fullcourtdefense-cli 1.34.22 → 1.34.25

package/dist/actionIdentity.d.ts

@@ -3,6 +3,7 @@ export interface ActionIdentity {
     sessionId?: string;
     runId?: string;
     instanceId?: string;
+    attemptId?: string;
 }
 export declare function identityPart(value: unknown): string | undefined;
 export declare function captureActionIdentity(payload?: Record<string, unknown>, env?: NodeJS.ProcessEnv): ActionIdentity;

package/dist/actionIdentity.js

@@ -11,5 +11,7 @@ function captureActionIdentity(payload = {}, env = process.env) {
             || env.FCD_SESSION_ID || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID),
         runId: identityPart(env.FCD_RUN_ID || env.GITHUB_RUN_ID || env.CI_PIPELINE_ID),
         instanceId: identityPart(env.FCD_WORKLOAD_INSTANCE_ID),
+        // Never use a generic request id: some clients reuse it for unrelated calls.
+        attemptId: identityPart(payload.tool_use_id || payload.tool_call_id),
     };
 }

package/dist/actionPolicyEngine.js

@@ -5792,6 +5792,27 @@ function provenJavaScriptReadUrls(code) {
       }
       case "EmptyStatement":
         return literal2(void 0);
+      case "IfStatement": {
+        ev(node.test);
+        evaluate(node.consequent, new Map(env), depth + 1);
+        if (node.alternate) evaluate(node.alternate, new Map(env), depth + 1);
+        return literal2(void 0);
+      }
+      case "UnaryExpression": {
+        if (node.operator !== "!") return fail();
+        ev(node.argument);
+        return { kind: "data" };
+      }
+      case "ThrowStatement":
+        return ev(node.argument);
+      case "TemplateLiteral": {
+        for (const expression of node.expressions) {
+          const value = ev(expression);
+          if (!["literal", "data", "string"].includes(value.kind)) return fail();
+          if (value.kind === "literal" && value.value !== null && typeof value.value === "object") return fail();
+        }
+        return { kind: "string" };
+      }
       case "ExpressionStatement":
       case "AwaitExpression":
       case "ChainExpression":
@@ -5835,6 +5856,7 @@ function provenJavaScriptReadUrls(code) {
       case "BinaryExpression": {
         const left = ev(node.left);
         const right = ev(node.right);
+        if (node.operator === "===" || node.operator === "!==") return { kind: "data" };
         if (node.operator !== "+") return fail();
         if (left.kind === "literal" && right.kind === "literal" && typeof left.value === "string" && typeof right.value === "string") {
           if (left.value.length + right.value.length > 32768) return fail();
@@ -5870,6 +5892,12 @@ function provenJavaScriptReadUrls(code) {
       }
       case "NewExpression": {
         const constructor = ev(node.callee);
+        if (constructor.kind === "call" && constructor.name === "Error") {
+          if (node.arguments.length !== 1) return fail();
+          const message = ev(node.arguments[0]);
+          if (message.kind !== "string" && !(message.kind === "literal" && typeof message.value === "string")) return fail();
+          return { kind: "data" };
+        }
         if (constructor.kind !== "call" || constructor.name !== "GoogleAuth" || node.arguments.length !== 1) return fail();
         const options = ev(node.arguments[0]);
         if (options.kind !== "object" || options.fields.size !== 1) return fail();
@@ -6000,6 +6028,7 @@ function provenJavaScriptReadUrls(code) {
     evaluate(tree, /* @__PURE__ */ new Map([
       ["fetch", callable("fetch")],
       ["require", callable("require")],
+      ["Error", callable("Error")],
       ["JSON", object([["stringify", callable("JSON.stringify")]])],
       ["console", object([["log", callable("console.log")], ["error", callable("console.error")]])]
     ]));
@@ -6740,14 +6769,17 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "recipients",
   "from",
   "cc",
-  "bcc"
+  "bcc",
+  "domain",
+  "destinationType",
+  "toolStatus"
 ]);
 function buildOperationMatchText(_toolName, context) {
   const parts = [];
   for (const [key, value] of Object.entries(context)) {
     const fieldWords = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_.-]/);
     const identifierField = /^(?:id|ids|uuid|uuids|guid|guids)$/.test(fieldWords[fieldWords.length - 1]);
-    if (OPERATION_MATCH_SKIP_FIELDS.has(key) || identifierField) continue;
+    if (OPERATION_MATCH_SKIP_FIELDS.has(key) || identifierField || key.startsWith("args.") || key.startsWith("request.")) continue;
     if (typeof value !== "string" || value.length === 0 || value.length > 2e3) continue;
     const text = COMMAND_LINE_FIELDS.has(key) ? shellVerbWords(value) : value;
     parts.push(`${key} ${text}`);
@@ -6820,6 +6852,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
+  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
   if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token)) return false;
@@ -6990,8 +7023,15 @@ function explicitGitHubWriteRepository(command) {
 function withoutUnattributedJavaScriptUrls(segment) {
   if (segment.length > 32768) return segment;
   const inline = /^\s*node(?:\.exe)?\s+(?:-e|--eval)\s+(?:"([^"$`\\]*)"|'([^']*)')\s*$/i.exec(segment);
-  if (!inline) return segment;
-  const code = inline[1] ?? inline[2];
+  let code;
+  if (inline) code = inline[1] ?? inline[2];
+  else {
+    const raw = segment.trim();
+    const opening = /^@'\r?\n/.exec(raw);
+    const end = opening ? hereStringEnd(raw, 0) : -1;
+    if (!opening || end < 0 || !/^\s*\|\s*node(?:\.exe)?(?:\s+-)?\s*$/i.test(raw.slice(end))) return segment;
+    code = raw.slice(opening[0].length, end - 3);
+  }
   let budget = 4e3;
   try {
     const tree = parse3(code, { ecmaVersion: "latest", sourceType: "script", allowAwaitOutsideFunction: true });
@@ -7053,6 +7093,8 @@ function extractUrl(args, _argsText) {
 }
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
+  if (/\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(command))) return command;
+  const fileSyntax = (text) => text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
   const originalSegments = splitShellSegments(command);
   const localPaths = /* @__PURE__ */ new Map();
   const literalValues = /* @__PURE__ */ new Map();
@@ -7095,12 +7137,12 @@ function shellUrlActionText(command) {
       const value = localPaths.get(name.toLowerCase());
       return value ? expand(match, `"${value}"`) : match;
     });
-    const expanded = prefix + tail;
+    const expanded = prefix + fileSyntax(tail);
     return expanded.replace(
-      /^(Set-Content|Add-Content|Out-File)(\s+[\s\S]*?\s+-(?:Value|InputObject)\s+)\$([A-Za-z_][\w]*)\s*$/i,
-      (match, writer, options, name) => {
+      /^(Set-Content|Add-Content|Out-File)(\s+[\s\S]*?\s+-(?:Value|InputObject)\s+)\$([A-Za-z_][\w]*)(\s+-[\s\S]*|\s*)$/i,
+      (match, writer, options, name, suffix) => {
         const value = literalValues.get(name.toLowerCase());
-        return value ? expand(match, writer + options + value) : match;
+        return value ? expand(match, writer + options + value + suffix) : match;
       }
     );
   });
@@ -7140,6 +7182,16 @@ function shellUrlActionText(command) {
     if (dataAssignments.has(index)) return true;
     if (pathAssignments.has(index)) return true;
     if (filtered[index] !== segment) return true;
+    if (/^\$[A-Za-z_][\w]*\s*=\s*\$null$/i.test(segment)) return true;
+    if (/^\[System\.Management\.Automation\.Language\.Parser\]::ParseFile\("[^"$`\r\n|;&<>]*",\s*\[ref\]\$[A-Za-z_][\w]*,\s*\[ref\]\$[A-Za-z_][\w]*\)\s*\|\s*Out-Null$/i.test(segment)) return true;
+    if (/^if\s*\(\$([A-Za-z_][\w]*)\.Count\)\s*\{\s*throw\s+\$\1\[0\]\s*\}$/i.test(segment)) return true;
+    if (/^Write-Output\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    if (/^gh\s+pr\s+checks\s+\d+\s+--json\s+[a-z,]+\s+--jq\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    const read = /^Get-Content\s+(?:(?:-LiteralPath|-Path)\s+)?(?:'([^'$`\r\n]*)'|"([^"$`\r\n]*)"|([^\s'"$`|;&(){}<>]+))(?:\s+-(?:Tail|TotalCount)\s+\d{1,6})?(?:\s+-Raw)?\s*$/i.exec(segment);
+    if (read) {
+      const target = read[1] ?? read[2] ?? read[3];
+      if (target && !target.startsWith("-") && !/^[\\/]{2}|[\r\n*?\[\]<>]/.test(target) && !/:/.test(target.replace(/^[A-Za-z]:[\\/]/, ""))) return true;
+    }
     const directory = /^New-Item\s+-ItemType\s+Directory\s+(?:-Force\s+)?-(?:LiteralPath|Path)\s+(?:'([^']*)'|"([^"$`]*)")\s*(?:\|\s*Out-Null)?$/i.exec(segment);
     if (directory && /^(?:[A-Za-z]:[\\/]|\/(?!\/))[\w ./\\-]+$/.test(directory[1] ?? directory[2])) return true;
     const words = maskQuotedSpans(segment);
@@ -7384,14 +7436,22 @@ function shellSegmentLead(segment) {
   const tokens = segment.trim().split(/\s+/).filter(Boolean);
   let i2 = 0;
   while (i2 < tokens.length && (/^[A-Za-z_][\w]*=/.test(tokens[i2]) || /^(?:sudo|time|nohup|command|builtin|exec|nice|env)$/i.test(tokens[i2]))) i2++;
-  const lead = (tokens[i2] || "").toLowerCase().replace(/^["']|["']$/g, "");
+  if (i2 < tokens.length && /^\$[\w:]+$/.test(tokens[i2]) && tokens[i2 + 1] === "=") i2 += 2;
+  else if (i2 < tokens.length && /^\$[\w:]+=$/.test(tokens[i2])) i2 += 1;
+  else if (i2 < tokens.length && /^\$[\w:]+=./.test(tokens[i2])) tokens[i2] = tokens[i2].replace(/^\$[\w:]+=/, "");
+  while (i2 < tokens.length && /^(?:\$|@)?\(+$/.test(tokens[i2])) i2++;
+  const lead = (tokens[i2] || "").toLowerCase().replace(/^(?:\$|@)?\(+/, "").replace(/^["']|["']$/g, "");
   return lead.replace(/^.*[\\/]/, "").replace(/\.(exe|cmd|bat|ps1)$/i, "");
 }
+var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
+var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
 function classifyShellSegment(segment, depth = 0) {
   const raw = segment.trim();
   if (!raw) return "read";
+  if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
   const lead = shellSegmentLead(segment);
+  if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
   if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
@@ -7469,8 +7529,10 @@ function classifyShellWords(masked, raw, lead) {
   if (/\b(git\s+(?:add|commit|push|merge|rebase|cherry-pick|stash|checkout|switch|restore|tag\s+\S)|npm\s+(?:install|ci|i|uninstall|update|publish)|pnpm\s+(?:install|add|i)|yarn(?:\s+add|\s+install)?|pip3?\s+install|poetry\s+(?:install|add)|cargo\s+(?:build|install)|go\s+(?:build|install|get|mod)|gcloud\s+run\s+deploy|firebase\s+deploy|terraform\s+apply|kubectl\s+apply|docker\s+(?:push|build|compose\s+up)|helm\s+(?:install|upgrade))\b/.test(value)) {
     return "write";
   }
+  if (SHELL_BLOCK_STRUCTURE_RE.test(value)) return "read";
   return "SHELL";
 }
+var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
@@ -7478,6 +7540,44 @@ function classifyShellCommandOperation(command, depth = 0) {
   if (segments.length === 0) return "SHELL";
   return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
 }
+function isPowerShellReadFormatter(segment) {
+  if (/^(?:Select-Object\s+[\w., *-]+|Format-Table(?:\s+[\w., *-]+)?|Format-List(?:\s+[\w., *-]+)?|Out-Null|ConvertFrom-Json)$/i.test(segment)) return true;
+  const tokens = segment.trim().split(/\s+/);
+  if (tokens.shift()?.toLowerCase() !== "convertto-json") return false;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const flag = tokens[i2].toLowerCase();
+    if (seen.has(flag)) return false;
+    seen.add(flag);
+    if (flag === "-compress") continue;
+    if (flag === "-depth" && /^(?:\d{1,2}|100)$/.test(tokens[++i2] || "")) continue;
+    return false;
+  }
+  return true;
+}
+function isGcloudStorageCatRead(command) {
+  if (command.length > 8192 || /[$`{}()<>;&|]/.test(command)) return false;
+  const pieces = command.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g) || [];
+  if (pieces.join("").replace(/\s/g, "") !== command.replace(/\s/g, "")) return false;
+  const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
+  if (!/^gcloud(?:\.cmd|\.exe)?$/i.test(tokens.shift() || "") || tokens.shift() !== "storage" || tokens.shift() !== "cat" || tokens.length > 32) return false;
+  let objects = 0;
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const token = tokens[i2];
+    if (/^gs:\/\/[a-z0-9][a-z0-9._-]*\/[A-Za-z0-9._~/*?-]+$/.test(token)) {
+      objects++;
+      continue;
+    }
+    if (token === "--display-url" || token === "-d") continue;
+    if ((token === "--range" || token === "-r") && /^(?:\d+-\d*|-\d+)$/.test(tokens[i2 + 1] || "")) {
+      i2++;
+      continue;
+    }
+    if (/^--range=(?:\d+-\d*|-\d+)$/.test(token)) continue;
+    return false;
+  }
+  return objects > 0;
+}
 function provenCompoundDownload(command, detectedUrl) {
   if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
@@ -7487,8 +7587,9 @@ function provenCompoundDownload(command, detectedUrl) {
     if (statusRead) segment = statusRead[1];
     if (/[$`{}()<>;&]/.test(segment)) return false;
     const pipeline = splitShellSegments(segment, true);
-    if (pipeline.slice(1).some((part) => !/^(?:Select-Object|Format-Table|Format-List)\s+[\w., *-]+$|^Out-Null$/i.test(part))) return false;
+    if (pipeline.slice(1).some((part) => !isPowerShellReadFormatter(part))) return false;
     const raw = pipeline[0];
+    if (isGcloudStorageCatRead(raw)) return true;
     const pieces = raw.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s"']+/g) || [];
     if (pieces.join("").replace(/\s/g, "") !== raw.replace(/\s/g, "")) return false;
     const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
@@ -7532,13 +7633,41 @@ function provenCompoundDownload(command, detectedUrl) {
     return urls === 1;
   });
 }
+function isPowerShellClockDisplay(value) {
+  return /^\(\s*Get-Date\s*\)\s*\.\s*(?:ToUniversalTime\s*\(\s*\)\s*\.\s*)?ToString\s*\(\s*(?:'[^'\r\n]{0,80}'|"[^"$`\r\n]{0,80}")\s*\)$/i.test(value);
+}
+function isPowerShellResponseProjection(segment, responses) {
+  const object = /^\[pscustomobject\]\s*@\{([^{}]+)\}\s*(?:\|\s*(.+))?$/i.exec(segment);
+  if (!object) return false;
+  if (object[2] && object[2].split("|").some((part) => !isPowerShellReadFormatter(part.trim()))) return false;
+  const fields = object[1].trim().replace(/;\s*$/, "").split(";");
+  if (fields.length > 32) return false;
+  const labels = /* @__PURE__ */ new Set();
+  return fields.every((field) => {
+    const entry = /^\s*([A-Za-z_][\w]*)\s*=\s*(.+?)\s*$/s.exec(field);
+    if (!entry) return false;
+    const label = entry[1].toLowerCase();
+    if (labels.has(label)) return false;
+    labels.add(label);
+    if (isPowerShellClockDisplay(entry[2])) return true;
+    const member = /^(\[int\]\s*)?\$([A-Za-z_][\w]*)\.(StatusCode|StatusDescription|RawContentLength|Content)$/i.exec(entry[2]);
+    return Boolean(member && responses.has(member[2].toLowerCase()) && (!member[1] || /^(?:StatusCode|RawContentLength)$/i.test(member[3])));
+  });
+}
 function provenPowerShellReadSequence(command) {
-  if (command.length > 65536 || !/(?:^|[;&\n])\s*\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(command)) return false;
+  if (command.length > 65536 || !/(?:^|[;&\n])\s*(?:\$[A-Za-z_][\w]*\s*=\s*(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s|(?:\$[A-Za-z_][\w]*\s*=\s*)?gcloud(?:\.cmd|\.exe)?\s+storage\s+cat\s)/i.test(command)) return false;
   const segments = splitShellSegments(command);
-  if (segments.length > 32 || /[`{}]/.test(command)) return false;
+  if (segments.length > 32 || /`/.test(command)) return false;
   const responses = /* @__PURE__ */ new Set();
   let requests = 0;
-  for (let segment of segments) {
+  for (let index = 0; index < segments.length; index++) {
+    let segment = segments[index];
+    if (/^\[pscustomobject\]\s*@\{/i.test(segment)) {
+      while (!segment.includes("}") && index + 1 < segments.length) segment += ";" + segments[++index];
+      if (!isPowerShellResponseProjection(segment, responses)) return false;
+      continue;
+    }
+    if (/[{}]/.test(maskQuotedSpans(segment))) return false;
     let binding;
     const assignment = /^\$([A-Za-z_][\w]*)\s*=\s*(.+)$/s.exec(segment);
     if (assignment) {
@@ -7550,15 +7679,18 @@ function provenPowerShellReadSequence(command) {
     if (property) segment = property[1];
     const pipeline = splitShellSegments(segment, true);
     const lead = pipeline.shift() || "";
-    if (pipeline.some((part) => !/^(?:ConvertTo-Json(?:\s+-Compress)?(?:\s+-Depth\s+\d{1,2})?|ConvertFrom-Json|Select-Object\s+[\w., -]+|Format-List|Format-Table|Out-Null)$/i.test(part))) return false;
-    if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
+    if (pipeline.some((part) => !isPowerShellReadFormatter(part))) return false;
+    if (isGcloudStorageCatRead(lead)) {
+      requests++;
+    } else if (/^(?:Invoke-RestMethod|Invoke-WebRequest|irm|iwr)\s/i.test(lead)) {
       const url = lead.match(/https?:\/\/[^\s"'<>]+/i)?.[0];
       if (!url || !provenCompoundDownload(lead, url)) return false;
       requests++;
-    } else if (/^\$[A-Za-z_][\w]*$/.test(lead)) {
-      if (binding || !responses.has(lead.slice(1).toLowerCase())) return false;
+    } else if (/^\$[A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)*$/.test(lead)) {
+      if (!responses.has(lead.slice(1).split(".")[0].toLowerCase())) return false;
     } else {
       if (binding) return false;
+      if (/^gh\s+(?:run|pr)\s+view\s+\d+\s+--json\s+(?:[A-Za-z][A-Za-z,]*|'[A-Za-z][A-Za-z, ]*'|"[A-Za-z][A-Za-z, ]*")(?:\s+--jq\s+'[^'$`\r\n]{1,2000}')?$/i.test(lead) || /^npm\s+view\s+(?:@[\w.-]+\/)?[\w.-]+\s+version$/i.test(lead) || /^Get-ScheduledTask\s+-TaskName\s+(?:[\w.-]+|'[^'$`\r\n]+'|"[^"$`\r\n]+")$/i.test(lead)) continue;
       if (pipeline.length === 0 && /^(?:git\s+status(?:\s+--short)?|cd\s+(?:[A-Za-z]:[\\/][\w./\\-]+|'[A-Za-z]:[\\/][^'$`\r\n]+'))$/i.test(lead)) continue;
       const file = /^Get-Content\s+(?:'([^'\r\n]+)'|"([^"$`\r\n]+)")((?:\s+-(?:Raw|Tail\s+\d+|TotalCount\s+\d+))*)$/i.exec(lead);
       if (!file || !/^[A-Za-z]:[\\/]/.test(file[1] || file[2]) || /[?*]/.test(file[1] || file[2])) return false;
@@ -7740,7 +7872,33 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   return worstResult;
 }
 function inferToolContext(toolName, args) {
-  return (0, import_detectorRuntime.updatedDetectorFacts)(toolName, args) || inferBundledToolContext(toolName, args);
+  const detectorArgs = {};
+  const untrustedInput = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(args)) {
+    if (reservedInputFact(key) || LEGACY_TRUST_LABEL_ARGS.has(key)) untrustedInput[key] = value;
+    else detectorArgs[key] = value;
+  }
+  if (Object.keys(untrustedInput).length) {
+    let carrier = "__fcd_untrustedInput";
+    while (Object.hasOwn(detectorArgs, carrier)) carrier += "_";
+    detectorArgs[carrier] = untrustedInput;
+  }
+  const updated = (0, import_detectorRuntime.updatedDetectorFacts)(toolName, detectorArgs);
+  if (!updated) return inferBundledToolContext(toolName, args);
+  const context = { ...updated.context };
+  for (const key of RESERVED_INPUT_FACTS) delete context[key];
+  const argsText = stringifyArgs(args);
+  context["toolArgs.bytes"] = String(Buffer.byteLength(argsText, "utf8"));
+  for (const [key, value] of Object.entries(args)) {
+    if (!["string", "number", "boolean"].includes(typeof value)) continue;
+    context[`args.${key}`] = String(value);
+    if (!reservedInputFact(key) && LEGACY_TRUST_LABEL_ARGS.has(key) && !Object.hasOwn(context, key)) context[key] = String(value);
+  }
+  if (!Object.hasOwn(context, "request.containsSecret") && recordHttpRequestFacts(context, args, extractUrl(args, argsText))) {
+    context["destination.type"] = context["request.destination.type"];
+    context["destination.domain"] = context["request.destination.domain"];
+  }
+  return { operation: updated.operation, context };
 }
 function inferBundledToolContext(toolName, args) {
   const context = {};
@@ -7754,19 +7912,13 @@ function inferBundledToolContext(toolName, args) {
     Number.isFinite(retryCount) ? retryCount : 0,
     Number.isFinite(fanoutCount) ? fanoutCount : 0
   );
-  context["toolArgs.bytes"] = String(Buffer.byteLength(argsText, "utf8"));
-  const secretKind = detectSecretKind(argsText);
-  context["toolArgs.containsSecret"] = secretKind !== "none" ? "true" : "false";
-  context["toolArgs.secretKind"] = secretKind;
-  context["toolArgs.containsPii"] = hasPiiLikeValue(argsText) ? "true" : "false";
+  Object.assign(context, inputContentFacts(argsText));
   context["retry.count"] = String(burstCount);
   context["fanout.count"] = String(burstCount);
   for (const [key, val] of Object.entries(args)) {
-    if (typeof val === "string") {
-      context[key] = val;
-    } else if (typeof val === "number") {
-      context[key] = String(val);
-    }
+    if (typeof val !== "string" && typeof val !== "number" && typeof val !== "boolean") continue;
+    context[`args.${key}`] = String(val);
