fullcourtdefense-cli 1.35.0 → 1.35.2

package/dist/actionPolicyEngine.js

@@ -6814,11 +6814,13 @@ function shellVerbWords(command) {
   let lead = "";
   let first = true;
   let scriptArgs = false;
+  let previousBare = "";
   return shellCommandWords(command).split(/\s+/).filter(Boolean).map((token) => {
     if (token === ";") {
       lead = "";
       first = true;
       scriptArgs = false;
+      previousBare = "";
       return token;
     }
     if (scriptArgs) return "";
@@ -6838,12 +6840,19 @@ function shellVerbWords(command) {
     }
     const dot = word.startsWith(".") ? "." : "";
     if (dot && !DOT_COMMAND_PROGRAMS.has(lead)) return "";
+    if (lead === "gh" && GH_CONFIG_RESOURCES.has(previousBare) && /^(?:delete|remove)$/i.test(word)) {
+      const glued = `${previousBare}${word.toLowerCase()}`;
+      previousBare = "";
+      return glued;
+    }
+    if (!flag) previousBare = word.toLowerCase();
     const [head, ...rest] = word.replace(/^\./, "").split(/[-_]+/).filter(Boolean);
     if (!head) return "";
     return `${flag ? flag[1] : dot}${head}${rest.length ? ` ${rest.join("")}` : ""}`;
   }).filter(Boolean).join(" ");
 }
 var VCS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "hg", "svn", "glab"]);
+var GH_CONFIG_RESOURCES = /* @__PURE__ */ new Set(["secret", "variable", "cache", "alias", "label", "ssh-key", "gpg-key"]);
 var SCRIPT_RUNNER_LEADS = /* @__PURE__ */ new Set([
   "bash",
   "sh",
@@ -6916,6 +6925,13 @@ function plausibleTokenBody(body) {
 }
 var PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|fake|xxxx/i;
 var REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
+var PUBLISHED_EXAMPLE_VALUES = /* @__PURE__ */ new Set([
+  "JBSWY3DPEHPK3PXP",
+  "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ",
+  "12345678901234567890",
+  ["AKIA", "IOSFODNN7", "EXAMPLE"].join(""),
+  ["wJalrXUtnFEMI/K7MDENG/bPxRfiCY", "EXAMPLEKEY"].join("")
+]);
 function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (token.length < 24 || token.length > 512) return false;
   const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
@@ -6924,7 +6940,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (!/^[A-Za-z0-9._~+/=-]+$/.test(token)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(token)) return false;
   if (/^[0-9a-f]+$/i.test(token)) return false;
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token)) return false;
+  if (/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token) && (token.length === 36 || /[^0-9a-f]/i.test(token[token.length - 37] || ""))) return false;
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
@@ -6950,6 +6966,7 @@ function looksLikeSecretValue(raw) {
   if (value.length < 8) return false;
   if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value)) return false;
   if (/^--?[A-Za-z]/.test(value)) return false;
+  if (PUBLISHED_EXAMPLE_VALUES.has(value)) return false;
   if (SECRET_PLACEHOLDER_RE.test(value)) return false;
   if (SECRET_CODE_EXPR_RE.test(value)) return false;
   if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value)) return false;
@@ -7346,13 +7363,14 @@ function temporaryFileSyntax(text) {
   return text.replace(/"\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_ ./\\-]+)"/gi, '"fcd-temporary$1"').replace(/(?<=^|\s)\$env:(?:TEMP|TMP)([\\/][A-Za-z0-9_./\\-]+)(?=\s|$)/gi, '"fcd-temporary$1"').replace(/\(Join-Path\s+\$env:(?:TEMP|TMP)\s+'([A-Za-z0-9_ ./\\-]+)'\)/gi, '"fcd-temporary/$1"');
 }
 var GH_FLAG_VALUE_RE = /^(?:'[^'$`\r\n]*'|"[^"$`\r\n]*"|[^\s'"$`|;&(){}<>]+)$/;
+var GH_PROSE_VALUE_RE = /^(?:'[^'$`]*'|"[^"$`]*"|[^\s'"$`|;&(){}<>]+)$/;
 function ghMetadataWriteBodyFile(segment) {
   return parseGhMetadataWrite(segment)?.bodyFile;
 }
 function parseGhMetadataWrite(segment) {
-  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)(.+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
+  const ghBody = /^(gh\s+(?:pr\s+create|issue\s+create|pr\s+(?:comment|edit)\s+\d+|issue\s+(?:comment|edit)\s+\d+)\s+)([\s\S]+?)((?:\s+2>&1)?(?:\s*\|\s*Select-Object\s+-Last\s+\d{1,3})?)$/i.exec(segment);
   if (!ghBody) return void 0;
-  const tokens = ghBody[2].match(/'[^'\r\n]*'|"[^"\r\n]*"|[^\s'"]+/g) || [];
