fullcourtdefense-cli 1.34.26 → 1.35.1

package/dist/actionPolicyEngine.js

@@ -6814,11 +6814,13 @@ function shellVerbWords(command) {
   let lead = "";
   let first = true;
   let scriptArgs = false;
+  let previousBare = "";
   return shellCommandWords(command).split(/\s+/).filter(Boolean).map((token) => {
     if (token === ";") {
       lead = "";
       first = true;
       scriptArgs = false;
+      previousBare = "";
       return token;
     }
     if (scriptArgs) return "";
@@ -6838,12 +6840,19 @@ function shellVerbWords(command) {
     }
     const dot = word.startsWith(".") ? "." : "";
     if (dot && !DOT_COMMAND_PROGRAMS.has(lead)) return "";
+    if (lead === "gh" && GH_CONFIG_RESOURCES.has(previousBare) && /^(?:delete|remove)$/i.test(word)) {
+      const glued = `${previousBare}${word.toLowerCase()}`;
+      previousBare = "";
+      return glued;
+    }
+    if (!flag) previousBare = word.toLowerCase();
     const [head, ...rest] = word.replace(/^\./, "").split(/[-_]+/).filter(Boolean);
     if (!head) return "";
     return `${flag ? flag[1] : dot}${head}${rest.length ? ` ${rest.join("")}` : ""}`;
   }).filter(Boolean).join(" ");
 }
 var VCS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "hg", "svn", "glab"]);
+var GH_CONFIG_RESOURCES = /* @__PURE__ */ new Set(["secret", "variable", "cache", "alias", "label", "ssh-key", "gpg-key"]);
 var SCRIPT_RUNNER_LEADS = /* @__PURE__ */ new Set([
   "bash",
   "sh",
@@ -7153,7 +7162,7 @@ function extractUrl(args, _argsText) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
-    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).join("\n") : raw;
+    const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).map(withoutGhMetadataProse).join("\n") : raw;
     const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
@@ -7322,7 +7331,7 @@ function segmentMayReachNetwork(segment) {
     return !LOCAL_DATA_LEADS.has(lead);
   });
 }
-var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*')\s*$/;
+var LITERAL_ASSIGNMENT_RE = /^\s*(?:\$|(?=[A-Za-z_]))([A-Za-z_]\w*)\s*=\s*(?:@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|'(?:[^']|'')*'|-?\d+(?:\.\d+)?|@\((?:[\s,]|'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|-?\d+(?:\.\d+)?)*\))\s*$/;
 function segmentsThatMayReachNetwork(segments) {
   const tempRedefined = segments.some((segment) => /\$env:(?:TEMP|TMP)\s*=/i.test(maskQuotedSpans(segment)));
   const remotePath = /(?:^|[\s"'=(])[\\/]{2}[^\s\\/"']+[\\/]/;
@@ -7346,22 +7355,46 @@ function temporaryFileSyntax(text) {
   return text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/(?<=^|\s)\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_./\\-]+)(?=\s|$)/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
 }
 var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
+var GH_PROSE_VALUE_RE = /^(?:'[^'$`]*'|"[^"$`]*"|[^\s'"$`|;&(){}<>]+)$/;
 function ghMetadataWriteBodyFile(segment) {
-  const ghBody = /^gh\s+(pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+(.+?)(?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?$/i.exec(segment);
+  return parseGhMetadataWrite(segment)?.bodyFile;
+}
+function parseGhMetadataWrite(segment) {
+  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)([\s\S]+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
   if (!ghBody) return void 0;
-  const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
+  const tokens = ghBody[2].match(/'[^']*'|"[^"]*"|[^\s'"]+/g) || [];
   if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
   let bodyFile;
+  let bodySeen = false;
+  const kept = [];
   for (let i2 = 0; i2 < tokens.length; i2 += 2) {
     const flag = tokens[i2];
     const value = tokens[i2 + 1];
-    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value) return void 0;
+    const literal2 = (/^--(?:body|title)$/i.test(flag) ? GH_PROSE_VALUE_RE : GH_FLAG_VALUE_RE).test(value);
+    const selectorVariable = !/^--(?:body|title|body-file)$/i.test(flag) && /^\$[A-Za-z_]\w*$/.test(value);
+    if (!literal2 && !selectorVariable) return void 0;
     if (/^--body-file$/i.test(flag)) {
-      if (bodyFile !== void 0) return void 0;
+      if (bodySeen) return void 0;
+      bodySeen = true;
       bodyFile = value;
     }
+    if (/^--body$/i.test(flag)) {
+      if (bodySeen) return void 0;
+      bodySeen = true;
+    }
+    const prose = /^--(?:body|title)$/i.test(flag);
+    kept.push(flag, prose ? '"fcd-gh-metadata"' : value);
   }
-  return bodyFile;
+  return { bodyFile, masked: `${ghBody[1]}${kept.join(" ")}${ghBody[3]}` };
+}
+function withoutGhMetadataProse(segment) {
+  const assigned = /^(\s*\$[A-Za-z_]\w*\s*=\s*)([\s\S]+)$/.exec(segment);
+  if (assigned) {
+    const masked = parseGhMetadataWrite(assigned[2])?.masked;
+    return masked === void 0 ? segment : `${assigned[1]}${masked}`;
+  }
+  return parseGhMetadataWrite(segment)?.masked ?? segment;
 }
 function shellUrlActionText(command) {
   if (command.length > 65536) return command;
@@ -7507,6 +7540,22 @@ function splitShellSegments(command, alsoOnPipe = false) {
         continue;
       }
     }
+    if (ch === "@" && command[i2 + 1] === "{") {
+      const end = hashtableEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
+    if (ch === "@" && command[i2 + 1] === "(") {
+      const end = literalArrayEnd(command, i2);
+      if (end > i2) {
+        cur += command.slice(i2, end);
+        i2 = end - 1;
+        continue;
+      }
+    }
     if (ch === '"' || ch === "'") {
       quote = ch;
       cur += ch;
@@ -7547,6 +7596,47 @@ ${q}@`;
   if (idx < 0) return -1;
   return idx + close.length;
 }
+function hashtableEnd(command, start) {
+  let depth = 0;
+  let quote = null;
+  for (let i2 = start + 1; i2 < command.length; i2++) {
+    const ch = command[i2];
+    if (quote) {
+      if (ch === "\\" && quote === '"' && i2 + 1 < command.length) {
+        i2++;
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}" && --depth === 0) return i2 + 1;
+  }
+  return -1;
+}
+var LITERAL_ELEMENT_RE = /^(?:'(?:[^']|'')*'|"[^"$`]*"|@'\r?\n[\s\S]*?\r?\n'@|@"\r?\n[^$`]*?\r?\n"@|-?\d+(?:\.\d+)?)/;
+function literalArrayEnd(command, start) {
+  let i2 = start + 2;
+  let elements = 0;
+  while (i2 < command.length) {
+    const rest = command.slice(i2);
+    const skip = /^[\s,]+/.exec(rest);
+    if (skip) {
+      i2 += skip[0].length;
+      continue;
+    }
+    if (command[i2] === ")") return elements > 0 ? i2 + 1 : -1;
+    const element = LITERAL_ELEMENT_RE.exec(rest);
+    if (!element || elements >= 256) return -1;
+    i2 += element[0].length;
+    elements++;
+  }
+  return -1;
+}
 var QUOTED_LITERAL_RE = /@'[\s\S]*?\r?\n'@|@"[\s\S]*?\r?\n"@|"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
 function quotedSpans(segment) {
   const spans = [];
@@ -7729,6 +7819,16 @@ function shellSegmentLead(segment) {
 }
 var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
 var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
+function isInertValueExpression(raw) {
+  const masked = maskQuotedSpans(raw);
+  if (/\$\(|`|&\s*[$(\w"']|[|<>]/.test(masked) || PS_VALUE_EXECUTOR_RE.test(masked)) return false;
+  if (/(?:::|\.)\s*(?:invoke|start|run|exec|create|load|download|upload|send|open)\w*\s*\(/i.test(masked)) return false;
+  for (const group of masked.matchAll(/\(\s*([A-Za-z][\w-]*)/g)) if (!LOCAL_DATA_LEADS.has(group[1].toLowerCase())) return false;
+  const body = masked.replace(/^\s*\$[\w]+\s*(?:\+|-|\*|\/)?=\s*/, "").trim();
+  if (/^\$\w+\s*(?:\+\+|--)$/.test(body)) return true;
+  if (/^(?:@\{|@\()/.test(body)) return !/[$(]/.test(body.slice(2)) && /^@[{(](?:[\s;,=]|""|-?\d+(?:\.\d+)?|[\w-]+|@\{|\}|\))*$/.test(body);
+  return /^(?:""|-?\d)/.test(body);
+}
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
 function classifyShellSegment(segment, depth = 0) {
   const raw = segment.trim();
@@ -7737,6 +7837,7 @@ function classifyShellSegment(segment, depth = 0) {
   const lead = shellSegmentLead(segment);
   if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
   if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
+  if (isInertValueExpression(raw)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
   if (sqlClient) {
@@ -7768,6 +7869,8 @@ function classifyShellWords(masked, raw, lead) {
     const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
     const hasBody = /\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file|--json|-body|-infile)\b/i.test(segment);
     if (explicitMethod || hasBody) return "write";
+    const credentialArgument = /\s(?:-h|--header|-headers|-u|--user|-token|-credential|-authentication|--oauth2-bearer|-proxycredential)(?:[\s=]|$)/i.exec(segment);
+    if (credentialArgument && /\$\(|`|\$env:|\(\s*[A-Za-z][\w-]*\s/.test(segment.slice(credentialArgument.index))) return "write";
     return pipesIntoInterpreter ? "SHELL" : "read";
   }
   if (SHELL_READ_PROGRAMS.has(lead)) {
@@ -7869,7 +7972,8 @@ function provenCompoundDownload(command, detectedUrl) {
   return segments.every((segment) => {
     const statusRead = /^\(((?:Invoke-WebRequest|iwr)\s+[^\r\n]+)\)\.(?:StatusCode|StatusDescription|RawContentLength)$/i.exec(segment);
     if (statusRead) segment = statusRead[1];
-    if (/[$`{}()<>;&]/.test(segment)) return false;
+    const withoutWriteOut = segment.replace(/(\s(?:-w|--write-out)\s+)(?:"[^"\r\n$`@]*"|'[^'\r\n$`@]*')/g, '$1"fcd-write-out"');
+    if (/[$`{}()<>;&]/.test(withoutWriteOut)) return false;
     const pipeline = splitShellSegments(segment, true);
     if (pipeline.slice(1).some((part) => !isPowerShellReadFormatter(part))) return false;
     const raw = pipeline[0];
@@ -7883,7 +7987,13 @@ function provenCompoundDownload(command, detectedUrl) {
     let urls = 0;
     for (let i2 = 0; i2 < tokens.length; i2++) {
       const token = tokens[i2];
-      if (isCurl && /^(?:--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+      if (isCurl && /^(?:-m|--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+        i2++;
+        continue;
+      }
+      if (isCurl && /^(?:-w|--write-out)$/.test(token)) {
+        const format = tokens[i2 + 1] || "";
+        if (!format || /^@/.test(format) || /[$`]/.test(format)) return false;
         i2++;
         continue;
       }
@@ -7924,7 +8034,7 @@ function isPowerShellResponseProjection(segment, responses) {
   const object = /^\[pscustomobject\]\s*@\{([^{}]+)\}\s*(?:\|\s*(.+))?$/i.exec(segment);
   if (!object) return false;
   if (object[2] && object[2].split("|").some((part) => !isPowerShellReadFormatter(part.trim()))) return false;
-  const fields = object[1].trim().replace(/;\s*$/, "").split(";");
+  const fields = object[1].trim().replace(/[;\s]*$/, "").split(/;|\r?\n/).filter((field) => field.trim());
   if (fields.length > 32) return false;
   const labels = /* @__PURE__ */ new Set();
   return fields.every((field) => {

package/dist/approvalPrompt.d.ts

@@ -5,5 +5,32 @@ export interface ApprovalMessageOptions {
     alwaysScopeLabel?: string;
     /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
     alwaysLimitsLabel?: string;
+    /** Visual variant. Ask is the interactive dialog; approval/block share the card, not extra buttons. */
+    tone?: DialogTone;
 }
+/** Which policy outcome this window is showing. Icons and copy follow this; buttons do not. */
