fullcourtdefense-cli 1.34.21 → 1.34.25

package/README.md

@@ -73,6 +73,7 @@ fullcourtdefense init
 - `fullcourtdefense help` — shows the full onboarding flow and command reference.
 - `fullcourtdefense onboard --token <token>` — resumable machine transaction: preflight + login + protection + optional discovery + verification. `--json true` prints final machine-readable status; exits non-zero only when a critical step fails.
 - `fullcourtdefense doctor` — confirms outbound HTTPS to FullCourtDefense is open before scanning.
+- `fullcourtdefense hotfix-status` — shows the loaded detector revision and whether fallback is active. Available from 1.34.22. Updates arrive through the background daemon; this command reads local status and does not force a download. Acceptance alone does not prove that a reported false alarm was corrected.
 - `fullcourtdefense login --token <token>` — enrolls this machine with a fleet token and saves per-machine Shield credentials (no copy/paste).
 - `fullcourtdefense install-all` — wraps every configured MCP server, installs IDE hooks and terminal guards, uploads discovery, schedules daily rescans.
 - `fullcourtdefense configure` — legacy/manual setup: saves org API key, Shield ID, Shield key, and API URL to `.fullcourtdefense.yml` (use `login` instead when you have a fleet token).

package/dist/actionIdentity.d.ts

@@ -3,6 +3,7 @@ export interface ActionIdentity {
     sessionId?: string;
     runId?: string;
     instanceId?: string;
+    attemptId?: string;
 }
 export declare function identityPart(value: unknown): string | undefined;
 export declare function captureActionIdentity(payload?: Record<string, unknown>, env?: NodeJS.ProcessEnv): ActionIdentity;

package/dist/actionIdentity.js

@@ -11,5 +11,7 @@ function captureActionIdentity(payload = {}, env = process.env) {
             || env.FCD_SESSION_ID || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID),
         runId: identityPart(env.FCD_RUN_ID || env.GITHUB_RUN_ID || env.CI_PIPELINE_ID),
         instanceId: identityPart(env.FCD_WORKLOAD_INSTANCE_ID),
+        // Never use a generic request id: some clients reuse it for unrelated calls.
+        attemptId: identityPart(payload.tool_use_id || payload.tool_call_id),
     };
 }

package/dist/actionPolicyEngine.d.ts

@@ -234,5 +234,10 @@ export declare function inferToolContext(toolName: string, args: Record<string,
     operation: string;
     context: Record<string, string>;
 };
+/** Exported for reproducible detector artifacts; policy decisions are not packaged. */
+export declare function inferBundledToolContext(toolName: string, args: Record<string, any>): {
+    operation: string;
+    context: Record<string, string>;
+};
 /** Static inventory match — same operation rules as runtime, without constraint context. */
 export declare function inventoryToolMatchesActionPolicy(toolName: string, toolActions: string[] | undefined, policies: EngineActionPolicy[]): boolean;

package/dist/actionPolicyEngine.js

@@ -29,6 +29,7 @@ __export(actionPolicyEngine_exports, {
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
+  inferBundledToolContext: () => inferBundledToolContext,
   inferToolContext: () => inferToolContext,
   inventoryToolMatchesActionPolicy: () => inventoryToolMatchesActionPolicy,
   isLocalFileContentAction: () => isLocalFileContentAction,
@@ -5740,6 +5741,7 @@ function parse3(input, options) {
 
 // src/actionPolicyEngine.ts
 var import_detectionData = require("./detectionData");
+var import_detectorRuntime = require("./detectorRuntime");
 function isFirestoreQueryUrl(target) {
   try {
     const url = new URL(target);
@@ -5790,6 +5792,27 @@ function provenJavaScriptReadUrls(code) {
       }
       case "EmptyStatement":
         return literal2(void 0);
+      case "IfStatement": {
+        ev(node.test);
+        evaluate(node.consequent, new Map(env), depth + 1);
+        if (node.alternate) evaluate(node.alternate, new Map(env), depth + 1);
+        return literal2(void 0);
+      }
+      case "UnaryExpression": {
+        if (node.operator !== "!") return fail();
+        ev(node.argument);
+        return { kind: "data" };
+      }
+      case "ThrowStatement":
+        return ev(node.argument);
+      case "TemplateLiteral": {
+        for (const expression of node.expressions) {
+          const value = ev(expression);
+          if (!["literal", "data", "string"].includes(value.kind)) return fail();
+          if (value.kind === "literal" && value.value !== null && typeof value.value === "object") return fail();
+        }
+        return { kind: "string" };
+      }
       case "ExpressionStatement":
       case "AwaitExpression":
       case "ChainExpression":
@@ -5833,6 +5856,7 @@ function provenJavaScriptReadUrls(code) {
       case "BinaryExpression": {
         const left = ev(node.left);
         const right = ev(node.right);
+        if (node.operator === "===" || node.operator === "!==") return { kind: "data" };
         if (node.operator !== "+") return fail();
         if (left.kind === "literal" && right.kind === "literal" && typeof left.value === "string" && typeof right.value === "string") {
           if (left.value.length + right.value.length > 32768) return fail();
@@ -5868,6 +5892,12 @@ function provenJavaScriptReadUrls(code) {
       }
       case "NewExpression": {
         const constructor = ev(node.callee);
+        if (constructor.kind === "call" && constructor.name === "Error") {
+          if (node.arguments.length !== 1) return fail();
+          const message = ev(node.arguments[0]);
+          if (message.kind !== "string" && !(message.kind === "literal" && typeof message.value === "string")) return fail();
+          return { kind: "data" };
+        }
         if (constructor.kind !== "call" || constructor.name !== "GoogleAuth" || node.arguments.length !== 1) return fail();
         const options = ev(node.arguments[0]);
         if (options.kind !== "object" || options.fields.size !== 1) return fail();
@@ -5998,6 +6028,7 @@ function provenJavaScriptReadUrls(code) {
     evaluate(tree, /* @__PURE__ */ new Map([
       ["fetch", callable("fetch")],
       ["require", callable("require")],
+      ["Error", callable("Error")],
       ["JSON", object([["stringify", callable("JSON.stringify")]])],
       ["console", object([["log", callable("console.log")], ["error", callable("console.error")]])]
     ]));
@@ -6738,14 +6769,17 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "recipients",
   "from",
   "cc",
-  "bcc"
+  "bcc",
+  "domain",
+  "destinationType",
+  "toolStatus"
 ]);
 function buildOperationMatchText(_toolName, context) {
   const parts = [];
   for (const [key, value] of Object.entries(context)) {
     const fieldWords = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_.-]/);
     const identifierField = /^(?:id|ids|uuid|uuids|guid|guids)$/.test(fieldWords[fieldWords.length - 1]);
-    if (OPERATION_MATCH_SKIP_FIELDS.has(key) || identifierField) continue;
+    if (OPERATION_MATCH_SKIP_FIELDS.has(key) || identifierField || key.startsWith("args.") || key.startsWith("request.")) continue;
     if (typeof value !== "string" || value.length === 0 || value.length > 2e3) continue;
     const text = COMMAND_LINE_FIELDS.has(key) ? shellVerbWords(value) : value;
     parts.push(`${key} ${text}`);
@@ -6818,6 +6852,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
+  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
   if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token)) return false;
@@ -6988,8 +7023,15 @@ function explicitGitHubWriteRepository(command) {
 function withoutUnattributedJavaScriptUrls(segment) {
   if (segment.length > 32768) return segment;
   const inline = /^\s*node(?:\.exe)?\s+(?:-e|--eval)\s+(?:"([^"$`\\]*)"|'([^']*)')\s*$/i.exec(segment);
-  if (!inline) return segment;
-  const code = inline[1] ?? inline[2];
+  let code;
+  if (inline) code = inline[1] ?? inline[2];
+  else {
+    const raw = segment.trim();
+    const opening = /^@'\r?\n/.exec(raw);
+    const end = opening ? hereStringEnd(raw, 0) : -1;
+    if (!opening || end < 0 || !/^\s*\|\s*node(?:\.exe)?(?:\s+-)?\s*$/i.test(raw.slice(end))) return segment;
+    code = raw.slice(opening[0].length, end - 3);
+  }
   let budget = 4e3;
   try {
     const tree = parse3(code, { ecmaVersion: "latest", sourceType: "script", allowAwaitOutsideFunction: true });
@@ -7051,8 +7093,12 @@ function extractUrl(args, _argsText) {
 }
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
+  if (/\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(command))) return command;
+  const fileSyntax = (text) => text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
   const originalSegments = splitShellSegments(command);
   const localPaths = /* @__PURE__ */ new Map();
+  const literalValues = /* @__PURE__ */ new Map();
+  const dataAssignments = /* @__PURE__ */ new Set();
   const pathAssignments = /* @__PURE__ */ new Set();
   let expandedSize = command.length;
   let expansionOverflow = false;
@@ -7065,6 +7111,11 @@ function shellUrlActionText(command) {
     return value;
   };
   const segments = originalSegments.map((segment, index) => {
+    const dataAssignment = /^\$([A-Za-z_][\w]*)\s*=\s*(@'\r?\n[\s\S]*?\r?\n'@|'(?:[^']|'')*')$/.exec(segment);
+    if (dataAssignment && !literalValues.has(dataAssignment[1].toLowerCase()) && literalValues.size < 32) {
+      literalValues.set(dataAssignment[1].toLowerCase(), dataAssignment[2]);
+      dataAssignments.add(index);
+    }
     const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(?:'([^']*)'|"([^"$`]*)")$/.exec(segment);
     if (assignment) {
       const name = assignment[1].toLowerCase();
@@ -7086,7 +7137,14 @@ function shellUrlActionText(command) {
       const value = localPaths.get(name.toLowerCase());
       return value ? expand(match, `"${value}"`) : match;
     });
-    return prefix + tail;
+    const expanded = prefix + fileSyntax(tail);
+    return expanded.replace(
+      /^(Set-Content|Add-Content|Out-File)(\s+[\s\S]*?\s+-(?:Value|InputObject)\s+)\$([A-Za-z_][\w]*)(\s+-[\s\S]*|\s*)$/i,
+      (match, writer, options, name, suffix) => {
+        const value = literalValues.get(name.toLowerCase());
+        return value ? expand(match, writer + options + value + suffix) : match;
+      }
+    );
   });
   if (expansionOverflow) return command;
   const filtered = segments.map((segment) => {
@@ -7121,15 +7179,26 @@ function shellUrlActionText(command) {
     return tail;
   });
   const onlyStoredData = segments.every((segment, index) => {
+    if (dataAssignments.has(index)) return true;
     if (pathAssignments.has(index)) return true;
     if (filtered[index] !== segment) return true;
+    if (/^\$[A-Za-z_][\w]*\s*=\s*\$null$/i.test(segment)) return true;
+    if (/^\[System\.Management\.Automation\.Language\.Parser\]::ParseFile\("[^"$`\r\n|;&<>]*",\s*\[ref\]\$[A-Za-z_][\w]*,\s*\[ref\]\$[A-Za-z_][\w]*\)\s*\|\s*Out-Null$/i.test(segment)) return true;
+    if (/^if\s*\(\$([A-Za-z_][\w]*)\.Count\)\s*\{\s*throw\s+\$\1\[0\]\s*\}$/i.test(segment)) return true;
+    if (/^Write-Output\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    if (/^gh\s+pr\s+checks\s+\d+\s+--json\s+[a-z,]+\s+--jq\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    const read = /^Get-Content\s+(?:(?:-LiteralPath|-Path)\s+)?(?:'([^'$`\r\n]*)'|"([^"$`\r\n]*)"|([^\s'"$`|;&(){}<>]+))(?:\s+-(?:Tail|TotalCount)\s+\d{1,6})?(?:\s+-Raw)?\s*$/i.exec(segment);
+    if (read) {
+      const target = read[1] ?? read[2] ?? read[3];
+      if (target && !target.startsWith("-") && !/^[\\/]{2}|[\r\n*?\[\]<>]/.test(target) && !/:/.test(target.replace(/^[A-Za-z]:[\\/]/, ""))) return true;
+    }
     const directory = /^New-Item\s+-ItemType\s+Directory\s+(?:-Force\s+)?-(?:LiteralPath|Path)\s+(?:'([^']*)'|"([^"$`]*)")\s*(?:\|\s*Out-Null)?$/i.exec(segment);
     if (directory && /^(?:[A-Za-z]:[\\/]|\/(?!\/))[\w ./\\-]+$/.test(directory[1] ?? directory[2])) return true;
     const words = maskQuotedSpans(segment);
     if (!/[$`|;&(){}<>]/.test(segment) && /^(?:(?:cd|pushd|set-location)\s+[^\r\n]+|(?:pwd|popd|get-location)|git\s+status(?:\s+[^\r\n]+)?)$/i.test(segment)) return true;
     return !/[$`]/.test(segment) && /^\(Get-Content\s+(?:[A-Za-z]:[\\/])?[\w./\\-]+\s+-Raw\)\.Replace\("",\s*""\)\s*\|\s*Set-Content\s+(?:[A-Za-z]:[\\/])?[\w./\\-]+\s+-Encoding\s+utf8\s*$/i.test(words);
   });
-  return onlyStoredData && filtered.some((value, index) => value !== segments[index]) ? filtered.join("\n") : command;
+  return onlyStoredData && filtered.some((value, index) => value !== segments[index]) ? filtered.filter((_, index) => !dataAssignments.has(index)).join("\n") : command;
 }
 function splitShellSegments(command, alsoOnPipe = false) {
   const out = [];
@@ -7367,14 +7436,22 @@ function shellSegmentLead(segment) {
   const tokens = segment.trim().split(/\s+/).filter(Boolean);
   let i2 = 0;
   while (i2 < tokens.length && (/^[A-Za-z_][\w]*=/.test(tokens[i2]) || /^(?:sudo|time|nohup|command|builtin|exec|nice|env)$/i.test(tokens[i2]))) i2++;
-  const lead = (tokens[i2] || "").toLowerCase().replace(/^["']|["']$/g, "");
+  if (i2 < tokens.length && /^\$[\w:]+$/.test(tokens[i2]) && tokens[i2 + 1] === "=") i2 += 2;
+  else if (i2 < tokens.length && /^\$[\w:]+=$/.test(tokens[i2])) i2 += 1;
+  else if (i2 < tokens.length && /^\$[\w:]+=./.test(tokens[i2])) tokens[i2] = tokens[i2].replace(/^\$[\w:]+=/, "");
+  while (i2 < tokens.length && /^(?:\$|@)?\(+$/.test(tokens[i2])) i2++;
+  const lead = (tokens[i2] || "").toLowerCase().replace(/^(?:\$|@)?\(+/, "").replace(/^["']|["']$/g, "");
   return lead.replace(/^.*[\\/]/, "").replace(/\.(exe|cmd|bat|ps1)$/i, "");
 }
+var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
+var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
 function classifyShellSegment(segment, depth = 0) {
   const raw = segment.trim();
   if (!raw) return "read";
+  if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
   const lead = shellSegmentLead(segment);
+  if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
   if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
@@ -7452,8 +7529,10 @@ function classifyShellWords(masked, raw, lead) {
   if (/\b(git\s+(?:add|commit|push|merge|rebase|cherry-pick|stash|checkout|switch|restore|tag\s+\S)|npm\s+(?:install|ci|i|uninstall|update|publish)|pnpm\s+(?:install|add|i)|yarn(?:\s+add|\s+install)?|pip3?\s+install|poetry\s+(?:install|add)|cargo\s+(?:build|install)|go\s+(?:build|install|get|mod)|gcloud\s+run\s+deploy|firebase\s+deploy|terraform\s+apply|kubectl\s+apply|docker\s+(?:push|build|compose\s+up)|helm\s+(?:install|upgrade))\b/.test(value)) {
     return "write";
   }
+  if (SHELL_BLOCK_STRUCTURE_RE.test(value)) return "read";
   return "SHELL";
 }
+var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
@@ -7461,6 +7540,44 @@ function classifyShellCommandOperation(command, depth = 0) {
   if (segments.length === 0) return "SHELL";
   return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
 }
+function isPowerShellReadFormatter(segment) {
+  if (/^(?:Select-Object\s+[\w., *-]+|Format-Table(?:\s+[\w., *-]+)?|Format-List(?:\s+[\w., *-]+)?|Out-Null|ConvertFrom-Json)$/i.test(segment)) return true;
+  const tokens = segment.trim().split(/\s+/);
+  if (tokens.shift()?.toLowerCase() !== "convertto-json") return false;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const flag = tokens[i2].toLowerCase();
+    if (seen.has(flag)) return false;
+    seen.add(flag);
+    if (flag === "-compress") continue;
+    if (flag === "-depth" && /^(?:\d{1,2}|100)$/.test(tokens[++i2] || "")) continue;
+    return false;
+  }
+  return true;
+}
+function isGcloudStorageCatRead(command) {
+  if (command.length > 8192 || /[$`{}()<>;&|]/.test(command)) return false;
+  const pieces = command.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g) || [];
+  if (pieces.join("").replace(/\s/g, "") !== command.replace(/\s/g, "")) return false;
+  const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
+  if (!/^gcloud(?:\.cmd|\.exe)?$/i.test(tokens.shift() || "") || tokens.shift() !== "storage" || tokens.shift() !== "cat" || tokens.length > 32) return false;
+  let objects = 0;
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const token = tokens[i2];
+    if (/^gs:\/\/[a-z0-9][a-z0-9._-]*\/[A-Za-z0-9._~/*?-]+$/.test(token)) {
+      objects++;
+      continue;
+    }
+    if (token === "--display-url" || token === "-d") continue;
+    if ((token === "--range" || token === "-r") && /^(?:\d+-\d*|-\d+)$/.test(tokens[i2 + 1] || "")) {
+      i2++;
+      continue;
+    }
+    if (/^--range=(?:\d+-\d*|-\d+)$/.test(token)) continue;
+    return false;
+  }
+  return objects > 0;
+}
 function provenCompoundDownload(command, detectedUrl) {
   if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
@@ -7470,8 +7587,9 @@ function provenCompoundDownload(command, detectedUrl) {
     if (statusRead) segment = statusRead[1];
     if (/[$`{}()<>;&]/.test(segment)) return false;
     const pipeline = splitShellSegments(segment, true);
-    if (pipeline.slice(1).some((part) => !/^(?:Select-Object|Format-Table|Format-List)\s+[\w., *-]+$|^Out-Null$/i.test(part))) return false;
+    if (pipeline.slice(1).some((part) => !isPowerShellReadFormatter(part))) return false;
     const raw = pipeline[0];
+    if (isGcloudStorageCatRead(raw)) return true;
     const pieces = raw.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g) || [];
     if (pieces.join("").replace(/\s/g, "") !== raw.replace(/\s/g, "")) return false;
     const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
@@ -7515,13 +7633,41 @@ function provenCompoundDownload(command, detectedUrl) {
     return urls === 1;
   });
 }
+function isPowerShellClockDisplay(value) {
+  return /^\(\s*Get-Date\s*\)\s*\.\s*(?:ToUniversalTime\s*\(\s*\)\s*\.\s*)?ToString\s*\(\s*(?:'[^'\r\n]{0,80}'|"[^"$`\r\n]{0,80}")\s*\)$/i.test(value);
+}
+function isPowerShellResponseProjection(segment, responses) {
+  const object = /^\[pscustomobject\]\s*@\{([^{}]+)\}\s*(?:\|\s*(.+))?$/i.exec(segment);
+  if (!object) return false;
+  if (object[2] && object[2].split("|").some((part) => !isPowerShellReadFormatter(part.trim()))) return false;
+  const fields = object[1].trim().replace(/;\s*$/, "").split(";");
+  if (fields.length > 32) return false;
+  const labels = /* @__PURE__ */ new Set();
+  return fields.every((field) => {
+    const entry = /^\s*([A-Za-z_][\w]*)\s*=\s*(.+?)\s*$/s.exec(field);
+    if (!entry) return false;
+    const label = entry[1].toLowerCase();
+    if (labels.has(label)) return false;
+    labels.add(label);
+    if (isPowerShellClockDisplay(entry[2])) return true;
+    const member = /^(\[int\]\s*)?\$([A-Za-z_][\w]*)\.(StatusCode|StatusDescription|RawContentLength|Content)$/i.exec(entry[2]);
+    return Boolean(member && responses.has(member[2].toLowerCase()) && (!member[1] || /^(?:StatusCode|RawContentLength)$/i.test(member[3])));
+  });
+}
 function provenPowerShellReadSequence(command) {
-  if (command.length > 65536 || !/(?:^|[;&\n])\s*\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(command)) return false;
+  if (command.length > 65536 || !/(?:^|[;&\n])\s*(?:\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s|(?:\$[A-Za-z_][\w]*\s*=\s*)?gcloud(?:\.cmd|\.exe)?\s+storage\s+cat\s)/i.test(command)) return false;
   const segments = splitShellSegments(command);
-  if (segments.length > 32 || /[`{}]/.test(command)) return false;
+  if (segments.length > 32 || /`/.test(command)) return false;
   const responses = /* @__PURE__ */ new Set();
   let requests = 0;
-  for (let segment of segments) {
+  for (let index = 0; index < segments.length; index++) {
+    let segment = segments[index];
+    if (/^\[pscustomobject\]\s*@\{/i.test(segment)) {
+      while (!segment.includes("}") && index + 1 < segments.length) segment += ";" + segments[++index];
+      if (!isPowerShellResponseProjection(segment, responses)) return false;
+      continue;
+    }
+    if (/[{}]/.test(maskQuotedSpans(segment))) return false;
     let binding;
     const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(.+)$/s.exec(segment);
     if (assignment) {
@@ -7533,15 +7679,18 @@ function provenPowerShellReadSequence(command) {
     if (property) segment = property[1];
     const pipeline = splitShellSegments(segment, true);
     const lead = pipeline.shift() || "";
-    if (pipeline.some((part) => !/^(?:ConvertTo-Json(?:\s+-Compress)?(?:\s+-Depth\s+\d{1,2})?|ConvertFrom-Json|Select-Object\s+[\w., -]+|Format-List|Format-Table|Out-Null)$/i.test(part))) return false;
-    if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
+    if (pipeline.some((part) => !isPowerShellReadFormatter(part))) return false;
+    if (isGcloudStorageCatRead(lead)) {
+      requests++;
+    } else if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
       const url = lead.match(/https?:\/\/[^\s"'<>]+/i)?.[0];
       if (!url || !provenCompoundDownload(lead, url)) return false;
       requests++;
-    } else if (/^\$[A-Za-z_][\w]*$/.test(lead)) {
-      if (binding || !responses.has(lead.slice(1).toLowerCase())) return false;
+    } else if (/^\$[A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)*$/.test(lead)) {
+      if (!responses.has(lead.slice(1).split(".")[0].toLowerCase())) return false;
     } else {
       if (binding) return false;
+      if (/^gh\s+(?:run|pr)\s+view\s+\d+\s+--json\s+(?:[A-Za-z][A-Za-z,]*|'[A-Za-z][A-Za-z, ]*'|"[A-Za-z][A-Za-z, ]*")(?:\s+--jq\s+'[^'$`\r\n]{1,2000}')?$/i.test(lead) || /^npm\s+view\s+(?:@[\w.-]+\/)?[\w.-]+\s+version$/i.test(lead) || /^Get-ScheduledTask\s+-TaskName\s+(?:[\w.-]+|'[^'$`\r\n]+'|"[^"$`\r\n]+")$/i.test(lead)) continue;
       if (pipeline.length === 0 && /^(?:git\s+status(?:\s+--short)?|cd\s+(?:[A-Za-z]:[\\/][\w./\\-]+|'[A-Za-z]:[\\/][^'$`\r\n]+'))$/i.test(lead)) continue;
       const file = /^Get-Content\s+(?:'([^'\r\n]+)'|"([^"$`\r\n]+)")((?:\s+-(?:Raw|Tail\s+\d+|TotalCount\s+\d+))*)$/i.exec(lead);
       if (!file || !/^[A-Za-z]:[\\/]/.test(file[1] || file[2]) || /[?*]/.test(file[1] || file[2])) return false;
@@ -7723,6 +7872,35 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   return worstResult;
 }
 function inferToolContext(toolName, args) {
+  const detectorArgs = {};
+  const untrustedInput = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(args)) {
+    if (reservedInputFact(key) || LEGACY_TRUST_LABEL_ARGS.has(key)) untrustedInput[key] = value;
+    else detectorArgs[key] = value;