+    if (!reservedInputFact(key)) context[key] = String(val);
   }
   const nameWords = toolNameLower.replace(/[_\-.]/g, " ");
   const isSearchTool = /\b(search|grep|find|lookup|locate)\b/.test(nameWords) && !/\b(delete|remove|drop|write|update|insert|replace|create)\b/.test(nameWords);
@@ -7799,7 +7951,7 @@ function inferBundledToolContext(toolName, args) {
     else if (writeOps.some((op) => toolNameLower.includes(op))) operation = "write";
     else if (deleteOps.some((op) => toolNameLower.includes(op))) operation = "delete";
   }
-  const methodArg = (args.method || "").toUpperCase();
+  const methodArg = typeof args.method === "string" ? args.method.toUpperCase() : "";
   if (["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg)) {
     operation = methodArg;
     if (args.url) context.url = args.url;
@@ -7814,20 +7966,19 @@ function inferBundledToolContext(toolName, args) {
       const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || provenReadUrls.includes(detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
+      const requestHasSecret = recordHttpRequestFacts(context, args, detectedUrl);
       if (inbound) {
         context["source.domain"] = parsed.hostname;
         context["source.type"] = hostType;
-      } else {
+      }
+      if (!inbound || requestHasSecret) {
         context["destination.type"] = hostType;
       }
     } catch {
       context["url.risk"] = "invalid";
     }
   }
-  if (typeof args.destinationType === "string") context["destination.type"] = args.destinationType;
   if (typeof args.destination === "string") context.destination = args.destination;
-  if (typeof args.domain === "string") context["destination.domain"] = args.domain;
-  if (typeof args.toolStatus === "string") context["tool.status"] = args.toolStatus;
   if (args.to || args.recipient || args.email) {
     context.to = args.to || args.recipient || args.email;
     context["destination.type"] = context["destination.type"] || "external";
@@ -7850,6 +8001,77 @@ function inferBundledToolContext(toolName, args) {
   }
   return { operation, context };
 }
+var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "verdict",
+  "decision",
+  "approval",
+  "toolName",
+  "agentName",
+  "agentClient",
+  "developerName",
+  "machineName",
+  "machineKind",
+  "machineId",
+  "humanPresent",
+  "organizationId",
+  "tenantId",
+  "shieldId",
+  "userId",
+  "ipAddress",
+  "gateway",
+  "mcpServer"
+]);
+var RESERVED_FACT_NAMESPACES = /* @__PURE__ */ new Set([
+  "args",
+  "toolArgs",
+  "tool",
+  "agent",
+  "action",
+  "operation",
+  "url",
+  "destination",
+  "source",
+  "request",
+  "retry",
+  "fanout",
+  "runtime",
+  "machine",
+  "session",
+  "policy",
+  "tenant",
+  "organization",
+  "role",
+  "roles"
+]);
+function reservedInputFact(key) {
+  return RESERVED_INPUT_FACTS.has(key) || key.includes(".") && RESERVED_FACT_NAMESPACES.has(key.split(".")[0]);
+}
+var LEGACY_TRUST_LABEL_ARGS = /* @__PURE__ */ new Set(["destinationType", "domain", "toolStatus"]);
+function inputContentFacts(argsText) {
+  const secretKind = detectSecretKind(argsText);
+  return {
+    "toolArgs.bytes": String(Buffer.byteLength(argsText, "utf8")),
+    "toolArgs.containsSecret": secretKind !== "none" ? "true" : "false",
+    "toolArgs.secretKind": secretKind,
+    "toolArgs.containsPii": hasPiiLikeValue(argsText) ? "true" : "false"
+  };
+}
+function recordHttpRequestFacts(context, args, detectedUrl) {
+  try {
+    const parsed = new URL(detectedUrl);
+    if (!["http:", "https:"].includes(parsed.protocol)) return false;
+    const containsSecret = hasSecretLikeValue(stringifyArgs({ url: detectedUrl, headers: args.headers, body: args.body, data: args.data }));
+    context["request.destination.domain"] = parsed.hostname;
+    context["request.destination.type"] = isInternalHost(parsed.hostname) ? "internal" : "external";
+    context["request.containsSecret"] = containsSecret ? "true" : "false";
+    return containsSecret;
+  } catch {
+    return false;
+  }
+}
 function inferInventoryToolOperations(toolName, toolActions = []) {
   const ops = /* @__PURE__ */ new Set([toolName, toolName.toUpperCase(), ...toolActions]);