+  const tokens = ghBody[2].match(/'[^']*'|"[^"]*"|[^\s'"]+/g) || [];
   if (tokens.join("").replace(/\s/g, "") !== ghBody[2].replace(/\s/g, "")) return void 0;
   let bodyFile;
   let bodySeen = false;
@@ -7360,7 +7378,10 @@ function parseGhMetadataWrite(segment) {
   for (let i2 = 0; i2 < tokens.length; i2 += 2) {
     const flag = tokens[i2];
     const value = tokens[i2 + 1];
-    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value || !GH_FLAG_VALUE_RE.test(value)) return void 0;
+    if (!/^--(?:base|head|title|label|assignee|milestone|reviewer|body-file|body)$/i.test(flag) || !value) return void 0;
+    const literal2 = (/^--(?:body|title)$/i.test(flag) ? GH_PROSE_VALUE_RE : GH_FLAG_VALUE_RE).test(value);
+    const selectorVariable = !/^--(?:body|title|body-file)$/i.test(flag) && /^\$[A-Za-z_]\w*$/.test(value);
+    if (!literal2 && !selectorVariable) return void 0;
     if (/^--body-file$/i.test(flag)) {
       if (bodySeen) return void 0;
       bodySeen = true;
@@ -7376,6 +7397,11 @@ function parseGhMetadataWrite(segment) {
   return { bodyFile, masked: `${ghBody[1]}${kept.join(" ")}${ghBody[3]}` };
 }
 function withoutGhMetadataProse(segment) {
+  const assigned = /^(\s*\$[A-Za-z_]\w*\s*=\s*)([\s\S]+)$/.exec(segment);
+  if (assigned) {
+    const masked = parseGhMetadataWrite(assigned[2])?.masked;
+    return masked === void 0 ? segment : `${assigned[1]}${masked}`;
+  }
   return parseGhMetadataWrite(segment)?.masked ?? segment;
 }
 function shellUrlActionText(command) {
@@ -7954,7 +7980,8 @@ function provenCompoundDownload(command, detectedUrl) {
   return segments.every((segment) => {
     const statusRead = /^\(((?:Invoke-WebRequest|iwr)\s+[^\r\n]+)\)\.(?:StatusCode|StatusDescription|RawContentLength)$/i.exec(segment);
     if (statusRead) segment = statusRead[1];
-    if (/[$`{}()<>;&]/.test(segment)) return false;
+    const withoutWriteOut = segment.replace(/(\s(?:-w|--write-out)\s+)(?:"[^"\r\n$`@]*"|'[^'\r\n$`@]*')/g, '$1"fcd-write-out"');
+    if (/[$`{}()<>;&]/.test(withoutWriteOut)) return false;
     const pipeline = splitShellSegments(segment, true);
     if (pipeline.slice(1).some((part) => !isPowerShellReadFormatter(part))) return false;
     const raw = pipeline[0];
@@ -7968,7 +7995,13 @@ function provenCompoundDownload(command, detectedUrl) {
     let urls = 0;
     for (let i2 = 0; i2 < tokens.length; i2++) {
       const token = tokens[i2];
-      if (isCurl && /^(?:--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+      if (isCurl && /^(?:-m|--max-time|--connect-timeout)$/.test(token) && /^\d+(?:\.\d+)?$/.test(tokens[i2 + 1] || "")) {
+        i2++;
+        continue;
+      }
+      if (isCurl && /^(?:-w|--write-out)$/.test(token)) {
+        const format = tokens[i2 + 1] || "";
+        if (!format || /^@/.test(format) || /[$`]/.test(format)) return false;
         i2++;
         continue;
       }
@@ -8068,6 +8101,16 @@ function provenPowerShellReadSequence(command) {
   }
   return requests > 0;
 }
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+var RAW_NETWORK_PROGRAM_RE = /(?:^|[\s;&|(`])(?:nc|ncat|netcat|socat|ssh|scp|sftp|rsync|telnet|ftp|tftp|mail|mailx|sendmail|msmtp|openssl\s+s_client)\b/i;
+function commandStaysOnLoopback(command) {
+  if (!command || RAW_NETWORK_PROGRAM_RE.test(command)) return false;
+  const hosts = [...command.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(?:[^/\s@'"]*@)?([^/\s:'"?#]+)/gi)].map((match) => match[1]);
+  return hosts.length > 0 && hosts.every(isLoopbackHost);
+}
 function isInternalHost(hostname) {
   const host = hostname.toLowerCase();
   if (!host || host === "localhost" || host === "::1" || host.endsWith(".local") || host.endsWith(".internal")) return true;
@@ -8108,6 +8151,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   const matchText = buildOperationMatchText(toolName, context);
   const toolCaps = toolCapabilities(toolName || context.toolName || "");
   const localFileContentAction = isLocalFileContentAction(toolName, operation, context);
+  const loopbackContentAction = context["destination.loopback"] === "true";
+  const ruleNamesDestination = (rule) => (rule.constraints || []).some((c) => c.field.startsWith("destination."));