+export type DialogTone = 'ask' | 'approval' | 'block';
+export interface NativeDialogView {
+    tone: DialogTone;
+    badge: string;
+    headline: string;
+    subtitle: string;
+    kind?: string;
+    action?: string;
+    policy?: string;
+    scope?: string;
+    agent?: string;
+    ide?: string;
+    tool?: string;
+    why: string[];
+    next: string[];
+    footer: string;
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+export declare function nativeDialogView(reason: string, options?: ApprovalMessageOptions): NativeDialogView;
+/** Window title: the kind of action and the policy that stopped it, by name. */
+export declare function nativeApprovalTitle(reason: string): string;
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeDialogView = nativeDialogView;
+exports.nativeApprovalTitle = nativeApprovalTitle;
 exports.nativeApprovalMessage = nativeApprovalMessage;
 /** Compact OS prompt. The complete decision remains in the IDE response and audit. */
 function line(value, limit) {
@@ -10,7 +12,19 @@ function line(value, limit) {
     const head = Math.ceil((limit - 3) * 0.6);
     return `${text.slice(0, head)} … ${text.slice(-(limit - head - 3))}`;
 }
-function nativeApprovalMessage(reason, options = {}) {
+const CEILING_NOTE_RE = /\s*This policy is set to Block[.;]\s*(?:Because it is not marked "Hard block", your workstation requires your approval before continuing\.|on a developer workstation it asks you instead\.)?\s*(?:An admin can (?:review the matching rule and its scope in the console|mark it "Hard block" in the console to stop this without asking)\.)?/;
+const CEILING_NOTE_SHORT = 'set to Block; on your workstation it asks you first.';
+/** Parse the `Rule:` line the block explanation writes into the name the console lists and its scope. */
+function ruleParts(rule) {
+    const policy = /^Action Policy "(.+?)" \((.+?)\)(?: — rule: (.+))?$/.exec(rule);
+    if (policy)
+        return { policy: policy[1], scope: [policy[2].replace(/^[^\w]+/, ''), policy[3]].filter(Boolean).join(' · ') };
+    const local = /^(built-in Local Safety rule|org custom rule) "(.+?)"(?: in Local Safety)?(?: \((.+)\))?$/.exec(rule);
+    if (local)
+        return { policy: local[2], localSafety: true, scope: [local[1] === 'org custom rule' ? 'Local Safety — org custom rule' : 'Local Safety — built-in rule', local[3]].filter(Boolean).join(' · ') };
+    return { policy: rule };
+}
+function promptFacts(reason) {
     const rows = reason.split(/\r?\n/).map(row => row.trim()).filter(Boolean);
     const field = (name) => rows.find(row => row.startsWith(`${name}:`))?.slice(name.length + 1).trim();
     const what = field('What');
@@ -20,20 +34,104 @@ function nativeApprovalMessage(reason, options = {}) {
     const why = field('Why');
     const agent = field('Agent')
         || (/^[a-z_ -]+:\s*\S+/i.test(rows[0] || '') && !/^(What|Rule|Why|Tool|Evidence|IDE|Developer):/.test(rows[0]) ? rows[0] : undefined);
-    const details = what || tool || rule || why ? [
-        agent ? `Agent: ${line(agent, 80)}` : '',
-        field('IDE') ? `IDE: ${line(field('IDE'), 40)}` : '',
-        what ? `Action: ${line(what, 230)}` : '',
-        tool ? `Tool: ${line([tool, evidence].filter(Boolean).join(' · '), 230)}` : '',
-        rule ? `Rule: ${line(rule, 200)}` : '',
-        why ? `Reason: ${line(why, 320)}` : '',
-    ].filter(Boolean) : [line(reason, 650)];
+    if (!(what || tool || rule || why))
+        return { fallback: reason };
+    const facts = { agent, ide: field('IDE') };
+    if (rule)
+        Object.assign(facts, ruleParts(rule));
+    if (what) {
+        // summarizeAction ends with the kind in parentheses: "… (shell command)".
+        const kind = /^(.*)\s\(([a-z][a-z /-]{2,30})\)$/i.exec(what);
+        facts.kind = kind?.[2];
+        facts.action = kind ? kind[1] : what;
+    }
+    if (tool)
+        facts.tool = [tool, evidence].filter(Boolean).join(' · ');
+    if (why) {
+        const stripped = why.replace(CEILING_NOTE_RE, ' ').replace(/\s+/g, ' ').trim();
+        if (stripped !== why.trim())
+            facts.note = CEILING_NOTE_SHORT;
+        facts.because = stripped.replace(/([^.])$/, '$1.');
+    }
+    return facts;
+}
+function sentences(text) {
+    return text.split(/(?<=\.)\s+/).map(part => part.trim()).filter(Boolean);
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+function nativeDialogView(reason, options = {}) {
+    const f = promptFacts(reason);
+    const tone = options.tone || 'ask';
+    const why = [
+        ...(f.because ? sentences(line(f.because, 400)) : []),
+        f.note ? line(f.note, 180) : '',
+        f.fallback ? line(f.fallback, 400) : '',
+    ].filter(Boolean);
+    const next = tone === 'block'
+        ? ['This action is stopped.', 'An admin can change the rule in the console.']
+        : tone === 'approval'
+            ? ['An admin or manager can approve it in the console.', 'Closing this window does not approve it.']
+            : [
+                'Allow once lets only this action continue.',
+                'Deny or close keeps it blocked.',
+                options.allowAlways && options.alwaysScopeLabel
+                    ? `Always allow covers ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`
+                    : '',
+            ].filter(Boolean);
+    const footer = f.policy && !f.fallback
+        ? `Full details: the IDE message and this machine’s Activity. Console → Action Policies → ${f.localSafety ? 'Source: Local Safety → ' : ''}"${line(f.policy, 80)}".`
+        : 'Full details are in the IDE message and this machine’s Activity in FullCourtDefense.';
+    return {
+        tone,
+        badge: tone === 'block' ? 'Blocked' : tone === 'approval' ? 'Approval required' : 'Ask the developer',
+        headline: tone === 'block' ? 'Action blocked' : tone === 'approval' ? 'Action requires approval' : 'Action needs your OK',
+        subtitle: tone === 'block'
+            ? 'A security policy stopped this action. It did not run.'
+            : tone === 'approval'
+                ? 'A security policy paused this action for an admin or manager.'
+                : 'A security policy paused this action. Review the details and choose what to do next.',
+        kind: f.kind,
+        action: f.action ? line(f.action, 280) : undefined,
+        policy: f.policy ? line(f.policy, 160) : undefined,
+        scope: f.scope ? line(f.scope, 220) : undefined,
+        agent: f.agent ? line(f.agent, 80) : undefined,
+        ide: f.ide ? line(f.ide, 40) : undefined,
+        tool: f.tool ? line(f.tool, 230) : undefined,
+        why: why.length ? why : ['A policy matched this action.'],
+        next,
+        footer,
+    };
+}
+/** Window title: the kind of action and the policy that stopped it, by name. */
+function nativeApprovalTitle(reason) {
+    const f = promptFacts(reason);
+    const parts = ['FullCourtDefense', f.kind ? `Approval needed: ${f.kind}` : 'Approval needed', f.policy ? line(f.policy, 60) : ''].filter(Boolean);
+    return parts.join(' · ');
+}
+function nativeApprovalMessage(reason, options = {}) {
+    const f = promptFacts(reason);
+    const details = f.fallback ? [line(f.fallback, 650)] : [
+        f.policy ? `Policy:  ${line(f.policy, 160)}` : '',
+        f.scope ? `         ${line(f.scope, 200)}` : '',
+        f.action ? `Action:  ${f.kind ? `${f.kind} — ` : ''}${line(f.action, 230)}` : '',
+        f.agent ? `Agent: ${line(f.agent, 80)}` : '',
+        f.ide ? `IDE: ${line(f.ide, 40)}` : '',
+        f.tool ? `Tool: ${line(f.tool, 230)}` : '',
+        f.because ? `Because: ${line(f.because, 300)}` : '',
+        f.note ? `Note:    ${f.note}` : '',
+    ].filter(Boolean);
+    const where = f.policy && !f.fallback
+        ? `Console → Action Policies → ${f.localSafety ? 'Source: Local Safety → ' : ''}"${line(f.policy, 80)}" · this decision: your machine’s Activity.`
+        : 'Full details: the IDE message or this machine’s Activity in FullCourtDefense.';
     if (!options.allowAlways) {
         return [
             'Allow this action once?',
             '', ...details, '',
-            'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
             'Allow once permits only this action. Deny or closing keeps it stopped.',
+            where,
         ].join('\n');
     }
     return [
@@ -41,6 +139,6 @@ function nativeApprovalMessage(reason, options = {}) {
         '', ...details, '',
         ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`, ''] : []),
         'Allow once permits only this action. Deny or closing keeps it stopped.',
-        'Full details: the IDE message or this machine’s Activity in FullCourtDefense.',
+        where,
     ].join('\n');
 }

package/dist/commands/ephemeralStack.d.ts

@@ -53,8 +53,44 @@ export interface EphemeralStackOptions {
     hooks?: string;
     /** 'false' => skip wrapping MCP client configs with the gateway. */
     gateway?: string;
+    /**
+     * HTTP egress gateway (API destinations). OFF unless asked for: 'true' or a
+     * port number starts `http-gateway` detached on 127.0.0.1 and the identity
+     * env gains HTTP_PROXY / HTTPS_PROXY / NO_PROXY. Absent / 'false' => nothing
+     * changes for the workload's network path.
+     */
+    httpGateway?: string;
+    /** Agent name the HTTP gateway attributes calls to (the workload name). */
+    agentName?: string;
     sendLog?: EphemeralLogSink;
 }
+export declare const DEFAULT_HTTP_GATEWAY_PORT = 18790;
+/** Resolve `--http-gateway <true|false|port>`; undefined = off. */
+export declare function resolveHttpGatewayPort(value: string | undefined): number | undefined;
+/**
+ * Identity-env additions that route the agent's HTTP libraries through the
+ * local gateway. NO_PROXY keeps loopback and the FullCourtDefense control plane
+ * direct (the gateway would bypass them anyway). Both casings: curl/Python read
+ * lower-case, many Java/Go tools upper-case.
+ */
+export declare function httpGatewayIdentityEnv(port: number, apiUrl: string, agentName: string | undefined, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function httpGatewayLogPath(): string;
+export declare function httpGatewayReadyPath(): string;
+/**
+ * Start `http-gateway` outside our process tree (plain node, no shells) and
+ * wait until it reports its port. The workload's entrypoint runs AFTER this
+ * command returns, so the proxy must already be listening when the agent starts.
+ */
+export declare function startDetachedHttpGateway(input: {
+    port: number;
+    agentName?: string;
+    apiUrl: string;
+    waitMs?: number;
+}): Promise<{
+    port: number;
+    pid?: number;
+    log: string;
+}>;
 /**
  * Install the runtime hook + MCP gateway for an enrolled ephemeral identity.
  * Each step is best-effort and reported: a missing MCP client on the image is

package/dist/commands/ephemeralStack.js

@@ -33,16 +33,22 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.silentLogSink = void 0;
+exports.DEFAULT_HTTP_GATEWAY_PORT = exports.silentLogSink = void 0;
 exports.ephemeralIdentityMarkerPath = ephemeralIdentityMarkerPath;
 exports.assertNotEnrolledLaptop = assertNotEnrolledLaptop;
 exports.writeEphemeralIdentityMarker = writeEphemeralIdentityMarker;
+exports.resolveHttpGatewayPort = resolveHttpGatewayPort;
+exports.httpGatewayIdentityEnv = httpGatewayIdentityEnv;
+exports.httpGatewayLogPath = httpGatewayLogPath;
+exports.httpGatewayReadyPath = httpGatewayReadyPath;
+exports.startDetachedHttpGateway = startDetachedHttpGateway;
 exports.installEphemeralProtectionStack = installEphemeralProtectionStack;
 exports.exportIdentityEnv = exportIdentityEnv;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
+const child_process_1 = require("child_process");
 const installClaudeHook_1 = require("./installClaudeHook");
 const mcpGateway_1 = require("./mcpGateway");
 /**
@@ -105,6 +111,102 @@ function writeEphemeralIdentityMarker(noun, machineId, markerPath = ephemeralIde
 /** No-op sink for callers without a live log stream (workloads today). */
 const silentLogSink = async () => { };
 exports.silentLogSink = silentLogSink;
+exports.DEFAULT_HTTP_GATEWAY_PORT = 18790;
+/** Resolve `--http-gateway <true|false|port>`; undefined = off. */
+function resolveHttpGatewayPort(value) {
+    const v = (value || '').trim().toLowerCase();
+    if (!v || v === 'false' || v === '0' || v === 'off' || v === 'no')
+        return undefined;
+    if (v === 'true' || v === 'on' || v === 'yes')
+        return exports.DEFAULT_HTTP_GATEWAY_PORT;
+    const port = Number(v);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error(`--http-gateway expects true, false or a port (1–65535), got "${value}"`);
+    return port;
+}
+/**
+ * Identity-env additions that route the agent's HTTP libraries through the
+ * local gateway. NO_PROXY keeps loopback and the FullCourtDefense control plane
+ * direct (the gateway would bypass them anyway). Both casings: curl/Python read
+ * lower-case, many Java/Go tools upper-case.
+ */
+function httpGatewayIdentityEnv(port, apiUrl, agentName, env = process.env) {
+    const proxy = `http://127.0.0.1:${port}`;
+    let apiHost = '';
+    try {
+        apiHost = new URL(apiUrl).hostname;
+    }
+    catch { /* ignore */ }
+    const noProxy = ['localhost', '127.0.0.1', '::1', apiHost].filter(Boolean).join(',');
+    const out = {
+        FCD_HTTP_GATEWAY: proxy,
+        HTTP_PROXY: proxy,
+        HTTPS_PROXY: proxy,
+        http_proxy: proxy,
+        https_proxy: proxy,
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+    };
+    if (agentName && !(env.FCD_AGENT_NAME || '').trim())
+        out.FCD_AGENT_NAME = agentName;
+    return out;
+}
+function httpGatewayLogPath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'http-gateway.log');
+}
+function httpGatewayReadyPath() {
+    return path.join(os.homedir(), '.fullcourtdefense', 'http-gateway.json');
+}
+/**
+ * Start `http-gateway` outside our process tree (plain node, no shells) and
+ * wait until it reports its port. The workload's entrypoint runs AFTER this
+ * command returns, so the proxy must already be listening when the agent starts.
+ */
+async function startDetachedHttpGateway(input) {
+    const readyFile = httpGatewayReadyPath();
+    const logFile = httpGatewayLogPath();
+    fs.mkdirSync(path.dirname(logFile), { recursive: true });
+    try {
+        fs.unlinkSync(readyFile);
+    }
+    catch { /* none */ }
+    const out = fs.openSync(logFile, 'a');
+    const cliEntry = path.resolve(process.argv[1] || path.join(__dirname, '..', 'index.js'));
+    // Credentials are NOT passed on the command line (visible in `ps`): the
+    // gateway reads the shield saved by workload-protect from ~/.fullcourtdefense.yml.
+    const args = [cliEntry, 'http-gateway', '--port', String(input.port), '--ready-file', readyFile,
+        '--api-url', input.apiUrl,
+        ...(input.agentName ? ['--agent-name', input.agentName] : [])];
+    const child = (0, child_process_1.spawn)(process.execPath, args, {
+        detached: true,
+        stdio: ['ignore', out, out],
+        windowsHide: true,
+        // The gateway must never route through itself, whatever the agent's env says,
+        // and a long-lived process has no business holding the org enrollment key.
+        env: Object.fromEntries(Object.entries({ ...process.env, FCD_EPHEMERAL: '1' })
+            .filter(([key]) => !/^(https?_proxy|no_proxy|FCD_API_KEY)$/i.test(key))),
+    });
+    child.unref();
+    fs.closeSync(out);
+    const deadline = Date.now() + (input.waitMs ?? 10_000);
+    while (Date.now() < deadline) {
+        try {
+            const ready = JSON.parse(fs.readFileSync(readyFile, 'utf8'));
+            if (ready.port)
+                return { port: ready.port, pid: ready.pid, log: logFile };
+        }
+        catch { /* not yet */ }
+        if (child.exitCode !== null)
+            break;
+        await new Promise(resolve => setTimeout(resolve, 200));
+    }
+    let tail = '';
+    try {
+        tail = fs.readFileSync(logFile, 'utf8').split('\n').filter(Boolean).slice(-3).join(' | ');
+    }
+    catch { /* ignore */ }
+    throw new Error(`http-gateway did not start on port ${input.port}${tail ? ` — ${tail}` : ''} (log: ${logFile})`);
+}
 /**
  * Install the runtime hook + MCP gateway for an enrolled ephemeral identity.
  * Each step is best-effort and reported: a missing MCP client on the image is
@@ -150,6 +252,29 @@ async function installEphemeralProtectionStack(options, config) {
             await sendLog([{ level: 'warn', message: `MCP gateway wrap skipped: ${reason}` }]);
         }
     }
+    // HTTP egress gateway (API destinations) — opt-in. Nothing about the
+    // workload's network path changes unless the caller asked for it.
+    const httpPort = resolveHttpGatewayPort(options.httpGateway);
+    if (httpPort !== undefined) {
+        console.log(`\n\x1b[1mStarting the HTTP egress gateway (API destinations) on 127.0.0.1:${httpPort}…\x1b[0m`);
+        try {
+            const started = await startDetachedHttpGateway({
+                port: httpPort,
+                agentName: options.agentName,
+                apiUrl: options.apiUrl,
+            });
+            console.log(`  \x1b[32m✓\x1b[0m http-gateway listening (pid ${started.pid ?? '?'}) · log: ${started.log}`);
+            console.log('  The identity env file now carries HTTP_PROXY / HTTPS_PROXY — source it before starting the agent.');
+            console.log('  HTTPS calls are gated by destination host; plain HTTP by host, method and endpoint shape.');
+            await sendLog([{ level: 'success', message: `HTTP egress gateway started on 127.0.0.1:${started.port}` }]);
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            console.log(`  \x1b[31mHTTP egress gateway failed to start:\x1b[0m ${reason}`);
+            await sendLog([{ level: 'warn', message: `HTTP egress gateway failed to start: ${reason}` }]);
+            throw error;
+        }
+    }
 }
 /**
  * Make the ephemeral identity visible to everything that runs AFTER this