fullcourtdefense-cli 1.34.4 → 1.34.5

package/dist/actionPolicyEngine.js

@@ -686,7 +686,7 @@ const PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|
  * ~ 1 in 62^6 per position. Structural — no vocabulary.
  */
 const REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
-function isHighEntropySecretToken(token) {
+function isHighEntropySecretToken(token, allowWordSlug = false) {
     if (token.length < 24 || token.length > 512)
         return false;
     // `NAME=value` / `--flag=value` is an assignment expression, not a value: the
@@ -695,7 +695,7 @@ function isHighEntropySecretToken(token) {
     // is a reference; `GITHUB_TOKEN=<40 random chars>` is still a secret).
     const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
     if (assignment)
-        return isHighEntropySecretToken(assignment[1]);
+        return isHighEntropySecretToken(assignment[1], allowWordSlug);
     // Any URI (postgres://, redis://, amqp://, https://…) is configuration; only
     // the password inside its userinfo can be a secret — judged as a value.
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(token))
@@ -723,6 +723,12 @@ function isHighEntropySecretToken(token) {
         return false; // url / path
     if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token))
         return false; // camelCase / snake_case identifiers
+    // Lowercase word slugs with a numeric suffix are identifiers (for example
+    // a dated customer/run ID). Separators and the suffix alone do not turn
+    // those words into random credential material. Known credential formats
+    // and explicitly named secret assignments are checked before this fallback.
+    if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token))
+        return false;
     let classes = 0;
     if (/[a-z]/.test(token))
         classes++;
@@ -847,7 +853,7 @@ function detectSecretKind(raw) {
         re.lastIndex = 0;
         let m;
         while ((m = re.exec(value)) !== null) {
-            if (isHighEntropySecretToken(m[1].replace(/[\\"'`]+$/, '')))
+            if (isHighEntropySecretToken(m[1].replace(/[\\"'`]+$/, ''), re === GENERIC_VALUE_RE))
                 return 'high_entropy';
         }
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.4"
+  "version": "1.34.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.4",
+  "version": "1.34.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {