void 0;
+    return `${match[1]}/${match[2]}/${match[3]}`.toLowerCase();
+  };
+  for (let i2 = 1; i2 < tokens.length; i2++) {
+    const value = tokens[i2];
+    if (value === "-R" || value === "--repo" || value.startsWith("--repo=") || /^-R.+/.test(value)) {
+      if (repository) return void 0;
+      const selector = value === "-R" || value === "--repo" ? tokens[++i2] : value.replace(/^(?:--repo=|-R)/, "");
+      repository = canonical(selector || "");
+      if (!repository) return void 0;
+    } else if (["--body", "-b", "--body-file", "-F", "--title", "-t"].includes(value)) {
+      if (!tokens[++i2]) return void 0;
+    } else if (/^--(?:body|body-file|title)=.+/.test(value)) {
+      continue;
+    } else if (["--edit-last", "--create-if-none", "--delete-last", "--yes"].includes(value)) {
+      continue;
+    } else if (value.startsWith("-")) {
+      return void 0;
+    } else if (!resource) resource = value;
+    else if (!operation) operation = value;
+    else if (!positional) positional = value;
+    else return void 0;
+  }
+  if (!["pr", "issue"].includes(resource || "") || !["comment", "create", "edit"].includes(operation || "")) return void 0;
+  if (positional?.startsWith("https://")) {
+    const target = /^https:\/\/([^/]+)\/([^/]+)\/([^/]+)\/(pull|issues)\/[1-9][0-9]*\/?$/.exec(positional);
+    if (!target || (resource === "pr" ? target[4] !== "pull" : target[4] !== "issues")) return void 0;
+    const fromUrl = canonical(`${target[1]}/${target[2]}/${target[3]}`);
+    if (!fromUrl || repository && repository !== fromUrl) return void 0;
+    repository = fromUrl;
+  } else if (positional && !/^[1-9][0-9]*$/.test(positional)) return void 0;
+  return repository;
+}
 function extractUrl(args, _argsText) {
   const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href || args.link;
   if (typeof direct === "string" && direct.trim()) return direct.trim();
@@ -7118,9 +7459,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   const ruleMatches = (rule) => candidateOperations.some((candidate) => operationMatchesRule(candidate, rule.operations, matchText, toolCaps)) && (!rule.constraints?.length || rule.constraints.every((c) => evaluateConstraint(c, context)));
   const replacedApprovalPolicies = /* @__PURE__ */ new Set();
   const appliedApprovalExceptions = /* @__PURE__ */ new Set();
+  const roleExceptions = [];
+  const appliedRoleExceptions = /* @__PURE__ */ new Set();
+  let grantingRoleException;
   for (const policy of policies) {
     if (!policyApplies(policy) || policy.stage === "monitor") continue;
     for (const rule of policy.rules) {
+      if (rule.roleException && !roleExceptionError(rule) && ruleMatches(rule)) roleExceptions.push({ policy, rule });
       if (rule.verdict !== "require_approval" || rule.approval?.scope !== "developer" || !ruleMatches(rule)) continue;
       if (approvalExceptionError(rule) || !Array.isArray(rule.approval.replacesPolicyIds)) continue;
       for (const id of rule.approval.replacesPolicyIds) {
@@ -7138,6 +7483,15 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     const isMonitorStage = policy.stage === "monitor";
     for (const rule of policy.rules) {
       if (!ruleMatches(rule)) continue;
+      if (!isMonitorStage && policy.resourceType === "machine_role" && policy.enforcement !== "hard" && rule.roleVerb && (rule.verdict === "block" || rule.verdict === "require_approval")) {
+        const roleId = policy.id.startsWith("machine-role:") ? policy.id.split(":")[1] : "";
+        const exception = roleExceptions.find((item) => item.rule.roleException.roleIds.includes(roleId) && item.rule.roleException.verbs.includes(rule.roleVerb));
+        if (exception) {
+          grantingRoleException = exception.policy;
+          appliedRoleExceptions.add(`${exception.policy.name} (${exception.policy.id}) relaxes ${policy.name}: ${rule.roleVerb}`);
+          continue;
+        }
+      }
       if (!isMonitorStage && rule.verdict === "require_approval" && rule.approval?.scope !== "developer" && policy.enforcement !== "hard" && replacedApprovalPolicies.has(policy.id)) {
         appliedApprovalExceptions.add(`${policy.name} (${policy.id})`);
         continue;
@@ -7215,6 +7569,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   if (monitorMatches.length > 0) {
     worstResult = { ...worstResult, monitorMatches };
   }
+  if (appliedRoleExceptions.size) {
+    worstResult = {
+      ...worstResult,
+      ...worstResult.verdict === "allow" && grantingRoleException ? { policyId: grantingRoleException.id, policyName: grantingRoleException.name, resourceType: grantingRoleException.resourceType } : {},
+      reason: `${worstResult.reason || worstResult.verdict}; explicit role exception: ${[...appliedRoleExceptions].sort().join("; ")}`
+    };
+  }
   if (skippedOrgPolicies.length > 0) {
     worstResult = { ...worstResult, skippedOrgPolicies };
   }
@@ -7282,13 +7643,14 @@ function inferToolContext(toolName, args) {
     operation = methodArg;
     if (args.url) context.url = args.url;
   }
-  const detectedUrl = extractUrl(args, argsText);
+  const provenReadUrls = isCodeExecTool && !hasSecretLikeValue(argsText) ? [...provenInlineJavaScriptReadUrls(commandText), ...provenPowerShellQueryUrls(commandText)] : [];
+  const detectedUrl = provenReadUrls[0] || extractUrl(args, argsText);
   if (detectedUrl) {
     context.url = detectedUrl;
     try {
       const parsed = new URL(detectedUrl);
       const hostType = isInternalHost(parsed.hostname) ? "internal" : "external";
-      const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || operation === "SHELL" && isCodeExecTool && !hasSecretLikeValue(argsText) && provenInlineJavaScriptRead(commandText, detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
+      const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || provenReadUrls.includes(detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
       if (inbound) {
@@ -7316,6 +7678,15 @@ function inferToolContext(toolName, args) {
     context.amount = String(args.amount ?? args.price ?? args.total);
   }
   context["action.kind"] = isCodeExecTool || toolNameLower === "shell" ? "shell" : context.query !== void 0 && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? "database" : ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg) ? "http" : context.path !== void 0 && (operation === "read" || operation === "write" || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? "file" : "tool";
+  delete context["destination.repository"];
+  if (isCodeExecTool) {
+    const repository = explicitGitHubWriteRepository(String(args.command || args.cmd || args.code || args.script || args.input || ""));
+    if (repository) {
+      context["destination.repository"] = repository;
+      context["destination.domain"] = repository.split("/")[0];
+      context["destination.type"] = isInternalHost(context["destination.domain"]) ? "internal" : "external";
+    }
+  }
   return { operation, context };
 }
 function inferInventoryToolOperations(toolName, toolActions = []) {
@@ -7357,6 +7728,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   normalizeMachineKind,
   policyTargetsMachineKind,
   resolveApprovalOptions,
+  roleExceptionError,
   ruleNeedsContentFact,
   toolCapabilities
 });

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.12"
+  "version": "1.34.15"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.12",
+  "version": "1.34.15",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {