fullcourtdefense-cli 1.34.20 → 1.34.21

package/dist/actionPolicyEngine.js

@@ -7475,10 +7475,23 @@ function provenCompoundDownload(command, detectedUrl) {
     const pieces = raw.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g) || [];
     if (pieces.join("").replace(/\s/g, "") !== raw.replace(/\s/g, "")) return false;
     const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
-    if (!/^(?:curl(?:\.exe)?|wget(?:\.exe)?|Invoke-RestMethod|Invoke-WebRequest|irm|iwr)$/i.test(tokens.shift() || "")) return false;
+    const program = tokens.shift() || "";
+    if (!/^(?:curl(?:\.exe)?|wget(?:\.exe)?|Invoke-RestMethod|Invoke-WebRequest|irm|iwr)$/i.test(program)) return false;
+    const isCurl = /^curl(?:\.exe)?$/i.test(program);
     let urls = 0;
     for (let i2 = 0; i2 < tokens.length; i2++) {
       const token = tokens[i2];
+      if (isCurl && /^(?:--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+        i2++;
+        continue;
+      }
+      if (isCurl && /^(?:-o|--output)$/.test(token)) {
+        const output = tokens[i2 + 1] || "";
+        const local = output.replace(/^[A-Za-z]:[\\/]/, "");
+        if (!local || /^[-\\/]/.test(local) || /[^\w .\\/-]/.test(local) || /^(?:CON|PRN|AUX|NUL|COM\d|LPT\d)(?:\.|$)/i.test(local.split(/[\\/]/).pop() || "")) return false;
+        i2++;
+        continue;
+      }
       if (/^https?:\/\//i.test(token)) {
         urls++;
         continue;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.20"
+  "version": "1.34.21"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.20",
+  "version": "1.34.21",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {