fullcourtdefense-cli 1.34.25 → 1.35.0

package/dist/actionPolicyEngine.d.ts

@@ -29,13 +29,26 @@ export interface ActionPolicyApproval {
     scope?: ActionPolicyApprovalScope;
     remember?: ActionPolicyApprovalRemember;
     onTimeout?: ActionPolicyApprovalOnTimeout;
+    /**
+     * Caps on a developer's "Always allow" under this rule: lifetime in days
+     * (1–30) and uses before the dialog returns (1–10000). Absent = the built-in
+     * 30-day lifetime, unlimited uses. The org ceiling delivered with the bundle
+     * can only tighten these, never widen them.
+     */
+    maxDays?: number;
+    maxUses?: number;
 }
 /** Fully-resolved approval options (every field present) attached to a `require_approval` result. */
 export interface ResolvedActionPolicyApproval {
     scope: ActionPolicyApprovalScope;
     remember: ActionPolicyApprovalRemember;
     onTimeout: ActionPolicyApprovalOnTimeout;
+    /** "Always allow" caps (see `ActionPolicyApproval`); undefined = built-in default. */
+    maxDays?: number;
+    maxUses?: number;
 }
+export declare const ACTION_POLICY_GRANT_MAX_DAYS = 30;
+export declare const ACTION_POLICY_GRANT_MAX_USES = 10000;
 export interface ActionPolicyRule {
     /** Explicit, narrowly scoped permission to relax named role actions only. */
     roleException?: {

package/dist/actionPolicyEngine.js

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/actionPolicyEngine.ts
 var actionPolicyEngine_exports = {};
 __export(actionPolicyEngine_exports, {
+  ACTION_POLICY_GRANT_MAX_DAYS: () => ACTION_POLICY_GRANT_MAX_DAYS,
+  ACTION_POLICY_GRANT_MAX_USES: () => ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS: () => CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL: () => DEFAULT_ACTION_POLICY_APPROVAL,
   MACHINE_KINDS: () => MACHINE_KINDS,
@@ -6237,6 +6239,18 @@ function provenPowerShellQueryUrls(command) {
     return [];
   }
 }
+var ACTION_POLICY_GRANT_MAX_DAYS = 30;
+var ACTION_POLICY_GRANT_MAX_USES = 1e4;
+function approvalCap(value, limit) {
+  const n = typeof value === "number" ? value : typeof value === "string" && value.trim() ? Number(value) : NaN;
+  if (!Number.isFinite(n) || n < 1) return void 0;
+  return Math.min(limit, Math.floor(n));
+}
+function minCap(a, b) {
+  if (a === void 0) return b;
+  if (b === void 0) return a;
+  return Math.min(a, b);
+}
 function approvalExceptionError(rule) {
   const roleError = roleExceptionError(rule);
   if (roleError) return roleError;
@@ -6314,17 +6328,25 @@ function resolveApprovalOptions(approval) {
   const scope = approval?.scope;
   const remember = approval?.remember;
   const onTimeout = approval?.onTimeout;
+  const maxDays = approvalCap(approval?.maxDays, ACTION_POLICY_GRANT_MAX_DAYS);
+  const maxUses = approvalCap(approval?.maxUses, ACTION_POLICY_GRANT_MAX_USES);
   return {
     scope: scope === "developer" || scope === "org" ? scope : DEFAULT_ACTION_POLICY_APPROVAL.scope,
     remember: remember === "session" || remember === "1h" || remember === "none" ? remember : DEFAULT_ACTION_POLICY_APPROVAL.remember,
-    onTimeout: onTimeout === "org" || onTimeout === "block" ? onTimeout : DEFAULT_ACTION_POLICY_APPROVAL.onTimeout
+    onTimeout: onTimeout === "org" || onTimeout === "block" ? onTimeout : DEFAULT_ACTION_POLICY_APPROVAL.onTimeout,
+    ...maxDays !== void 0 ? { maxDays } : {},
+    ...maxUses !== void 0 ? { maxUses } : {}
   };
 }
 function mergeApprovalOptions(a, b) {
+  const maxDays = minCap(a.maxDays, b.maxDays);
+  const maxUses = minCap(a.maxUses, b.maxUses);
   return {
     scope: APPROVAL_SCOPE_RANK[b.scope] > APPROVAL_SCOPE_RANK[a.scope] ? b.scope : a.scope,
     remember: APPROVAL_REMEMBER_RANK[b.remember] > APPROVAL_REMEMBER_RANK[a.remember] ? b.remember : a.remember,
-    onTimeout: APPROVAL_ON_TIMEOUT_RANK[b.onTimeout] > APPROVAL_ON_TIMEOUT_RANK[a.onTimeout] ? b.onTimeout : a.onTimeout
+    onTimeout: APPROVAL_ON_TIMEOUT_RANK[b.onTimeout] > APPROVAL_ON_TIMEOUT_RANK[a.onTimeout] ? b.onTimeout : a.onTimeout,
+    ...maxDays !== void 0 ? { maxDays } : {},
+    ...maxUses !== void 0 ? { maxUses } : {}
   };
 }
 function effectiveApprovalScope(approval, presence) {
@@ -6790,14 +6812,24 @@ var COMMAND_LINE_FIELDS = /* @__PURE__ */ new Set(["command", "cmd", "commandLin
 var CODE_EXEC_TOOL_NAME_RE = /\b(node ?repl|repl|shell|exec|execute|terminal|command|cmd|run ?code|bash|zsh|sh|powershell|pwsh)\b/i;
 function shellVerbWords(command) {
   let lead = "";
+  let first = true;
+  let scriptArgs = false;
   return shellCommandWords(command).split(/\s+/).filter(Boolean).map((token) => {
     if (token === ";") {
       lead = "";
+      first = true;
+      scriptArgs = false;
       return token;
     }
+    if (scriptArgs) return "";
     const flag = /^(-{1,2})([A-Za-z][A-Za-z0-9_-]*)(?:=.*)?$/.exec(token);
     const word = flag ? flag[2] : /^\.?[A-Za-z][A-Za-z0-9_-]*$/.test(token) ? token : "";
-    if (!word) return "";
+    const leading = first && !flag;
+    if (leading) first = false;
+    if (!word) {
+      if (leading ? isScriptPath(token, true) : !flag && SCRIPT_RUNNER_LEADS.has(lead) && isScriptPath(token, false)) scriptArgs = true;
+      return "";
+    }
     if (!flag && !lead) lead = word.toLowerCase();
     if (flag) {
       if (VCS_PROGRAMS.has(lead)) return "";
@@ -6812,6 +6844,50 @@ function shellVerbWords(command) {
   }).filter(Boolean).join(" ");
 }
 var VCS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "hg", "svn", "glab"]);
+var SCRIPT_RUNNER_LEADS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "dash",
+  "ksh",
+  "fish",
+  "cmd",
+  "powershell",
+  "pwsh",
+  "sudo",
+  "doas",
+  "env",
+  "nohup",
+  "time",
+  "timeout",
+  "watch",
+  "ssh",
+  "xargs",
+  "node",
+  "nodejs",
+  "deno",
+  "bun",
+  "python",
+  "python3",
+  "python2",
+  "py",
+  "perl",
+  "ruby",
+  "php",
+  "lua",
+  "rscript",
+  "julia",
+  "tsx",
+  "ts-node",
+  "npx"
+]);
+var SCRIPT_EXTENSION_RE = /\.(?:ps1|psm1|sh|bash|zsh|ksh|fish|py|pyw|js|mjs|cjs|ts|mts|cts|rb|pl|php|lua|r|jl|cmd|bat)$/i;
+function isScriptPath(token, leading) {
+  const t = token.replace(/^["']|["']$/g, "");
+  if (!t || /^[$%<>|&]/.test(t)) return false;
+  if (SCRIPT_EXTENSION_RE.test(t)) return true;
+  return leading ? /^\.{1,2}[\\/]/.test(t) : /[\\/]/.test(t);
+}
 var DOT_COMMAND_PROGRAMS = /* @__PURE__ */ new Set(["sqlite3", "sqlite", "litecli", "duckdb"]);
 function stringifyArgs(args) {
   try {
@@ -6866,13 +6942,14 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
 }
 var SECRET_NAME = String.raw`(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key|secret|password|passwd|pwd|credentials?|private[_-]?key|token)`;
 var SECRET_ASSIGNMENT_RE = new RegExp(String.raw`(?:^|[^\w])[\w.-]*?${SECRET_NAME}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{8,})`, "gi");
-var SECRET_FLAG_RE = /--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>]{8,})/gi;
-var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an|some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
+var SECRET_FLAG_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>-][^\s\\"',;&|)}\]<>]{7,})/gi;
+var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an)(?:[-_.][\w.-]*)?|(?:some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
 var SECRET_CODE_EXPR_RE = /^(?:[A-Za-z_$][\w$]*(?:[.\[][^\s=]*)+|[A-Za-z_$][\w$]*\(.*\)?|process\.env\.\w+|os\.environ.*|env(?:iron)?\.\w+|new\s+\w+.*|await\s+.*|require\(.*)$/;
 function looksLikeSecretValue(raw) {
   const value = raw.replace(/[\\"'`]+$/, "");
   if (value.length < 8) return false;
   if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value)) return false;
+  if (/^--?[A-Za-z]/.test(value)) return false;
   if (SECRET_PLACEHOLDER_RE.test(value)) return false;
   if (SECRET_CODE_EXPR_RE.test(value)) return false;
   if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value)) return false;
@@ -7076,8 +7153,8 @@ function extractUrl(args, _argsText) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
-    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).join("\n") : raw;
-    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>]+/i)?.[0];
+    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).map(withoutGhMetadataProse).join("\n") : raw;
+    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
       try {
@@ -7086,15 +7163,225 @@ function extractUrl(args, _argsText) {
         return false;
       }
     });
-    const found = externalOutbound || outboundUrls[0] || firstUrl(value);
+    const found = externalOutbound || outboundUrls[0] || firstUrl(shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)).join("\n") : value);
     if (found) return found;
   }
   return "";
 }
+var LOCAL_DATA_LEADS = /* @__PURE__ */ new Set([
+  // PowerShell text / file / pipeline cmdlets and their aliases
+  "get-content",
+  "gc",
+  "type",
+  "set-content",
+  "sc",
+  "add-content",
+  "ac",
+  "out-file",
+  "out-string",
+  "out-null",
+  "write-host",
+  "write-output",
+  "write-verbose",
+  "write-warning",
+  "write-error",
+  "write-information",
+  "write-debug",
+  "select-string",
+  "sls",
+  "select-object",
+  "select",
+  "where-object",
+  "where",
+  "foreach-object",
+  "foreach",
+  "%",
+  "?",
+  "sort-object",
+  "sort",
+  "group-object",
+  "group",
+  "measure-object",
+  "measure",
+  "compare-object",
+  "compare",
+  "format-table",
+  "ft",
+  "format-list",
+  "fl",
+  "format-wide",
+  "fw",
+  "convertto-json",
+  "convertfrom-json",
+  "convertto-csv",
+  "convertfrom-csv",
+  "test-path",
+  "get-item",
+  "gi",
+  "get-childitem",
+  "gci",
+  "ls",
+  "dir",
+  "split-path",
+  "join-path",
+  "resolve-path",
+  "new-item",
+  "ni",
+  "copy-item",
+  "cpi",
+  "copy",
+  "move-item",
+  "mi",
+  "move",
+  "rename-item",
+  "rni",
+  "ren",
+  "remove-item",
+  "ri",
+  "del",
+  "erase",
+  "rd",
+  "rmdir",
+  "get-date",
+  "set-location",
+  "cd",
+  "chdir",
+  "push-location",
+  "pushd",
+  "pop-location",
+  "popd",
+  "get-location",
+  "pwd",
+  // POSIX text / file tools
+  "echo",
+  "printf",
+  "cat",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "cut",
+  "uniq",
+  "head",
+  "tail",
+  "tr",
+  "wc",
+  "test",
+  "mkdir",
+  "touch",
+  "cp",
+  "mv",
+  "rm",
+  "ln",
+  "basename",
+  "dirname",
+  "realpath",
+  "jq",
+  "yq",
+  "diff",
+  "date",
+  "true",
+  "false"
+]);
+var GIT_NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "clone",
+  "fetch",
+  "pull",
+  "push",
+  "remote",
+  "ls-remote",
+  "submodule",
+  "archive",
+  "request-pull",
+  "svn",
+  "daemon",
+  "bundle",
+  "http-fetch",
+  "http-push",
+  "send-pack",
+  "fetch-pack",
+  "upload-pack",
+  "receive-pack",
+  "lfs"
+]);
+function segmentMayReachNetwork(segment) {
+  if (/\$\(|`/.test(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
+  return splitShellSegments(segment, true).some((stage) => {
+    if (/^\s*(?:\$[\w:]+|[A-Za-z_]\w*)\s*=/.test(stage)) return true;
+    const masked = maskQuotedSpans(stage);
+    for (const group of masked.matchAll(/\(\s*([A-Za-z][\w-]*)/g)) {
+      if (!LOCAL_DATA_LEADS.has(group[1].toLowerCase())) return true;
+    }
+    const lead = shellSegmentLead(stage);
+    if (!lead) return false;
+    if (lead === "git") {
+      const subcommand = gitSubcommand(stage);
+      return !subcommand || GIT_NETWORK_SUBCOMMANDS.has(subcommand);
+    }
+    return !LOCAL_DATA_LEADS.has(lead);
+  });
+}
+var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|-?\d+(?:\.\d+)?|@\((?:[\s,]|'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|-?\d+(?:\.\d+)?)*\))\s*$/;
+function segmentsThatMayReachNetwork(segments) {
+  const tempRedefined = segments.some((segment) => /\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(segment)));
+  const remotePath = /(?:^|[\s"'=(])[\\/]{2}[^\s\\/"']+[\\/]/;
+  return segments.filter((segment, index) => {
+    if (!LITERAL_ASSIGNMENT_RE.test(segment)) return segmentMayReachNetwork(segment);
+    return segments.slice(index + 1).some((later) => !LITERAL_ASSIGNMENT_RE.test(later) && (remotePath.test(later) || ghMetadataWriteBodyFile(tempRedefined ? later : temporaryFileSyntax(later)) === void 0 && segmentMayReachNetwork(later)));
+  });
+}
+function gitSubcommand(stage) {
+  const tokens = maskQuotedSpans(stage).trim().split(/\s+/);
+  let i2 = tokens.findIndex((token) => /^(?:.*[\\/])?git(?:\.exe)?$/i.test(token)) + 1;
+  if (i2 <= 0) return "";
+  while (i2 < tokens.length && tokens[i2].startsWith("-")) {
+    if (/^(?:-c|-C|--git-dir|--work-tree|--namespace|--exec-path|--config-env|--super-prefix|--list-cmds)$/i.test(tokens[i2])) i2++;
+    i2++;
+  }
+  const subcommand = (tokens[i2] || "").toLowerCase();
+  return /^[a-z][\w-]*$/.test(subcommand) ? subcommand : "";
+}
+function temporaryFileSyntax(text) {
+  return text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/(?<=^|\s)\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_./\\-]+)(?=\s|$)/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
+}
+var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
+function ghMetadataWriteBodyFile(segment) {
+  return parseGhMetadataWrite(segment)?.bodyFile;
+}
+function parseGhMetadataWrite(segment) {
+  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)(.+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
+  if (!ghBody) return void 0;
+  const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
+  if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
+  let bodyFile;
+  let bodySeen = false;
+  const kept = [];
+  for (let i2 = 0; i2 < tokens.length; i2 += 2) {
+    const flag = tokens[i2];
+    const value = tokens[i2 + 1];
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (/^--body-file$/i.test(flag)) {
+      if (bodySeen) return void 0;
+      bodySeen = true;
+      bodyFile = value;
+    }
+    if (/^--body$/i.test(flag)) {
+      if (bodySeen) return void 0;
+      bodySeen = true;
+    }
+    const prose = /^--(?:body|title)$/i.test(flag);
+    kept.push(flag, prose ? '"fcd-gh-metadata"' : value);
+  }
+  return { bodyFile, masked: `${ghBody[1]}${kept.join(" ")}${ghBody[3]}` };
+}
+function withoutGhMetadataProse(segment) {
+  return parseGhMetadataWrite(segment)?.masked ?? segment;
+}
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
   if (/\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(command))) return command;
-  const fileSyntax = (text) => text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
+  const fileSyntax = temporaryFileSyntax;
   const originalSegments = splitShellSegments(command);
   const localPaths = /* @__PURE__ */ new Map();
   const literalValues = /* @__PURE__ */ new Map();
@@ -7111,7 +7398,7 @@ function shellUrlActionText(command) {
     return value;
   };
   const segments = originalSegments.map((segment, index) => {
-    const dataAssignment = /^\$([A-Za-z_][\w]*)\s*=\s*(@'\r?\n[\s\S]*?\r?\n'@|'(?:[^']|'')*')$/.exec(segment);
+    const dataAssignment = /^\$([A-Za-z_][\w]*)\s*=\s*(@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*')$/.exec(segment);
     if (dataAssignment && !literalValues.has(dataAssignment[1].toLowerCase()) && literalValues.size < 32) {
       literalValues.set(dataAssignment[1].toLowerCase(), dataAssignment[2]);
       dataAssignments.add(index);
@@ -7125,7 +7412,7 @@ function shellUrlActionText(command) {
       pathAssignments.add(index);
       return segment;
     }
-    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/.exec(segment);
+    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/.exec(segment);
     const prefix = literal2?.[0] || "";
     const tail = segment.slice(prefix.length).replace(
       /"\$([A-Za-z_][\w]*)([\\/][\w ./\\-]*)?"/g,
@@ -7147,8 +7434,9 @@ function shellUrlActionText(command) {
     );
   });
   if (expansionOverflow) return command;
-  const filtered = segments.map((segment) => {
-    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/;
+  const storedTargets = /* @__PURE__ */ new Map();
+  const filtered = segments.map((segment, index) => {
+    const literal2 = /^(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$]*?\r?\n"@|'(?:[^']|'')*'|"[^"$`]*")/;
     const piped = segment.match(literal2);
     let tail = piped ? segment.slice(piped[0].length).replace(/^\s*\|\s*/, "") : "";
     if (!piped || !/^\s*\|/.test(segment.slice(piped[0].length))) {
@@ -7176,8 +7464,15 @@ function shellUrlActionText(command) {
     }
     target = target.replace(/^['"]|['"]$/g, "");
     if (!target || /^[\\/]{2}|[\r\n*?\[\]<>]/.test(target) || /:/.test(target.replace(/^[A-Za-z]:[\\/]/, ""))) return segment;
+    const key = target.toLowerCase();
+    if (!storedTargets.has(key)) storedTargets.set(key, index);
     return tail;
   });
+  const isStoredTarget = (token, before) => {
+    if (!token) return false;
+    const written = storedTargets.get(token.replace(/^['"]|['"]$/g, "").toLowerCase());
+    return written !== void 0 && written < before;
+  };
   const onlyStoredData = segments.every((segment, index) => {
     if (dataAssignments.has(index)) return true;
     if (pathAssignments.has(index)) return true;
@@ -7187,6 +7482,10 @@ function shellUrlActionText(command) {
     if (/^if\s*\(\$([A-Za-z_][\w]*)\.Count\)\s*\{\s*throw\s+\$\1\[0\]\s*\}$/i.test(segment)) return true;
     if (/^Write-Output\s+'(?:[^']|'')*'$/i.test(segment)) return true;
     if (/^gh\s+pr\s+checks\s+\d+\s+--json\s+[a-z,]+\s+--jq\s+'(?:[^']|'')*'$/i.test(segment)) return true;
+    const ghBodyFile = ghMetadataWriteBodyFile(segment);
+    if (ghBodyFile !== void 0) return isStoredTarget(ghBodyFile, index);
+    const removal = /^Remove-Item\s+(?:-(?:LiteralPath|Path)\s+)?('[^'\r\n]*'|"[^"\r\n]*"|[^\s'"$`|;&(){}<>]+)(?:\s+-Force)?$/i.exec(segment);
+    if (removal && isStoredTarget(removal[1], index)) return true;
     const read = /^Get-Content\s+(?:(?:-LiteralPath|-Path)\s+)?(?:'([^'$`\r\n]*)'|"([^"$`\r\n]*)"|([^\s'"$`|;&(){}<>]+))(?:\s+-(?:Tail|TotalCount)\s+\d{1,6})?(?:\s+-Raw)?\s*$/i.exec(segment);
     if (read) {
       const target = read[1] ?? read[2] ?? read[3];
@@ -7223,6 +7522,22 @@ function splitShellSegments(command, alsoOnPipe = false) {
         continue;
       }
     }
+    if (ch === "@" && command[i2 + 1] === "{") {
+      const end = hashtableEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
+    if (ch === "@" && command[i2 + 1] === "(") {
+      const end = literalArrayEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
     if (ch === '"' || ch === "'") {
       quote = ch;
       cur += ch;
@@ -7263,6 +7578,47 @@ ${q}@`;
   if (idx < 0) return -1;
   return idx + close.length;
 }
+function hashtableEnd(command, start) {
+  let depth = 0;
+  let quote = null;
+  for (let i2 = start + 1; i2 < command.length; i2++) {
+    const ch = command[i2];
+    if (quote) {
+      if (ch === "\\" && quote === '"' && i2 + 1 < command.length) {
+        i2++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}" && --depth === 0) return i2 + 1;