+  }
+  if (Object.keys(untrustedInput).length) {
+    let carrier = "__fcd_untrustedInput";
+    while (Object.hasOwn(detectorArgs, carrier)) carrier += "_";
+    detectorArgs[carrier] = untrustedInput;
+  }
+  const updated = (0, import_detectorRuntime.updatedDetectorFacts)(toolName, detectorArgs);
+  if (!updated) return inferBundledToolContext(toolName, args);
+  const context = { ...updated.context };
+  for (const key of RESERVED_INPUT_FACTS) delete context[key];
+  const argsText = stringifyArgs(args);
+  context["toolArgs.bytes"] = String(Buffer.byteLength(argsText, "utf8"));
+  for (const [key, value] of Object.entries(args)) {
+    if (!["string", "number", "boolean"].includes(typeof value)) continue;
+    context[`args.${key}`] = String(value);
+    if (!reservedInputFact(key) && LEGACY_TRUST_LABEL_ARGS.has(key) && !Object.hasOwn(context, key)) context[key] = String(value);
+  }
+  if (!Object.hasOwn(context, "request.containsSecret") && recordHttpRequestFacts(context, args, extractUrl(args, argsText))) {
+    context["destination.type"] = context["request.destination.type"];
+    context["destination.domain"] = context["request.destination.domain"];
+  }
+  return { operation: updated.operation, context };
+}
+function inferBundledToolContext(toolName, args) {
   const context = {};
   let operation = toolName;
   const toolNameLower = toolName.toLowerCase();
@@ -7734,19 +7912,13 @@ function inferToolContext(toolName, args) {
     Number.isFinite(retryCount) ? retryCount : 0,
     Number.isFinite(fanoutCount) ? fanoutCount : 0
   );
-  context["toolArgs.bytes"] = String(Buffer.byteLength(argsText, "utf8"));
-  const secretKind = detectSecretKind(argsText);
-  context["toolArgs.containsSecret"] = secretKind !== "none" ? "true" : "false";
-  context["toolArgs.secretKind"] = secretKind;
-  context["toolArgs.containsPii"] = hasPiiLikeValue(argsText) ? "true" : "false";
+  Object.assign(context, inputContentFacts(argsText));
   context["retry.count"] = String(burstCount);
   context["fanout.count"] = String(burstCount);
   for (const [key, val] of Object.entries(args)) {
-    if (typeof val === "string") {
-      context[key] = val;
-    } else if (typeof val === "number") {
-      context[key] = String(val);
-    }
+    if (typeof val !== "string" && typeof val !== "number" && typeof val !== "boolean") continue;
+    context[`args.${key}`] = String(val);
+    if (!reservedInputFact(key)) context[key] = String(val);
   }
   const nameWords = toolNameLower.replace(/[_\-.]/g, " ");
   const isSearchTool = /\b(search|grep|find|lookup|locate)\b/.test(nameWords) && !/\b(delete|remove|drop|write|update|insert|replace|create)\b/.test(nameWords);
@@ -7779,7 +7951,7 @@ function inferToolContext(toolName, args) {
     else if (writeOps.some((op) => toolNameLower.includes(op))) operation = "write";
     else if (deleteOps.some((op) => toolNameLower.includes(op))) operation = "delete";
   }
-  const methodArg = (args.method || "").toUpperCase();
+  const methodArg = typeof args.method === "string" ? args.method.toUpperCase() : "";
   if (["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg)) {
     operation = methodArg;
     if (args.url) context.url = args.url;
@@ -7794,20 +7966,19 @@ function inferToolContext(toolName, args) {
       const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || provenReadUrls.includes(detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
+      const requestHasSecret = recordHttpRequestFacts(context, args, detectedUrl);
       if (inbound) {
         context["source.domain"] = parsed.hostname;
         context["source.type"] = hostType;
-      } else {
+      }
+      if (!inbound || requestHasSecret) {
         context["destination.type"] = hostType;
       }
     } catch {
       context["url.risk"] = "invalid";
     }
   }
-  if (typeof args.destinationType === "string") context["destination.type"] = args.destinationType;
   if (typeof args.destination === "string") context.destination = args.destination;
-  if (typeof args.domain === "string") context["destination.domain"] = args.domain;
-  if (typeof args.toolStatus === "string") context["tool.status"] = args.toolStatus;
   if (args.to || args.recipient || args.email) {
     context.to = args.to || args.recipient || args.email;
     context["destination.type"] = context["destination.type"] || "external";
@@ -7830,6 +8001,77 @@ function inferToolContext(toolName, args) {
   }
   return { operation, context };
 }
+var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "verdict",
+  "decision",
+  "approval",
+  "toolName",
+  "agentName",
+  "agentClient",
+  "developerName",
+  "machineName",
+  "machineKind",
+  "machineId",
+  "humanPresent",
+  "organizationId",
+  "tenantId",
+  "shieldId",
+  "userId",
+  "ipAddress",
+  "gateway",
+  "mcpServer"
+]);
+var RESERVED_FACT_NAMESPACES = /* @__PURE__ */ new Set([
+  "args",
+  "toolArgs",
+  "tool",
+  "agent",
+  "action",
+  "operation",
+  "url",
+  "destination",
+  "source",
+  "request",
+  "retry",
+  "fanout",
+  "runtime",
+  "machine",
+  "session",
+  "policy",
+  "tenant",
+  "organization",
+  "role",
+  "roles"
+]);
+function reservedInputFact(key) {
+  return RESERVED_INPUT_FACTS.has(key) || key.includes(".") && RESERVED_FACT_NAMESPACES.has(key.split(".")[0]);
+}
+var LEGACY_TRUST_LABEL_ARGS = /* @__PURE__ */ new Set(["destinationType", "domain", "toolStatus"]);
+function inputContentFacts(argsText) {
+  const secretKind = detectSecretKind(argsText);
+  return {
+    "toolArgs.bytes": String(Buffer.byteLength(argsText, "utf8")),
+    "toolArgs.containsSecret": secretKind !== "none" ? "true" : "false",
+    "toolArgs.secretKind": secretKind,
+    "toolArgs.containsPii": hasPiiLikeValue(argsText) ? "true" : "false"
+  };
+}
+function recordHttpRequestFacts(context, args, detectedUrl) {
+  try {
+    const parsed = new URL(detectedUrl);
+    if (!["http:", "https:"].includes(parsed.protocol)) return false;
+    const containsSecret = hasSecretLikeValue(stringifyArgs({ url: detectedUrl, headers: args.headers, body: args.body, data: args.data }));
+    context["request.destination.domain"] = parsed.hostname;
+    context["request.destination.type"] = isInternalHost(parsed.hostname) ? "internal" : "external";
+    context["request.containsSecret"] = containsSecret ? "true" : "false";
+    return containsSecret;
+  } catch {
+    return false;
+  }
+}
 function inferInventoryToolOperations(toolName, toolActions = []) {
   const ops = /* @__PURE__ */ new Set([toolName, toolName.toUpperCase(), ...toolActions]);
   const upper = toolName.toUpperCase();
@@ -7863,6 +8105,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,
+  inferBundledToolContext,
   inferToolContext,
   inventoryToolMatchesActionPolicy,
   isLocalFileContentAction,

package/dist/agentTerminal.d.ts

@@ -14,9 +14,7 @@ export declare const AGENT_TERMINAL_ASK_BLOCKED: string;
 /** Shown when the IDE prompt already answered for this exact command. */
 export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.";
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
-export declare function ideShellPendingKey(command: string): string;
-/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
-export declare function ideLocalSafetyRememberKey(ruleId: string): string;
+export declare function ideShellPendingKey(command: string, cwd?: string): string;
 /** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 export declare const IDE_CONFIRMATION_WINDOW_MS: number;
 /**