fullcourtdefense-cli 1.35.0 → 1.35.1

package/dist/actionPolicyEngine.js

@@ -6814,11 +6814,13 @@ function shellVerbWords(command) {
   let lead = "";
   let first = true;
   let scriptArgs = false;
+  let previousBare = "";
   return shellCommandWords(command).split(/\s+/).filter(Boolean).map((token) => {
     if (token === ";") {
       lead = "";
       first = true;
       scriptArgs = false;
+      previousBare = "";
       return token;
     }
     if (scriptArgs) return "";
@@ -6838,12 +6840,19 @@ function shellVerbWords(command) {
     }
     const dot = word.startsWith(".") ? "." : "";
     if (dot && !DOT_COMMAND_PROGRAMS.has(lead)) return "";
+    if (lead === "gh" && GH_CONFIG_RESOURCES.has(previousBare) && /^(?:delete|remove)$/i.test(word)) {
+      const glued = `${previousBare}${word.toLowerCase()}`;
+      previousBare = "";
+      return glued;
+    }
+    if (!flag) previousBare = word.toLowerCase();
     const [head, ...rest] = word.replace(/^\./, "").split(/[-_]+/).filter(Boolean);
     if (!head) return "";
     return `${flag ? flag[1] : dot}${head}${rest.length ? ` ${rest.join("")}` : ""}`;
   }).filter(Boolean).join(" ");
 }
 var VCS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "hg", "svn", "glab"]);
+var GH_CONFIG_RESOURCES = /* @__PURE__ */ new Set(["secret", "variable", "cache", "alias", "label", "ssh-key", "gpg-key"]);
 var SCRIPT_RUNNER_LEADS = /* @__PURE__ */ new Set([
   "bash",
   "sh",
@@ -7346,13 +7355,14 @@ function temporaryFileSyntax(text) {
   return text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/(?<=^|\s)\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_./\\-]+)(?=\s|$)/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
 }
 var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
+var GH_PROSE_VALUE_RE = /^(?:'[^'$`]*'|"[^"$`]*"|[^\s'"$`|;&(){}<>]+)$/;
 function ghMetadataWriteBodyFile(segment) {
   return parseGhMetadataWrite(segment)?.bodyFile;
 }
 function parseGhMetadataWrite(segment) {
-  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)(.+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
+  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)([\s\S]+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
   if (!ghBody) return void 0;
-  const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
+  const tokens = ghBody[2].match(/'[^']*'|"[^"]*"|[^\s'"]+/g) || [];
   if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
   let bodyFile;
   let bodySeen = false;
@@ -7360,7 +7370,10 @@ function parseGhMetadataWrite(segment) {
   for (let i2 = 0; i2 < tokens.length; i2 += 2) {
     const flag = tokens[i2];
     const value = tokens[i2 + 1];
-    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value) return void 0;
+    const literal2 = (/^--(?:body|title)$/i.test(flag) ? GH_PROSE_VALUE_RE : GH_FLAG_VALUE_RE).test(value);
+    const selectorVariable = !/^--(?:body|title|body-file)$/i.test(flag) && /^\$[A-Za-z_]\w*$/.test(value);
+    if (!literal2 && !selectorVariable) return void 0;
     if (/^--body-file$/i.test(flag)) {
       if (bodySeen) return void 0;
       bodySeen = true;
@@ -7376,6 +7389,11 @@ function parseGhMetadataWrite(segment) {
   return { bodyFile, masked: `${ghBody[1]}${kept.join(" ")}${ghBody[3]}` };
 }
 function withoutGhMetadataProse(segment) {
+  const assigned = /^(\s*\$[A-Za-z_]\w*\s*=\s*)([\s\S]+)$/.exec(segment);
+  if (assigned) {
+    const masked = parseGhMetadataWrite(assigned[2])?.masked;
+    return masked === void 0 ? segment : `${assigned[1]}${masked}`;
+  }
   return parseGhMetadataWrite(segment)?.masked ?? segment;
 }
 function shellUrlActionText(command) {
@@ -7954,7 +7972,8 @@ function provenCompoundDownload(command, detectedUrl) {
   return segments.every((segment) => {
     const statusRead = /^\(((?:Invoke-WebRequest|iwr)\s+[^\r\n]+)\)\.(?:StatusCode|StatusDescription|RawContentLength)$/i.exec(segment);
     if (statusRead) segment = statusRead[1];
-    if (/[$`{}()<>;&]/.test(segment)) return false;
+    const withoutWriteOut = segment.replace(/(\s(?:-w|--write-out)\s+)(?:"[^"\r\n$`@]*"|'[^'\r\n$`@]*')/g, '$1"fcd-write-out"');
+    if (/[$`{}()<>;&]/.test(withoutWriteOut)) return false;
     const pipeline = splitShellSegments(segment, true);
     if (pipeline.slice(1).some((part) => !isPowerShellReadFormatter(part))) return false;
     const raw = pipeline[0];
@@ -7968,7 +7987,13 @@ function provenCompoundDownload(command, detectedUrl) {
     let urls = 0;
     for (let i2 = 0; i2 < tokens.length; i2++) {
       const token = tokens[i2];
-      if (isCurl && /^(?:--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+      if (isCurl && /^(?:-m|--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+        i2++;
+        continue;
+      }
+      if (isCurl && /^(?:-w|--write-out)$/.test(token)) {
+        const format = tokens[i2 + 1] || "";
+        if (!format || /^@/.test(format) || /[$`]/.test(format)) return false;
         i2++;
         continue;
       }

