fullcourtdefense-cli 1.34.25 → 1.34.26

package/dist/actionPolicyEngine.d.ts

@@ -29,13 +29,26 @@ export interface ActionPolicyApproval {
     scope?: ActionPolicyApprovalScope;
     remember?: ActionPolicyApprovalRemember;
     onTimeout?: ActionPolicyApprovalOnTimeout;
+    /**
+     * Caps on a developer's "Always allow" under this rule: lifetime in days
+     * (1–30) and uses before the dialog returns (1–10000). Absent = the built-in
+     * 30-day lifetime, unlimited uses. The org ceiling delivered with the bundle
+     * can only tighten these, never widen them.
+     */
+    maxDays?: number;
+    maxUses?: number;
 }
 /** Fully-resolved approval options (every field present) attached to a `require_approval` result. */
 export interface ResolvedActionPolicyApproval {
     scope: ActionPolicyApprovalScope;
     remember: ActionPolicyApprovalRemember;
     onTimeout: ActionPolicyApprovalOnTimeout;
+    /** "Always allow" caps (see `ActionPolicyApproval`); undefined = built-in default. */
+    maxDays?: number;
+    maxUses?: number;
 }
+export declare const ACTION_POLICY_GRANT_MAX_DAYS = 30;
+export declare const ACTION_POLICY_GRANT_MAX_USES = 10000;
 export interface ActionPolicyRule {
     /** Explicit, narrowly scoped permission to relax named role actions only. */
     roleException?: {

package/dist/actionPolicyEngine.js

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/actionPolicyEngine.ts
 var actionPolicyEngine_exports = {};
 __export(actionPolicyEngine_exports, {
+  ACTION_POLICY_GRANT_MAX_DAYS: () => ACTION_POLICY_GRANT_MAX_DAYS,
+  ACTION_POLICY_GRANT_MAX_USES: () => ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS: () => CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL: () => DEFAULT_ACTION_POLICY_APPROVAL,
   MACHINE_KINDS: () => MACHINE_KINDS,
@@ -6237,6 +6239,18 @@ function provenPowerShellQueryUrls(command) {
     return [];
   }
 }
+var ACTION_POLICY_GRANT_MAX_DAYS = 30;
+var ACTION_POLICY_GRANT_MAX_USES = 1e4;
+function approvalCap(value, limit) {
+  const n = typeof value === "number" ? value : typeof value === "string" && value.trim() ? Number(value) : NaN;
+  if (!Number.isFinite(n) || n < 1) return void 0;
+  return Math.min(limit, Math.floor(n));
+}
+function minCap(a, b) {
+  if (a === void 0) return b;
+  if (b === void 0) return a;
+  return Math.min(a, b);
+}
 function approvalExceptionError(rule) {
   const roleError = roleExceptionError(rule);
   if (roleError) return roleError;
@@ -6314,17 +6328,25 @@ function resolveApprovalOptions(approval) {
   const scope = approval?.scope;
   const remember = approval?.remember;
   const onTimeout = approval?.onTimeout;
+  const maxDays = approvalCap(approval?.maxDays, ACTION_POLICY_GRANT_MAX_DAYS);
+  const maxUses = approvalCap(approval?.maxUses, ACTION_POLICY_GRANT_MAX_USES);
   return {
     scope: scope === "developer" || scope === "org" ? scope : DEFAULT_ACTION_POLICY_APPROVAL.scope,
     remember: remember === "session" || remember === "1h" || remember === "none" ? remember : DEFAULT_ACTION_POLICY_APPROVAL.remember,
-    onTimeout: onTimeout === "org" || onTimeout === "block" ? onTimeout : DEFAULT_ACTION_POLICY_APPROVAL.onTimeout
+    onTimeout: onTimeout === "org" || onTimeout === "block" ? onTimeout : DEFAULT_ACTION_POLICY_APPROVAL.onTimeout,
+    ...maxDays !== void 0 ? { maxDays } : {},
+    ...maxUses !== void 0 ? { maxUses } : {}
   };
 }
 function mergeApprovalOptions(a, b) {
+  const maxDays = minCap(a.maxDays, b.maxDays);
+  const maxUses = minCap(a.maxUses, b.maxUses);
   return {
     scope: APPROVAL_SCOPE_RANK[b.scope] > APPROVAL_SCOPE_RANK[a.scope] ? b.scope : a.scope,
     remember: APPROVAL_REMEMBER_RANK[b.remember] > APPROVAL_REMEMBER_RANK[a.remember] ? b.remember : a.remember,
-    onTimeout: APPROVAL_ON_TIMEOUT_RANK[b.onTimeout] > APPROVAL_ON_TIMEOUT_RANK[a.onTimeout] ? b.onTimeout : a.onTimeout
+    onTimeout: APPROVAL_ON_TIMEOUT_RANK[b.onTimeout] > APPROVAL_ON_TIMEOUT_RANK[a.onTimeout] ? b.onTimeout : a.onTimeout,
+    ...maxDays !== void 0 ? { maxDays } : {},
+    ...maxUses !== void 0 ? { maxUses } : {}
   };
 }
 function effectiveApprovalScope(approval, presence) {
@@ -6790,14 +6812,24 @@ var COMMAND_LINE_FIELDS = /* @__PURE__ */ new Set(["command", "cmd", "commandLin
 var CODE_EXEC_TOOL_NAME_RE = /\b(node ?repl|repl|shell|exec|execute|terminal|command|cmd|run ?code|bash|zsh|sh|powershell|pwsh)\b/i;
 function shellVerbWords(command) {
   let lead = "";
+  let first = true;
+  let scriptArgs = false;
   return shellCommandWords(command).split(/\s+/).filter(Boolean).map((token) => {
     if (token === ";") {
       lead = "";
+      first = true;
+      scriptArgs = false;
       return token;
     }
+    if (scriptArgs) return "";
     const flag = /^(-{1,2})([A-Za-z][A-Za-z0-9_-]*)(?:=.*)?$/.exec(token);
     const word = flag ? flag[2] : /^\.?[A-Za-z][A-Za-z0-9_-]*$/.test(token) ? token : "";
-    if (!word) return "";
+    const leading = first && !flag;
+    if (leading) first = false;
+    if (!word) {
+      if (leading ? isScriptPath(token, true) : !flag && SCRIPT_RUNNER_LEADS.has(lead) && isScriptPath(token, false)) scriptArgs = true;
+      return "";
+    }
     if (!flag && !lead) lead = word.toLowerCase();
     if (flag) {
       if (VCS_PROGRAMS.has(lead)) return "";
@@ -6812,6 +6844,50 @@ function shellVerbWords(command) {
   }).filter(Boolean).join(" ");
 }
 var VCS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "hg", "svn", "glab"]);
+var SCRIPT_RUNNER_LEADS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "cmd",
+  "powershell",
+  "pwsh",
+  "sudo",
+  "doas",
+  "env",
+  "nohup",
+  "time",
+  "timeout",
+  "watch",
+  "ssh",
+  "xargs",
+  "node",
+  "nodejs",
+  "deno",
+  "bun",
+  "python",
+  "python3",
+  "python2",
+  "py",
+  "perl",
+  "ruby",
+  "php",
+  "lua",
+  "rscript",
+  "julia",
+  "tsx",
+  "ts-node",
+  "npx"
+]);
+var SCRIPT_EXTENSION_RE = /\.(?:ps1|psm1|sh|bash|zsh|ksh|fish|py|pyw|js|mjs|cjs|ts|mts|cts|rb|pl|php|lua|r|jl|cmd|bat)$/i;
+function isScriptPath(token, leading) {
+  const t = token.replace(/^["']|["']$/g, "");
+  if (!t || /^[$%<>|&]/.test(t)) return false;
+  if (SCRIPT_EXTENSION_RE.test(t)) return true;
+  return leading ? /^\.{1,2}[\\/]/.test(t) : /[\\/]/.test(t);
+}
 var DOT_COMMAND_PROGRAMS = /* @__PURE__ */ new Set(["sqlite3", "sqlite", "litecli", "duckdb"]);
 function stringifyArgs(args) {
   try {
@@ -6866,13 +6942,14 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
 }
 var SECRET_NAME = String.raw`(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key|secret|password|passwd|pwd|credentials?|private[_-]?key|token)`;
 var SECRET_ASSIGNMENT_RE = new RegExp(String.raw`(?:^|[^\w])[\w.-]*?${SECRET_NAME}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{8,})`, "gi");
-var SECRET_FLAG_RE = /--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>]{8,})/gi;
-var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an|some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
+var SECRET_FLAG_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>-][^\s\\"',;&|)}\]<>]{7,})/gi;
+var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an)(?:[-_.][\w.-]*)?|(?:some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
 var SECRET_CODE_EXPR_RE = /^(?:[A-Za-z_$][\w$]*(?:[.\[][^\s=]*)+|[A-Za-z_$][\w$]*\(.*\)?|process\.env\.\w+|os\.environ.*|env(?:iron)?\.\w+|new\s+\w+.*|await\s+.*|require\(.*)$/;
 function looksLikeSecretValue(raw) {
   const value = raw.replace(/[\\"'`]+$/, "");
   if (value.length < 8) return false;
   if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value)) return false;
+  if (/^--?[A-Za-z]/.test(value)) return false;
   if (SECRET_PLACEHOLDER_RE.test(value)) return false;
   if (SECRET_CODE_EXPR_RE.test(value)) return false;
   if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value)) return false;
@@ -7077,7 +7154,7 @@ function extractUrl(args, _argsText) {
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
     const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).join("\n") : raw;
-    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>]+/i)?.[0];
+    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
       try {
@@ -7086,15 +7163,210 @@ function extractUrl(args, _argsText) {
         return false;
       }
     });
-    const found = externalOutbound || outboundUrls[0] || firstUrl(value);
+    const found = externalOutbound || outboundUrls[0] || firstUrl(shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)).join("\n") : value);
     if (found) return found;
   }
   return "";
 }
+var LOCAL_DATA_LEADS = /* @__PURE__ */ new Set([
+  // PowerShell text / file / pipeline cmdlets and their aliases
+  "get-content",
+  "gc",
+  "type",
+  "set-content",
+  "sc",
+  "add-content",
+  "ac",
+  "out-file",
+  "out-string",
+  "out-null",
+  "write-host",
+  "write-output",
+  "write-verbose",
+  "write-warning",
+  "write-error",
+  "write-information",
+  "write-debug",
+  "select-string",
+  "sls",
+  "select-object",
+  "select",
+  "where-object",
+  "where",
+  "foreach-object",
+  "foreach",
+  "%",
+  "?",
+  "sort-object",
+  "sort",
+  "group-object",
+  "group",
+  "measure-object",
+  "measure",
+  "compare-object",
+  "compare",
+  "format-table",
+  "ft",
+  "format-list",
+  "fl",
+  "format-wide",
+  "fw",
+  "convertto-json",
+  "convertfrom-json",
+  "convertto-csv",
+  "convertfrom-csv",
+  "test-path",
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "ls",
+  "dir",
+  "split-path",
+  "join-path",
+  "resolve-path",
+  "new-item",
+  "ni",
+  "copy-item",
+  "cpi",
+  "copy",
+  "move-item",
+  "mi",
+  "move",
+  "rename-item",
+  "rni",
+  "ren",
+  "remove-item",
+  "ri",
+  "del",
+  "erase",
+  "rd",
+  "rmdir",
+  "get-date",
+  "set-location",
+  "cd",
+  "chdir",
+  "push-location",
+  "pushd",
+  "pop-location",
+  "popd",
+  "get-location",
+  "pwd",
+  // POSIX text / file tools
+  "echo",
+  "printf",
+  "cat",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "cut",
+  "uniq",
+  "head",
+  "tail",
+  "tr",
+  "wc",
+  "test",
+  "mkdir",
+  "touch",
+  "cp",
+  "mv",
+  "rm",
+  "ln",
+  "basename",
+  "dirname",
+  "realpath",
+  "jq",
+  "yq",
+  "diff",
+  "date",
+  "true",
+  "false"
+]);
+var GIT_NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "clone",
+  "fetch",
+  "pull",
+  "push",
+  "remote",
+  "ls-remote",
+  "submodule",
+  "archive",
+  "request-pull",
+  "svn",
+  "daemon",
+  "bundle",
+  "http-fetch",
+  "http-push",
+  "send-pack",
+  "fetch-pack",
+  "upload-pack",
+  "receive-pack",
+  "lfs"
+]);
+function segmentMayReachNetwork(segment) {
+  if (/\$\(|`/.test(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
+  return splitShellSegments(segment, true).some((stage) => {
+    if (/^\s*(?:\$[\w:]+|[A-Za-z_]\w*)\s*=/.test(stage)) return true;
+    const masked = maskQuotedSpans(stage);
+    for (const group of masked.matchAll(/\(\s*([A-Za-z][\w-]*)/g)) {
+      if (!LOCAL_DATA_LEADS.has(group[1].toLowerCase())) return true;
+    }
+    const lead = shellSegmentLead(stage);
+    if (!lead) return false;
+    if (lead === "git") {
+      const subcommand = gitSubcommand(stage);
+      return !subcommand || GIT_NETWORK_SUBCOMMANDS.has(subcommand);
+    }
+    return !LOCAL_DATA_LEADS.has(lead);
+  });
+}
+var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*')\s*$/;
+function segmentsThatMayReachNetwork(segments) {
+  const tempRedefined = segments.some((segment) => /\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(segment)));
+  const remotePath = /(?:^|[\s"'=(])[\\/]{2}[^\s\\/"']+[\\/]/;
+  return segments.filter((segment, index) => {
+    if (!LITERAL_ASSIGNMENT_RE.test(segment)) return segmentMayReachNetwork(segment);
+    return segments.slice(index + 1).some((later) => !LITERAL_ASSIGNMENT_RE.test(later) && (remotePath.test(later) || ghMetadataWriteBodyFile(tempRedefined ? later : temporaryFileSyntax(later)) === void 0 && segmentMayReachNetwork(later)));
+  });
+}
+function gitSubcommand(stage) {
+  const tokens = maskQuotedSpans(stage).trim().split(/\s+/);
+  let i2 = tokens.findIndex((token) => /^(?:.*[\\/])?git(?:\.exe)?$/i.test(token)) + 1;
+  if (i2 <= 0) return "";
+  while (i2 < tokens.length && tokens[i2].startsWith("-")) {
+    if (/^(?:-c|-C|--git-dir|--work-tree|--namespace|--exec-path|--config-env|--super-prefix|--list-cmds)$/i.test(tokens[i2])) i2++;
+    i2++;
+  }
+  const subcommand = (tokens[i2] || "").toLowerCase();
+  return /^[a-z][\w-]*$/.test(subcommand) ? subcommand : "";
+}
+function temporaryFileSyntax(text) {
+  return text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/(?<=^|\s)\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_./\\-]+)(?=\s|$)/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
+}
+var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
+function ghMetadataWriteBodyFile(segment) {
+  const ghBody = /^gh\s+(pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+(.+?)(?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?$/i.exec(segment);
+  if (!ghBody) return void 0;
+  const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
+  if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
+  let bodyFile;
+  for (let i2 = 0; i2 < tokens.length; i2 += 2) {
+    const flag = tokens[i2];
+    const value = tokens[i2 + 1];
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (/^--body-file$/i.test(flag)) {
+      if (bodyFile !== void 0) return void 0;
+      bodyFile = value;
+    }
+  }
+  return bodyFile;
+}
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
   if (/\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(command))) return command;
-  const fileSyntax = (text) => text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
+  const fileSyntax = temporaryFileSyntax;
   const originalSegments = splitShellSegments(command);
   const localPaths = /* @__PURE__ */ new Map();
   const literalValues = /* @__PURE__ */ new Map();
@@ -7111,7 +7383,7 @@ function shellUrlActionText(command) {
     return value;
   };
   const segments = originalSegments.map((segment, index) => {
-    const dataAssignment = /^\$([A-Za-z_][\w]*)\s*=\s*(@'\r?\n[\s\S]*?\r?\n'@|'(?:[^']|'')*')$/.exec(segment);
+    const dataAssignment = /^\$([A-Za-z_][\w]*)\s*=\s*(@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*')$/.exec(segment);
     if (dataAssignment && !literalValues.has(dataAssignment[1].toLowerCase()) && literalValues.size < 32) {
       literalValues.set(dataAssignment[1].toLowerCase(), dataAssignment[2]);
       dataAssignments.add(index);
@@ -7125,7 +7397,7 @@ function shellUrlActionText(command) {
       pathAssignments.add(index);
       return segment;
     }
-    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/.exec(segment);
+    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/.exec(segment);
     const prefix = literal2?.[0] || "";
     const tail = segment.slice(prefix.length).replace(
       /"\$([A-Za-z_][\w]*)([\\/][\w ./\\-]*)?"/g,
@@ -7147,8 +7419,9 @@ function shellUrlActionText(command) {
     );
   });
   if (expansionOverflow) return command;
-  const filtered = segments.map((segment) => {
-    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/;
+  const storedTargets = /* @__PURE__ */ new Map();
+  const filtered = segments.map((segment, index) => {
+    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/;
     const piped = segment.match(literal2);
     let tail = piped ? segment.slice(piped[0].length).replace(/^\s*\|\s*/, "") : "";
     if (!piped || !/^\s*\|/.test(segment.slice(piped[0].length))) {
@@ -7176,8 +7449,15 @@ function shellUrlActionText(command) {
     }
     target = target.replace(/^['"]|['"]$/g, "");
     if (!target || /^[\\/]{2}|[\r\n*?\[\]<>]/.test(target) || /:/.test(target.replace(/^[A-Za-z]:[\\/]/, ""))) return segment;
+    const key = target.toLowerCase();
+    if (!storedTargets.has(key)) storedTargets.set(key, index);
     return tail;
   });
+  const isStoredTarget = (token, before) => {
+    if (!token) return false;
+    const written = storedTargets.get(token.replace(/^['"]|['"]$/g, "").toLowerCase());
+    return written !== void 0 && written < before;
+  };
   const onlyStoredData = segments.every((segment, index) => {
     if (dataAssignments.has(index)) return true;
     if (pathAssignments.has(index)) return true;
@@ -7187,6 +7467,10 @@ function shellUrlActionText(command) {
     if (/^if\s*\(\$([A-Za-z_][\w]*)\.Count\)\s*\{\s*throw\s+\$\1\[0\]\s*\}$/i.test(segment)) return true;
     if (/^Write-Output\s+'(?:[^']|'')*'$/i.test(segment)) return true;
     if (/^gh\s+pr\s+checks\s+\d+\s+--json\s+[a-z,]+\s+--jq\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    const ghBodyFile = ghMetadataWriteBodyFile(segment);
+    if (ghBodyFile !== void 0) return isStoredTarget(ghBodyFile, index);
+    const removal = /^Remove-Item\s+(?:-(?:LiteralPath|Path)\s+)?('[^'\r\n]*'|"[^"\r\n]*"|[^\s'"$`|;&(){}<>]+)(?:\s+-Force)?$/i.exec(segment);
+    if (removal && isStoredTarget(removal[1], index)) return true;
     const read = /^Get-Content\s+(?:(?:-LiteralPath|-Path)\s+)?(?:'([^'$`\r\n]*)'|"([^"$`\r\n]*)"|([^\s'"$`|;&(){}<>]+))(?:\s+-(?:Tail|TotalCount)\s+\d{1,6})?(?:\s+-Raw)?\s*$/i.exec(segment);
     if (read) {
       const target = read[1] ?? read[2] ?? read[3];
@@ -7508,8 +7792,8 @@ function classifyShellWords(masked, raw, lead) {
   if (/\b(drop\s+(database|table|schema)|truncate\s+table|kubectl\s+delete|terraform\s+destroy|gcloud\s+(?:sql\s+instances|compute\s+instances|projects|run\s+services)\s+delete|az\s+(?:group|vm|sql\s+server)\s+delete|aws\s+(?:s3\s+rb|rds\s+delete-db-instance|ec2\s+terminate-instances)|docker\s+(?:system\s+prune|volume\s+rm|rm\s+-f)|mkfs|dd\s+if=)\b/.test(value)) {
     return "DELETE";
   }
-  const xfer = segment.toLowerCase().match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