   const upper = toolName.toUpperCase();

package/dist/agentTerminal.d.ts

@@ -14,9 +14,7 @@ export declare const AGENT_TERMINAL_ASK_BLOCKED: string;
 /** Shown when the IDE prompt already answered for this exact command. */
 export declare const AGENT_TERMINAL_IDE_CONFIRMED = "allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.";
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
-export declare function ideShellPendingKey(command: string): string;
-/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
-export declare function ideLocalSafetyRememberKey(ruleId: string): string;
+export declare function ideShellPendingKey(command: string, cwd?: string): string;
 /** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 export declare const IDE_CONFIRMATION_WINDOW_MS: number;
 /**

package/dist/agentTerminal.js

@@ -36,7 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IDE_CONFIRMATION_WINDOW_MS = exports.AGENT_TERMINAL_IDE_CONFIRMED = exports.AGENT_TERMINAL_ASK_BLOCKED = exports.AGENT_TERMINAL_MARKERS = void 0;
 exports.isAgentDrivenTerminal = isAgentDrivenTerminal;
 exports.ideShellPendingKey = ideShellPendingKey;
-exports.ideLocalSafetyRememberKey = ideLocalSafetyRememberKey;
 exports.ideConfirmedFor = ideConfirmedFor;
 exports.buildAgentTerminalJs = buildAgentTerminalJs;
 exports.buildAgentTerminalPs = buildAgentTerminalPs;
@@ -84,19 +83,13 @@ exports.AGENT_TERMINAL_ASK_BLOCKED = 'an AI agent is driving this terminal, so n
 /** Shown when the IDE prompt already answered for this exact command. */
 exports.AGENT_TERMINAL_IDE_CONFIRMED = 'allowed through the IDE permission gate; confirmation is recorded by the IDE post-execution hook.';
 // ---------------------------------------------------------------------------
-// IDE-answer lookup keys. These MUST match devConfirm.ts: the hook raises a
-// pending marker keyed by sha256(`${event}|${tool}|${sha256('cmd:'+command)}`)
-// with event 'shell' and tool 'shell', and a remembered entry keyed by
-// sha256(`shell|local-safety:${ruleId}|${ruleId}`) for Local Safety ask rules.
+// Exact command + working directory handoff keys match devConfirm v3.
+// A handoff delegates to the IDE permission gate; it is never consent.
 // ---------------------------------------------------------------------------
 const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
 /** Pending-marker key the IDE hook wrote for this shell command (see devConfirm.pendingKey). */
-function ideShellPendingKey(command) {
-    return sha256(`shell|shell|${sha256(`cmd:${command.trim()}`)}`);
-}
-/** Remembered-confirmation key for a Local Safety ask rule on the shell tool (see devConfirm rememberKey). */
-function ideLocalSafetyRememberKey(ruleId) {
-    return sha256(`shell|local-safety:${ruleId}|${ruleId}`);
+function ideShellPendingKey(command, cwd = process.cwd()) {
+    return sha256(JSON.stringify(['shell', 'shell', sha256(`args-v3:${JSON.stringify({ command, cwd })}`)]));
 }
 /** Maximum lifetime of an exact-command IDE permission handoff (not consent). */
 exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
@@ -106,12 +99,9 @@ exports.IDE_CONFIRMATION_WINDOW_MS = 10 * 60_000;
  * by the generated guard code below.
  */
 function ideConfirmedFor(ledger, command, ruleId, now = Date.now(), sessionId) {
-    if (!ledger || ledger.formatVersion !== 2)
-        return false;
-    // A pending prompt is not an affirmative answer. IDE handoffs are handled
-    // separately by the generated guard, without claiming developer consent.
-    const rememberKey = ideLocalSafetyRememberKey(ruleId);
-    return (ledger.remembered || []).some(r => r?.key === rememberKey && typeof r.expiresAt === 'string' && Date.parse(r.expiresAt) > now && (r.remember === '1h' || (r.remember === 'session' && !!sessionId && r.sessionId === sessionId)));
+    // Terminal guards lack the hook's complete policy/context snapshot. They
+    // cannot reconstruct a scoped approval and must never infer one from a rule.
+    return false;
 }
 // ---------------------------------------------------------------------------
 // Rendered snippets for the generated guards (single source of truth).