package/dist/approvalPrompt.d.ts

@@ -5,7 +5,32 @@ export interface ApprovalMessageOptions {
     alwaysScopeLabel?: string;
     /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
     alwaysLimitsLabel?: string;
+    /** Visual variant. Ask is the interactive dialog; approval/block share the card, not extra buttons. */
+    tone?: DialogTone;
 }
+/** Which policy outcome this window is showing. Icons and copy follow this; buttons do not. */
+export type DialogTone = 'ask' | 'approval' | 'block';
+export interface NativeDialogView {
+    tone: DialogTone;
+    badge: string;
+    headline: string;
+    subtitle: string;
+    kind?: string;
+    action?: string;
+    policy?: string;
+    scope?: string;
+    agent?: string;
+    ide?: string;
+    tool?: string;
+    why: string[];
+    next: string[];
+    footer: string;
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+export declare function nativeDialogView(reason: string, options?: ApprovalMessageOptions): NativeDialogView;
 /** Window title: the kind of action and the policy that stopped it, by name. */
 export declare function nativeApprovalTitle(reason: string): string;
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeDialogView = nativeDialogView;
 exports.nativeApprovalTitle = nativeApprovalTitle;
 exports.nativeApprovalMessage = nativeApprovalMessage;
 /** Compact OS prompt. The complete decision remains in the IDE response and audit. */
@@ -54,6 +55,56 @@ function promptFacts(reason) {
     }
     return facts;
 }
+function sentences(text) {
+    return text.split(/(?<=\.)\s+/).map(part => part.trim()).filter(Boolean);
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+function nativeDialogView(reason, options = {}) {
+    const f = promptFacts(reason);
+    const tone = options.tone || 'ask';
+    const why = [
+        ...(f.because ? sentences(line(f.because, 400)) : []),
+        f.note ? line(f.note, 180) : '',
+        f.fallback ? line(f.fallback, 400) : '',
+    ].filter(Boolean);
+    const next = tone === 'block'
+        ? ['This action is stopped.', 'An admin can change the rule in the console.']
+        : tone === 'approval'
+            ? ['An admin or manager can approve it in the console.', 'Closing this window does not approve it.']
+            : [
+                'Allow once lets only this action continue.',
+                'Deny or close keeps it blocked.',
+                options.allowAlways && options.alwaysScopeLabel
+                    ? `Always allow covers ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`
+                    : '',
+            ].filter(Boolean);
+    const footer = f.policy && !f.fallback
+        ? `Full details: the IDE message and this machine’s Activity. Console → Action Policies → ${f.localSafety ? 'Source: Local Safety → ' : ''}"${line(f.policy, 80)}".`
+        : 'Full details are in the IDE message and this machine’s Activity in FullCourtDefense.';
+    return {
+        tone,
+        badge: tone === 'block' ? 'Blocked' : tone === 'approval' ? 'Approval required' : 'Ask the developer',
+        headline: tone === 'block' ? 'Action blocked' : tone === 'approval' ? 'Action requires approval' : 'Action needs your OK',
+        subtitle: tone === 'block'
+            ? 'A security policy stopped this action. It did not run.'
+            : tone === 'approval'
+                ? 'A security policy paused this action for an admin or manager.'
+                : 'A security policy paused this action. Review the details and choose what to do next.',
+        kind: f.kind,
+        action: f.action ? line(f.action, 280) : undefined,
+        policy: f.policy ? line(f.policy, 160) : undefined,
+        scope: f.scope ? line(f.scope, 220) : undefined,
+        agent: f.agent ? line(f.agent, 80) : undefined,
+        ide: f.ide ? line(f.ide, 40) : undefined,
+        tool: f.tool ? line(f.tool, 230) : undefined,
+        why: why.length ? why : ['A policy matched this action.'],
+        next,
+        footer,
+    };
+}
 /** Window title: the kind of action and the policy that stopped it, by name. */
 function nativeApprovalTitle(reason) {
     const f = promptFacts(reason);