+  const contentCeilingApplies = (rule) => ruleNeedsContentFact(rule) && (localFileContentAction || loopbackContentAction && !ruleNamesDestination(rule));
   const isBareInvocation = !!operation && operation.toLowerCase() === (toolName || "").toLowerCase();
   const isCodeExecTool = toolCaps.has("code_execution");
   const candidateOperations = isBareInvocation && declaredOperations.length > 0 && !isCodeExecTool ? [operation, ...declaredOperations] : [operation];
@@ -8162,7 +8208,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
       const constraintDesc = rule.constraints?.map((c) => `${c.field} ${c.operator} ${c.value}`).join(", ");
       const matchedRule = `${rule.operations.join("/")} \u2192 ${rule.verdict}${constraintDesc ? ` (${constraintDesc})` : ""}`;
       if (isMonitorStage) {
-        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction;
+        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule);
         if ((rule.verdict === "block" || rule.verdict === "require_approval") && !wouldOnlyWarn) {
           const match = { policyId: policy.id, policyName: policy.name, verdict: rule.verdict, matchedRule };
           monitorMatches.push(match);
@@ -8180,13 +8226,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
         reason: `Action policy "${policy.name}": ${rule.operations.join("/")} ${rule.verdict === "block" ? "blocked" : rule.verdict === "require_approval" ? "requires approval" : rule.verdict}`,
         ...rule.verdict === "require_approval" ? { approval: resolveApprovalOptions(rule.approval) } : {}
       };
-      if (rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction) {
+      if (rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule)) {
         matched = {
           ...matched,
           allowed: true,
           verdict: "log",
           loggedInsteadOfBlocked: true,
-          reason: `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`
+          reason: localFileContentAction ? `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)` : `${matched.reason} \u2014 recorded as a warning: the destination is this machine (${context["destination.domain"]}) and nothing leaves it (the same content sent to an outside host still blocks; add a destination.type constraint to the rule to enforce on loopback too)`
         };
       }
       if (matched.verdict === "require_approval") {
@@ -8363,6 +8409,10 @@ function inferBundledToolContext(toolName, args) {
     context.amount = String(args.amount ?? args.price ?? args.total);
   }
   context["action.kind"] = isCodeExecTool || toolNameLower === "shell" ? "shell" : context.query !== void 0 && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? "database" : ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg) ? "http" : context.path !== void 0 && (operation === "read" || operation === "write" || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? "file" : "tool";
+  delete context["destination.loopback"];
+  if (context["destination.domain"] && isLoopbackHost(context["destination.domain"]) && (!isCodeExecTool || commandStaysOnLoopback(commandText))) {
+    context["destination.loopback"] = "true";
+  }
   delete context["destination.repository"];
   if (isCodeExecTool) {
     const repository = explicitGitHubWriteRepository(String(args.command || args.cmd || args.code || args.script || args.input || ""));

package/dist/approvalPrompt.d.ts

@@ -5,7 +5,32 @@ export interface ApprovalMessageOptions {
     alwaysScopeLabel?: string;
     /** How long it holds: "30 days" (default) or "7 days or 20 uses". */
     alwaysLimitsLabel?: string;
+    /** Visual variant. Ask is the interactive dialog; approval/block share the card, not extra buttons. */
+    tone?: DialogTone;
 }
+/** Which policy outcome this window is showing. Icons and copy follow this; buttons do not. */
+export type DialogTone = 'ask' | 'approval' | 'block';
+export interface NativeDialogView {
+    tone: DialogTone;
+    badge: string;
+    headline: string;
+    subtitle: string;
+    kind?: string;
+    action?: string;
+    policy?: string;
+    scope?: string;
+    agent?: string;
+    ide?: string;
+    tool?: string;
+    why: string[];
+    next: string[];
+    footer: string;
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+export declare function nativeDialogView(reason: string, options?: ApprovalMessageOptions): NativeDialogView;
 /** Window title: the kind of action and the policy that stopped it, by name. */
 export declare function nativeApprovalTitle(reason: string): string;
 export declare function nativeApprovalMessage(reason: string, options?: ApprovalMessageOptions): string;

package/dist/approvalPrompt.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeDialogView = nativeDialogView;
 exports.nativeApprovalTitle = nativeApprovalTitle;
 exports.nativeApprovalMessage = nativeApprovalMessage;
 /** Compact OS prompt. The complete decision remains in the IDE response and audit. */
@@ -54,6 +55,56 @@ function promptFacts(reason) {
     }
     return facts;
 }
+function sentences(text) {
+    return text.split(/(?<=\.)\s+/).map(part => part.trim()).filter(Boolean);
+}
+/**
+ * Layout model for the branded OS dialog. Same facts as the compact prompt;
+ * skips mockup-only chrome (other-outcome chips, Request approval, project tags).
+ */
+function nativeDialogView(reason, options = {}) {
+    const f = promptFacts(reason);
+    const tone = options.tone || 'ask';
+    const why = [
+        ...(f.because ? sentences(line(f.because, 400)) : []),
+        f.note ? line(f.note, 180) : '',
+        f.fallback ? line(f.fallback, 400) : '',
+    ].filter(Boolean);
+    const next = tone === 'block'
+        ? ['This action is stopped.', 'An admin can change the rule in the console.']
+        : tone === 'approval'
+            ? ['An admin or manager can approve it in the console.', 'Closing this window does not approve it.']
+            : [
+                'Allow once lets only this action continue.',
+                'Deny or close keeps it blocked.',
+                options.allowAlways && options.alwaysScopeLabel
+                    ? `Always allow covers ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`
+                    : '',
+            ].filter(Boolean);
+    const footer = f.policy && !f.fallback
+        ? `Full details: the IDE message and this machine’s Activity. Console → Action Policies → ${f.localSafety ? 'Source: Local Safety → ' : ''}"${line(f.policy, 80)}".`
+        : 'Full details are in the IDE message and this machine’s Activity in FullCourtDefense.';
+    return {
+        tone,
+        badge: tone === 'block' ? 'Blocked' : tone === 'approval' ? 'Approval required' : 'Ask the developer',
+        headline: tone === 'block' ? 'Action blocked' : tone === 'approval' ? 'Action requires approval' : 'Action needs your OK',
+        subtitle: tone === 'block'
+            ? 'A security policy stopped this action. It did not run.'
+            : tone === 'approval'
+                ? 'A security policy paused this action for an admin or manager.'
+                : 'A security policy paused this action. Review the details and choose what to do next.',
+        kind: f.kind,
+        action: f.action ? line(f.action, 280) : undefined,
+        policy: f.policy ? line(f.policy, 160) : undefined,
+        scope: f.scope ? line(f.scope, 220) : undefined,
+        agent: f.agent ? line(f.agent, 80) : undefined,
+        ide: f.ide ? line(f.ide, 40) : undefined,
+        tool: f.tool ? line(f.tool, 230) : undefined,
+        why: why.length ? why : ['A policy matched this action.'],
+        next,
+        footer,
+    };
+}
 /** Window title: the kind of action and the policy that stopped it, by name. */
 function nativeApprovalTitle(reason) {
     const f = promptFacts(reason);

package/dist/blockExplanation.js

@@ -170,7 +170,10 @@ function buildBlockExplanation(input) {
         // "Blocked ..." reason must not turn a pending approval into a final denial.
         const reason = src.source === 'builtin' && (input.outcome === 'ask' || input.outcome === 'approval')
             ? src.reason.replace(/^Blocked\b/, 'Matched') : src.reason;
-        why = src.explanation ? `${reason} — ${src.explanation}` : reason;
+        // Catalog findings often carry the same words as reason and explanation
+        // ("…: gcloud access-token print." / "gcloud access-token print"); say it once.
+        const explanation = src.explanation?.trim().replace(/\.$/, '');
+        why = explanation && !reason.toLowerCase().includes(explanation.toLowerCase()) ? `${reason} — ${src.explanation}` : reason;
         unblock = [
             `Open the rule in the console: ${consoleLink}`,
             `An admin can set "${label}" to Ask the developer, Warn only, or Off — for everyone or only for ${input.developerName || 'this machine'}.`,

package/dist/commands/deterministicGuard.js

@@ -610,19 +610,53 @@ function containsSensitiveCredentialPath(value) {
     // is not a file read. Traversal and the file must sit in the SAME path token:
     // `../.github/x.yml` on one argument and `.env` on another are two unrelated
     // arguments, not a reach outside the workspace (recorded IDE false positive).
-    const envToken = text.split(/[\s'"]+/).find(token => /(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[?#])/.test(token));
-    if (envToken) {
+    // `=` ends a token too: `--env-file=.env` and `DOTENV_CONFIG_PATH=.env` name
+    // the file as much as a bare operand does.
+    for (const token of text.split(/[\s'"=]+/)) {
+        const fileClass = envFileClass(token);
+        if (fileClass === 'template')
+            continue;
+        if (fileClass !== 'secret-store')
+            continue;
         // Traversal to a .env outside the workspace stays a hard block
         // (env_traversal); a plain workspace .env is a separate warn-by-default
         // item (env_workspace) — agents legitimately read it during development,
         // but the fleet should still see every touch.
-        const reachesOutside = /(?:^|\/)\.\.(?:\/|$)/.test(envToken) || /%2e/i.test(envToken);
+        const reachesOutside = /(?:^|\/)\.\.(?:\/|$)/.test(token) || /%2e/i.test(token);
         return reachesOutside
             ? { itemId: 'env_traversal', label: 'environment file via path traversal' }
             : { itemId: 'env_workspace', label: 'workspace environment file' };
     }
     return undefined;
 }
+/**
+ * file.class of an environment file, decided by the filename's structure — not
+ * by the text around it.
+ *
+ *   secret-store  `.env`, `.env.local`, `.env.production`, `HEAD:.env`
+ *   template      `.env.example`, `.env.sample`, `.env.template`, `.env.dist`,
+ *                 `.env.defaults`, `.env.schema` — committed on purpose, keys
+ *                 with empty or placeholder values, the file a README says to
+ *                 copy. Reading, editing or staging a template is not a
+ *                 credential access, whatever program does it.
+ *
+ * A git object path (`HEAD:.env`, `origin/main:.env`, `:.env` for the index)
+ * names the same file inside a commit — `git show HEAD:.env` prints it — so the
+ * revision prefix is stripped before the filename is classified. A Windows
+ * drive letter (`c:/repo/.env`) survives the same strip as a path.
+ */
+const ENV_TEMPLATE_SUFFIXES = new Set(['example', 'examples', 'sample', 'template', 'tpl', 'dist', 'default', 'defaults', 'schema', 'skeleton', 'skel']);
+const ENV_FILE_RE = /(?:^|\/)\.env((?:\.[a-z0-9_-]+)*)(?:$|[?#])/;
+function envFileClass(token) {
+    if (!token.includes('.env'))
+        return undefined;
+    const filePath = token.replace(/^[^\s:]*:(?=[./~\w])/, '');
+    const match = ENV_FILE_RE.exec(filePath) || ENV_FILE_RE.exec(token);
+    if (!match)
+        return undefined;
+    const suffixes = match[1].split('.').filter(Boolean);
+    return suffixes.some(suffix => ENV_TEMPLATE_SUFFIXES.has(suffix)) ? 'template' : 'secret-store';
+}
 /**
  * Commands that PRINT stored credentials to stdout — the file-path rules are
  * useless against them because the secret never comes from a watched file
@@ -1027,8 +1061,10 @@ function credentialAccessCommandText(text) {
     // PowerShell 7 permits a pipeline to continue on a line starting with `|`,
     // even across comment lines. A trailing comma also continues an argument list.