-  if (xfer && /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/.test(value)) {
+  const xfer = segment.toLowerCase().match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
+  if (xfer && /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/.test(value)) {
     if (/az\s+storage\s+blob\s+upload/.test(value)) return "write";
     const tokens = xfer[1].split(/\s+/).filter(Boolean).map((t) => t.replace(/^["']|["']$/g, ""));
     const operands = [];
@@ -7707,6 +7991,10 @@ function isInternalHost(hostname) {
   const private172 = host.match(/^172\.(\d+)\./);
   return Boolean(private172 && Number(private172[1]) >= 16 && Number(private172[1]) <= 31);
 }
+function isSingleLabelWebHost(parsed) {
+  const host = parsed.hostname.toLowerCase();
+  return /^(?:https?|wss?):$/.test(parsed.protocol) && host.length > 0 && !host.includes(".") && !host.includes(":");
+}
 function policyTargetsCall(policy, context) {
   if (!policyTargetsMachineKind(policy.appliesTo, normalizeMachineKind(context.machineKind))) return false;
   const developerTargets = policy.appliesTo?.developerNames?.filter(Boolean) || [];
@@ -7962,7 +8250,7 @@ function inferBundledToolContext(toolName, args) {
     context.url = detectedUrl;
     try {
       const parsed = new URL(detectedUrl);
-      const hostType = isInternalHost(parsed.hostname) ? "internal" : "external";
+      const hostType = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
       const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || provenReadUrls.includes(detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
@@ -8065,7 +8353,7 @@ function recordHttpRequestFacts(context, args, detectedUrl) {
     if (!["http:", "https:"].includes(parsed.protocol)) return false;
     const containsSecret = hasSecretLikeValue(stringifyArgs({ url: detectedUrl, headers: args.headers, body: args.body, data: args.data }));
     context["request.destination.domain"] = parsed.hostname;
-    context["request.destination.type"] = isInternalHost(parsed.hostname) ? "internal" : "external";
+    context["request.destination.type"] = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
     context["request.containsSecret"] = containsSecret ? "true" : "false";
     return containsSecret;
   } catch {
@@ -8096,6 +8384,8 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACTION_POLICY_GRANT_MAX_DAYS,
+  ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL,
   MACHINE_KINDS,

package/dist/approvalPrompt.d.ts

@@ -3,5 +3,7 @@ export interface ApprovalMessageOptions {
     allowAlways?: boolean;
     /** Human wording of the grant scope, e.g. "`gh` commands (write) to github.com". */
     alwaysScopeLabel?: string;
+    /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
+    alwaysLimitsLabel?: string;
 }
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -39,7 +39,7 @@ function nativeApprovalMessage(reason, options = {}) {
     return [
         'Allow this action?',
         '', ...details, '',
-        ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for 30 days on this machine, under this rule as it is written today.`, ''] : []),
+        ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`, ''] : []),
         'Allow once permits only this action. Deny or closing keeps it stopped.',
         'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
     ].join('\n');

package/dist/askDialog.d.ts

@@ -20,7 +20,7 @@
  * Deterministic all the way: the rule that asked is named in the envelope, the
  * grant is bound to that rule's hash, and nothing here re-evaluates the action.