+  }
+  return -1;
+}
+var LITERAL_ELEMENT_RE = /^(?:'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|-?\d+(?:\.\d+)?)/;
+function literalArrayEnd(command, start) {
+  let i2 = start + 2;
+  let elements = 0;
+  while (i2 < command.length) {
+    const rest = command.slice(i2);
+    const skip = /^[\s,]+/.exec(rest);
+    if (skip) {
+      i2 += skip[0].length;
+      continue;
+    }
+    if (command[i2] === ")") return elements > 0 ? i2 + 1 : -1;
+    const element = LITERAL_ELEMENT_RE.exec(rest);
+    if (!element || elements >= 256) return -1;
+    i2 += element[0].length;
+    elements++;
+  }
+  return -1;
+}
 var QUOTED_LITERAL_RE = /@'[\s\S]*?\r?\n'@|@"[\s\S]*?\r?\n"@|"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
 function quotedSpans(segment) {
   const spans = [];
@@ -7445,6 +7801,16 @@ function shellSegmentLead(segment) {
 }
 var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
 var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
+function isInertValueExpression(raw) {
+  const masked = maskQuotedSpans(raw);
+  if (/\$\(|`|&\s*[$(\w"']|[|<>]/.test(masked) || PS_VALUE_EXECUTOR_RE.test(masked)) return false;
+  if (/(?:::|\.)\s*(?:invoke|start|run|exec|create|load|download|upload|send|open)\w*\s*\(/i.test(masked)) return false;
+  for (const group of masked.matchAll(/\(\s*([A-Za-z][\w-]*)/g)) if (!LOCAL_DATA_LEADS.has(group[1].toLowerCase())) return false;
+  const body = masked.replace(/^\s*\$[\w]+\s*(?:\+|-|\*|\/)?=\s*/, "").trim();
+  if (/^\$\w+\s*(?:\+\+|--)$/.test(body)) return true;
+  if (/^(?:@\{|@\()/.test(body)) return !/[$(]/.test(body.slice(2)) && /^@[{(](?:[\s;,=]|""|-?\d+(?:\.\d+)?|[\w-]+|@\{|\}|\))*$/.test(body);
+  return /^(?:""|-?\d)/.test(body);
+}
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
 function classifyShellSegment(segment, depth = 0) {
   const raw = segment.trim();
@@ -7453,6 +7819,7 @@ function classifyShellSegment(segment, depth = 0) {
   const lead = shellSegmentLead(segment);
   if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
   if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
+  if (isInertValueExpression(raw)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
   if (sqlClient) {
@@ -7484,6 +7851,8 @@ function classifyShellWords(masked, raw, lead) {
     const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
     const hasBody = /\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file|--json|-body|-infile)\b/i.test(segment);
     if (explicitMethod || hasBody) return "write";
+    const credentialArgument = /\s(?:-h|--header|-headers|-u|--user|-token|-credential|-authentication|--oauth2-bearer|-proxycredential)(?:[\s=]|$)/i.exec(segment);
+    if (credentialArgument && /\$\(|`|\$env:|\(\s*[A-Za-z][\w-]*\s/.test(segment.slice(credentialArgument.index))) return "write";
     return pipesIntoInterpreter ? "SHELL" : "read";
   }
   if (SHELL_READ_PROGRAMS.has(lead)) {
@@ -7508,8 +7877,8 @@ function classifyShellWords(masked, raw, lead) {
   if (/\b(drop\s+(database|table|schema)|truncate\s+table|kubectl\s+delete|terraform\s+destroy|gcloud\s+(?:sql\s+instances|compute\s+instances|projects|run\s+services)\s+delete|az\s+(?:group|vm|sql\s+server)\s+delete|aws\s+(?:s3\s+rb|rds\s+delete-db-instance|ec2\s+terminate-instances)|docker\s+(?:system\s+prune|volume\s+rm|rm\s+-f)|mkfs|dd\s+if=)\b/.test(value)) {
     return "DELETE";
   }
-  const xfer = segment.toLowerCase().match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
-  if (xfer && /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/.test(value)) {
+  const xfer = segment.toLowerCase().match(/\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\s+(.+)$/);
+  if (xfer && /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/.test(value)) {
     if (/az\s+storage\s+blob\s+upload/.test(value)) return "write";
     const tokens = xfer[1].split(/\s+/).filter(Boolean).map((t) => t.replace(/^["']|["']$/g, ""));
     const operands = [];
@@ -7640,7 +8009,7 @@ function isPowerShellResponseProjection(segment, responses) {
   const object = /^\[pscustomobject\]\s*@\{([^{}]+)\}\s*(?:\|\s*(.+))?$/i.exec(segment);
   if (!object) return false;
   if (object[2] && object[2].split("|").some((part) => !isPowerShellReadFormatter(part.trim()))) return false;
-  const fields = object[1].trim().replace(/;\s*$/, "").split(";");
+  const fields = object[1].trim().replace(/[;\s]*$/, "").split(/;|\r?\n/).filter((field) => field.trim());
   if (fields.length > 32) return false;
   const labels = /* @__PURE__ */ new Set();
   return fields.every((field) => {
@@ -7707,6 +8076,10 @@ function isInternalHost(hostname) {
   const private172 = host.match(/^172\.(\d+)\./);
   return Boolean(private172 && Number(private172[1]) >= 16 && Number(private172[1]) <= 31);
 }
+function isSingleLabelWebHost(parsed) {
+  const host = parsed.hostname.toLowerCase();
+  return /^(?:https?|wss?):$/.test(parsed.protocol) && host.length > 0 && !host.includes(".") && !host.includes(":");
+}
 function policyTargetsCall(policy, context) {
   if (!policyTargetsMachineKind(policy.appliesTo, normalizeMachineKind(context.machineKind))) return false;
   const developerTargets = policy.appliesTo?.developerNames?.filter(Boolean) || [];
@@ -7962,7 +8335,7 @@ function inferBundledToolContext(toolName, args) {
     context.url = detectedUrl;
     try {
       const parsed = new URL(detectedUrl);
-      const hostType = isInternalHost(parsed.hostname) ? "internal" : "external";
+      const hostType = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
       const inbound = operation === "read" || ["GET", "HEAD", "OPTIONS", "SELECT", "SHOW", "DESCRIBE", "EXPLAIN"].includes(operation) || isCodeExecTool && !hasSecretLikeValue(argsText) && provenCompoundDownload(commandText, detectedUrl) || provenReadUrls.includes(detectedUrl) || operation === toolName && /\b(fetch|get|read|search|list|lookup|browse|navigate|download|clone|pull|view|open|crawl|scrape)\b/.test(nameWords) && !/\b(post|put|send|upload|push|write|submit|publish|export|create|update|delete|patch)\b/.test(nameWords);
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
@@ -8065,7 +8438,7 @@ function recordHttpRequestFacts(context, args, detectedUrl) {
     if (!["http:", "https:"].includes(parsed.protocol)) return false;
     const containsSecret = hasSecretLikeValue(stringifyArgs({ url: detectedUrl, headers: args.headers, body: args.body, data: args.data }));
     context["request.destination.domain"] = parsed.hostname;
-    context["request.destination.type"] = isInternalHost(parsed.hostname) ? "internal" : "external";
+    context["request.destination.type"] = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
     context["request.containsSecret"] = containsSecret ? "true" : "false";
     return containsSecret;
   } catch {
@@ -8096,6 +8469,8 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACTION_POLICY_GRANT_MAX_DAYS,
+  ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL,
   MACHINE_KINDS,

package/dist/approvalPrompt.d.ts

@@ -3,5 +3,9 @@ export interface ApprovalMessageOptions {
     allowAlways?: boolean;
     /** Human wording of the grant scope, e.g. "`gh` commands (write) to github.com". */
     alwaysScopeLabel?: string;
+    /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
+    alwaysLimitsLabel?: string;
 }
+/** Window title: the kind of action and the policy that stopped it, by name. */
+export declare function nativeApprovalTitle(reason: string): string;
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;