     // Keep these forms intact so a later consumer cannot lose its source path.
+    // A lone `&` backgrounds or invokes (`& script.ps1`) and disqualifies the
+    // text; `2>&1` / `>&2` merely duplicate a file descriptor and do not.
     const allowMetadata = !(/(?:^|[\r\n])[ \t]*\||,[ \t]*(?:#[^\r\n]*)?[\r\n]/.test(text)
-        || /`|(?:^|[^&])&(?:[^&]|$)|@['"]|(?:^|[;&|\r\n])\s*\.\s|\b(?:iex|invoke-expression|invoke-command|eval|function|filter|set-alias|new-alias|sal|nal|set-item|new-item|update-typedata|add-type|import-module|ipmo|PSDefaultParameterValues)\b/i.test(text));
+        || /`|(?:^|[^&>])&(?:[^&\d]|$)|@['"]|(?:^|[;&|\r\n])\s*\.\s|\b(?:iex|invoke-expression|invoke-command|eval|function|filter|set-alias|new-alias|sal|nal|set-item|new-item|update-typedata|add-type|import-module|ipmo|PSDefaultParameterValues)\b/i.test(text));
     const statements = [];
     let current = '', quote = '', depth = 0;
     for (let i = 0; i < text.length; i++) {
@@ -1068,7 +1104,86 @@ function credentialAccessCommandText(text) {
         return text;
     statements.push(current);
     // A real shell separator is a boundary of the preceding path, even without spaces.
-    return statements.map(statement => allowMetadata && isFileMetadataQuery(statement) ? 'fcd_file_metadata' : statement).join('\n');
+    return statements.map(statement => allowMetadata && (isFileMetadataQuery(statement) || isMetadataOnlyStatement(statement)) ? 'fcd_file_metadata' : statement).join('\n');
+}
+/**
+ * access.role of a statement, from its LEADING PROGRAM: what does this program
+ * do with the paths it is given? The programs below answer questions ABOUT a
+ * file — tracked? ignored? present? how big? changed when? — and never print or
+ * move its content. A sensitive path handed to them is the subject of the
+ * question, not an access: `git status .env`, `git check-ignore -v .env`,
+ * `ls -la .env`, `test -f .env`. Anything not listed keeps the conservative
+ * default (the statement may read), so coverage grows without ever losing recall.
+ *
+ * Structural guards: no substitution, grouping or stdin redirection in the
+ * statement (`$(…)`, backticks, parentheses, braces, `<`); a pipe may only feed
+ * a pure text FILTER (`grep`, `wc`, `sort`, `Select-String`…) — metadata in,
+ * metadata out — never a program that turns names into content or runs them
+ * (`xargs cat`, `sh`, `ForEach-Object`). `git log -p` prints patches and
+ * `find -exec` runs a program on the match, so those flags return the
+ * statement to the default.
+ */
+// Programs that print a listing. `Get-Item` / `Get-ChildItem` emit FileInfo
+// OBJECTS and stay with isFileMetadataQuery above, which knows which object
+// properties are metadata. `ls` / `dir` alias them in PowerShell, but every way
+// an object becomes content again — an output variable, a script block, a
+// non-filter consumer — is rejected structurally before this table is consulted.
+const METADATA_ONLY_PROGRAMS = new Set([
+    'ls', 'dir', 'stat', 'test', '[', 'file', 'du', 'realpath', 'readlink', 'basename', 'dirname', 'test-path',
+]);
+const GIT_METADATA_SUBCOMMANDS = new Set(['status', 'check-ignore', 'check-attr', 'ls-files', 'ls-tree', 'log', 'shortlog', 'rev-parse', 'rev-list', 'branch', 'remote', 'tag', 'describe']);
+// Downstream of a metadata program, only these keep the pipe metadata-only.