@@ -129,7 +119,7 @@ function buildAgentTerminalJs() {
         `function agentTerminal(){const e=process.env;return AGENT_MARKERS.some(m=>m.v!==undefined?e[m.n]===m.v:(typeof e[m.n]==='string'&&e[m.n].length>0));}`,
         `const IDE_WINDOW_MS=${exports.IDE_CONFIRMATION_WINDOW_MS};`,
         `function sha(s){return crypto.createHash('sha256').update(s).digest('hex');}`,
-        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));const now=Date.now();const pk=sha('shell|shell|'+sha('cmd:'+line.trim()));if((ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS))return true;if(ledger.formatVersion!==2)return false;const rk=sha('shell|local-safety:'+ruleId+'|'+ruleId);const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;return (ledger.remembered||[]).some(r=>r&&r.key===rk&&typeof r.expiresAt==='string'&&Date.parse(r.expiresAt)>now&&(r.remember==='1h'||(r.remember==='session'&&session&&r.sessionId===session)));}catch{return false;}}`,
+        `function ideConfirmed(line,ruleId){try{const ledger=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.fullcourtdefense','dev-confirm.json'),'utf8'));if(ledger.formatVersion!==3)return false;const now=Date.now();const pk=sha(JSON.stringify(['shell','shell',sha('args-v3:'+JSON.stringify({command:line,cwd:process.cwd()}))]));const session=process.env.FCD_SESSION_ID||process.env.CLAUDE_CODE_SESSION_ID||process.env.CODEX_THREAD_ID;if(!session)return false;return (ledger.pending||[]).some(p=>p&&p.permissionHandoff===true&&p.sessionId===session&&p.key===pk&&typeof p.raisedAt==='string'&&now>=Date.parse(p.raisedAt)&&now-Date.parse(p.raisedAt)<IDE_WINDOW_MS);}catch{return false;}}`,
         `const AGENT_ASK_BLOCKED=${JSON.stringify(exports.AGENT_TERMINAL_ASK_BLOCKED)};`,
         `const AGENT_IDE_CONFIRMED=${JSON.stringify(exports.AGENT_TERMINAL_IDE_CONFIRMED)};`,
     ].join('\n');
@@ -165,24 +155,19 @@ function buildAgentTerminalPs() {
         `    $ledgerPath = Join-Path $HOME '.fullcourtdefense\\dev-confirm.json'`,
         `    if (-not (Test-Path -LiteralPath $ledgerPath)) { return $false }`,
         `    $ledger = Get-Content -LiteralPath $ledgerPath -Raw | ConvertFrom-Json`,
+        `    if ($ledger.formatVersion -ne 3) { return $false }`,
+        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }; if (-not $session) { return $false }`,
         `    $now = [DateTimeOffset]::UtcNow`,
-        `    $pk = Get-FcdSha256 ('shell|shell|' + (Get-FcdSha256 ('cmd:' + $Line.Trim())))`,
+        `    $argsJson = ConvertTo-Json -Compress -InputObject ([ordered]@{command=$Line;cwd=(Get-Location).ProviderPath})`,
+        `    $digest = Get-FcdSha256 ('args-v3:' + $argsJson)`,
+        `    $pk = Get-FcdSha256 (ConvertTo-Json -Compress -InputObject @('shell','shell',$digest))`,
         `    foreach ($p in @($ledger.pending)) {`,
-        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.key -eq $pk -and $p.raisedAt) {`,
+        `      if ($null -ne $p -and $p.permissionHandoff -eq $true -and $p.sessionId -ceq $session -and $p.key -ceq $pk -and $p.raisedAt) {`,
         `        $raised = if ($p.raisedAt -is [DateTime]) { [DateTimeOffset]$p.raisedAt } else { [DateTimeOffset]::Parse([string]$p.raisedAt, [Globalization.CultureInfo]::InvariantCulture) }`,
         `        $age = $now - $raised`,
         `        if ($age.TotalMilliseconds -ge 0 -and $age.TotalMilliseconds -lt ${exports.IDE_CONFIRMATION_WINDOW_MS}) { return $true }`,
         `      }`,
         `    }`,
-        `    if ($ledger.formatVersion -ne 2) { return $false }`,
-        `    $rk = Get-FcdSha256 ('shell|local-safety:' + $RuleId + '|' + $RuleId)`,
-        `    $session = $env:FCD_SESSION_ID; if (-not $session) { $session = $env:CLAUDE_CODE_SESSION_ID }; if (-not $session) { $session = $env:CODEX_THREAD_ID }`,
-        `    foreach ($r in @($ledger.remembered)) {`,
-        `      if ($null -ne $r -and $r.key -eq $rk -and $r.expiresAt -and ($r.remember -eq '1h' -or ($r.remember -eq 'session' -and $session -and $r.sessionId -eq $session))) {`,
-        `        $expiry = if ($r.expiresAt -is [DateTime]) { [DateTimeOffset]$r.expiresAt } else { [DateTimeOffset]::Parse([string]$r.expiresAt, [Globalization.CultureInfo]::InvariantCulture) }`,
-        `        if ($expiry -gt $now) { return $true }`,
-        `      }`,
-        `    }`,
         `  } catch { }`,
         `  return $false`,
         `}`,

package/dist/approvalPrompt.d.ts

@@ -0,0 +1,7 @@
+export interface ApprovalMessageOptions {
+    /** The dialog offers "Always allow"; the footer must say what that covers. */
+    allowAlways?: boolean;
+    /** Human wording of the grant scope, e.g. "`gh` commands (write) to github.com". */
+    alwaysScopeLabel?: string;
+}
+export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;