  */
-import { ConfirmRemember, GrantScope, NativeDialogOptions, NativeDialogOutcome } from './devConfirm';
+import { ConfirmRemember, GrantLimits, GrantScope, NativeDialogOptions, NativeDialogOutcome } from './devConfirm';
 /** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
 export declare const ASK_ENVELOPE_FIELD = "fcdAsk";
 /** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
@@ -36,9 +36,22 @@ export interface AskEnvelope {
     scope: GrantScope;
     policyId?: string;
     policyName?: string;
+    /** Bundle hash — goes on the recorded event. */
     policyHash?: string;
+    /**
+     * Identity of the rule as written (`actionPolicyRuleHash` / `localSafetyRuleHash`).
+     * A grant binds to this so it survives unrelated org edits and enrollments.
+     * Older hook builds omit it; the bundle hash is the fallback.
+     */
+    ruleHash?: string;
     matchedRule?: string;
     remember: ConfirmRemember;
+    /**
+     * Caps an "Always allow" would be created under (rule + org ceiling).
+     * `null` = the org switched "Always allow" off (no third button).
+     * Absent (older hook build) = the built-in 30 days.
+     */
+    grantLimits?: GrantLimits | null;
     /** Text for the dialog (the same explanation the IDE card shows). */
     reason: string;
 }

package/dist/askDialog.js

@@ -138,15 +138,18 @@ async function resolveAskWithDialog(verdict, options = {}) {
     const canAsk = options.dialog ? (0, devConfirm_1.isHumanPresent)() : (0, devConfirm_1.nativeDialogAvailable)();
     if (askChannel() === 'ide' || !canAsk)
         return { ...clean, resolution: 'ide' };
-    const allowAlways = envelope.remember !== 'none' && Boolean(envelope.policyHash)
+    const grantHash = envelope.ruleHash || envelope.policyHash;
+    const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
+    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits)
         && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
     const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope) : undefined;
+    const limitsLabel = allowAlways && grantLimits ? (0, devConfirm_1.describeGrantLimits)(grantLimits) : undefined;
     const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;
     const reason = options.clientLabel ? `IDE: ${options.clientLabel}\n${envelope.reason}` : envelope.reason;
     let outcome = 'unavailable';
     let latencyMs = 0;
     try {
-        ({ outcome, latencyMs } = await dialog(reason, options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, { allowAlways, alwaysScopeLabel: scopeLabel }));
+        ({ outcome, latencyMs } = await dialog(reason, options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, { allowAlways, alwaysScopeLabel: scopeLabel, alwaysLimitsLabel: limitsLabel }));
     }
     catch {
         outcome = 'unavailable';
@@ -154,13 +157,12 @@ async function resolveAskWithDialog(verdict, options = {}) {
     if (outcome === 'unavailable')
         return { ...clean, resolution: 'ide' };
     const policyLabel = envelope.policyName ? ` (${envelope.policyName})` : '';
-    const rule = { policyId: envelope.policyId, policyName: envelope.policyName, matchedRule: envelope.matchedRule, policyHash: envelope.policyHash };
     if (outcome === 'allow' || outcome === 'allow_always') {
         // Same bookkeeping the post-execution hook would have done for an IDE Allow.
         (0, devConfirm_1.settleDeveloperConfirmation)(envelope.event, envelope.toolName, envelope.argsDigest);
         let granted = false;
-        if (outcome === 'allow_always' && allowAlways && envelope.policyHash) {
-            granted = Boolean((0, devConfirm_1.recordDeveloperGrant)(envelope.scope, { ...rule, policyHash: envelope.policyHash }));
+        if (outcome === 'allow_always' && allowAlways && grantHash && grantLimits) {
+            granted = Boolean((0, devConfirm_1.recordDeveloperGrant)(envelope.scope, { policyId: envelope.policyId, policyName: envelope.policyName, matchedRule: envelope.matchedRule, policyHash: grantHash }, grantLimits));
         }
         // The MCP gateway sees this exact call next; do not ask the person twice.
         if (envelope.event === 'mcp')
@@ -170,7 +172,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
             toolName: envelope.toolName,
             operation: envelope.operation,
             reason: granted
-                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (30 days, this rule)${policyLabel}`
+                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (${limitsLabel}, this rule)${policyLabel}`
                 : `developer confirmed in the FullCourtDefense dialog${policyLabel}`,
             ruleId: envelope.policyId,
             policyHash: envelope.policyHash,
@@ -180,7 +182,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         });
         (0, telemetry_1.triggerFlush)(false);
         const agentMsg = granted
-            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} under this rule.`
+            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} (${limitsLabel}) under this rule.`
             : `FullCourtDefense: the developer allowed this ${envelope.event} once in the FullCourtDefense dialog.`;
         return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, true, '', agentMsg)), exitCode: 0, resolution: outcome };
     }

package/dist/commands/deterministicGuard.js

@@ -568,7 +568,6 @@ function containsMetadataEndpoint(value) {
 }
 function containsSensitiveCredentialPath(value) {
     const text = normalizeForPath(value);
-    const traversal = /(?:^|\/)\.\.(?:\/|$)/.test(text) || /%2e/i.test(value);
     const checks = [
         { itemId: 'ssh_private_key', label: 'SSH private key', re: /(?:^|\/)\.ssh\/id_(?:rsa|ed25519|ecdsa|dsa)(?:$|[/?#\s'"])/ },
         { itemId: 'ssh_config', label: 'SSH config', re: /(?:^|\/)\.ssh\/config(?:$|[/?#\s'"])/ },
@@ -605,12 +604,20 @@ function containsSensitiveCredentialPath(value) {
         if (check.re.test(text))
             return { itemId: check.itemId, label: check.label };
     }
-    if (/(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[/?#\s'"])/.test(text)) {
+    // `.env` is a FILE, the last segment of its path: `../.env`, `.env.local`,
+    // `cat ../../.env`. A regex literal such as `process\.env\.\w*` normalizes to
+    // `process/.env/.\w*` — a directory named .env with more path after it — and
+    // is not a file read. Traversal and the file must sit in the SAME path token:
+    // `../.github/x.yml` on one argument and `.env` on another are two unrelated
+    // arguments, not a reach outside the workspace (recorded IDE false positive).
+    const envToken = text.split(/[\s'"]+/).find(token => /(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[?#])/.test(token));
+    if (envToken) {
         // Traversal to a .env outside the workspace stays a hard block
         // (env_traversal); a plain workspace .env is a separate warn-by-default
         // item (env_workspace) — agents legitimately read it during development,
         // but the fleet should still see every touch.
-        return traversal
+        const reachesOutside = /(?:^|\/)\.\.(?:\/|$)/.test(envToken) || /%2e/i.test(envToken);
+        return reachesOutside
             ? { itemId: 'env_traversal', label: 'environment file via path traversal' }
             : { itemId: 'env_workspace', label: 'workspace environment file' };
     }