+const TEXT_FILTER_PROGRAMS = new Set([
+    'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'wc', 'sort', 'uniq', 'head', 'tail', 'cut', 'tr', 'column', 'nl',
+    'select-string', 'sls', 'measure-object', 'measure', 'sort-object',
+    'format-table', 'ft', 'format-list', 'fl', 'format-wide', 'fw', 'out-string', 'out-null', 'out-host', 'more',
+]);
+// An output/pipeline variable keeps the result for a later statement to open.
+const CAPTURING_PARAMETER_RE = /^-(?:outvariable|ov|pipelinevariable|pv|outbuffer|ob)$/i;
+function leadingProgram(tokens) {
+    let i = 0;
+    while (i < tokens.length && (/^[A-Za-z_]\w*=/.test(tokens[i]) || /^(?:sudo|command)$/i.test(tokens[i])))
+        i++;
+    return { program: (tokens[i] || '').toLowerCase().replace(/^.*\//, '').replace(/\.exe$/, ''), args: tokens.slice(i + 1) };
+}
+function isMetadataOnlyStatement(statement) {
+    if (/[`(){}<]|\$\(/.test(statement))
+        return false;
+    const tokens = statement.trim().match(/"[^"\r\n]*"|'(?:[^'\r\n]|'')*'|[^\s"']+/g) || [];
+    if (tokens.some(token => CAPTURING_PARAMETER_RE.test(token)))
+        return false;
+    const segments = [[]];
+    for (const token of tokens) {
+        if (token === '|')
+            segments.push([]);
+        else
+            segments[segments.length - 1].push(token);
+    }
+    for (const segment of segments.slice(1)) {
+        if (!TEXT_FILTER_PROGRAMS.has(leadingProgram(segment).program))
+            return false;
+    }
+    const { program, args } = leadingProgram(segments[0]);
+    if (!program)
+        return false;
+    if (program === 'git') {
+        let j = 0;
+        while (j < args.length && args[j].startsWith('-')) {
+            if (/^-[cC]$/.test(args[j]))
+                j++;
+            j++;
+        }
+        const subcommand = (args[j] || '').toLowerCase();
+        if (!GIT_METADATA_SUBCOMMANDS.has(subcommand))
+            return false;
+        const rest = args.slice(j + 1);
+        if ((subcommand === 'log' || subcommand === 'rev-list') && rest.some(arg => /^(?:-p|-u|--patch|-L|--pretty|--format|-c|--cc)/.test(arg)))
+            return false;
+        return true;
+    }
+    if (program === 'find')
+        return !args.some(arg => /^-(?:exec|execdir|ok|okdir|delete|fprint\w*|fls)$/i.test(arg));
+    return METADATA_ONLY_PROGRAMS.has(program);
 }
 function scanTextValue(toolName, rawValue, options, commandContext = false) {
     // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
@@ -1092,7 +1207,10 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     const sensitivePath = containsSensitiveCredentialPath(commandContext
         ? `${credentialAccessCommandText(value)}\n${interpreterFileArguments(rawValue)}` : value);
     if (sensitivePath) {
-        const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', `Blocked local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', 
+        // Verdict-neutral: the same finding is a warning on a monitor machine and
+        // a block on an enforcing one — the console shows the verdict, not this text.
+        `Local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
         if (finding)
             return finding;
     }

package/dist/commands/hook.js

@@ -2111,6 +2111,12 @@ async function enforceActionPolicy(ctx) {
         (0, policyGateHealth_1.recordGateSuccess)();
     }
     catch (err) {
+        // A verdict was already written inside the try (respondDegraded / respond →
+        // io.exit). In daemon mode io.exit unwinds with HookExitSignal; catching it
+        // here answered the IDE a SECOND time ("Hook error: {code:0}") and counted
+        // one rejected request as two gate failures, tripping fail-closed early.
+        if (err instanceof HookExitSignal)
+            throw err;
         const described = (0, describeError_1.describeError)(err);
         (0, hookIo_1.dbg)({ phase: 'policy_exception', event, error: described, failClosed: ctx.failClosed });
         const detail = `Hook error: ${described}.`;
@@ -2281,6 +2287,8 @@ async function enforceShieldText(ctx) {
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
+        if (err instanceof HookExitSignal)
+            throw err; // verdict already written (daemon-mode unwind)
         respondDegraded(ctx, `Hook error: ${(0, describeError_1.describeError)(err)}.`, 'prompt');
     }
 }