fullcourtdefense-cli 1.35.1 → 1.35.2

package/dist/actionPolicyEngine.js

@@ -6925,6 +6925,13 @@ function plausibleTokenBody(body) {
 }
 var PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|fake|xxxx/i;
 var REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
+var PUBLISHED_EXAMPLE_VALUES = /* @__PURE__ */ new Set([
+  "JBSWY3DPEHPK3PXP",
+  "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ",
+  "12345678901234567890",
+  ["AKIA", "IOSFODNN7", "EXAMPLE"].join(""),
+  ["wJalrXUtnFEMI/K7MDENG/bPxRfiCY", "EXAMPLEKEY"].join("")
+]);
 function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (token.length < 24 || token.length > 512) return false;
   const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
@@ -6933,7 +6940,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (!/^[A-Za-z0-9._~+/=-]+$/.test(token)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(token)) return false;
   if (/^[0-9a-f]+$/i.test(token)) return false;
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token)) return false;
+  if (/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token) && (token.length === 36 || /[^0-9a-f]/i.test(token[token.length - 37] || ""))) return false;
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
@@ -6959,6 +6966,7 @@ function looksLikeSecretValue(raw) {
   if (value.length < 8) return false;
   if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value)) return false;
   if (/^--?[A-Za-z]/.test(value)) return false;
+  if (PUBLISHED_EXAMPLE_VALUES.has(value)) return false;
   if (SECRET_PLACEHOLDER_RE.test(value)) return false;
   if (SECRET_CODE_EXPR_RE.test(value)) return false;
   if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value)) return false;
@@ -8093,6 +8101,16 @@ function provenPowerShellReadSequence(command) {
   }
   return requests > 0;
 }
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+var RAW_NETWORK_PROGRAM_RE = /(?:^|[\s;&|(`])(?:nc|ncat|netcat|socat|ssh|scp|sftp|rsync|telnet|ftp|tftp|mail|mailx|sendmail|msmtp|openssl\s+s_client)\b/i;
+function commandStaysOnLoopback(command) {
+  if (!command || RAW_NETWORK_PROGRAM_RE.test(command)) return false;
+  const hosts = [...command.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(?:[^/\s@'"]*@)?([^/\s:'"?#]+)/gi)].map((match) => match[1]);
+  return hosts.length > 0 && hosts.every(isLoopbackHost);
+}
 function isInternalHost(hostname) {
   const host = hostname.toLowerCase();
   if (!host || host === "localhost" || host === "::1" || host.endsWith(".local") || host.endsWith(".internal")) return true;
@@ -8133,6 +8151,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   const matchText = buildOperationMatchText(toolName, context);
   const toolCaps = toolCapabilities(toolName || context.toolName || "");
   const localFileContentAction = isLocalFileContentAction(toolName, operation, context);
+  const loopbackContentAction = context["destination.loopback"] === "true";
+  const ruleNamesDestination = (rule) => (rule.constraints || []).some((c) => c.field.startsWith("destination."));
+  const contentCeilingApplies = (rule) => ruleNeedsContentFact(rule) && (localFileContentAction || loopbackContentAction && !ruleNamesDestination(rule));
   const isBareInvocation = !!operation && operation.toLowerCase() === (toolName || "").toLowerCase();
   const isCodeExecTool = toolCaps.has("code_execution");
   const candidateOperations = isBareInvocation && declaredOperations.length > 0 && !isCodeExecTool ? [operation, ...declaredOperations] : [operation];
@@ -8187,7 +8208,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
       const constraintDesc = rule.constraints?.map((c) => `${c.field} ${c.operator} ${c.value}`).join(", ");
       const matchedRule = `${rule.operations.join("/")} \u2192 ${rule.verdict}${constraintDesc ? ` (${constraintDesc})` : ""}`;
       if (isMonitorStage) {
-        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction;
+        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule);
         if ((rule.verdict === "block" || rule.verdict === "require_approval") && !wouldOnlyWarn) {
           const match = { policyId: policy.id, policyName: policy.name, verdict: rule.verdict, matchedRule };
           monitorMatches.push(match);
@@ -8205,13 +8226,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
         reason: `Action policy "${policy.name}": ${rule.operations.join("/")} ${rule.verdict === "block" ? "blocked" : rule.verdict === "require_approval" ? "requires approval" : rule.verdict}`,
         ...rule.verdict === "require_approval" ? { approval: resolveApprovalOptions(rule.approval) } : {}
       };
-      if (rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction) {
+      if (rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule)) {
         matched = {
           ...matched,
           allowed: true,
           verdict: "log",
           loggedInsteadOfBlocked: true,
-          reason: `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`
+          reason: localFileContentAction ? `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)` : `${matched.reason} \u2014 recorded as a warning: the destination is this machine (${context["destination.domain"]}) and nothing leaves it (the same content sent to an outside host still blocks; add a destination.type constraint to the rule to enforce on loopback too)`
         };
       }
       if (matched.verdict === "require_approval") {
@@ -8388,6 +8409,10 @@ function inferBundledToolContext(toolName, args) {
     context.amount = String(args.amount ?? args.price ?? args.total);
   }
   context["action.kind"] = isCodeExecTool || toolNameLower === "shell" ? "shell" : context.query !== void 0 && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? "database" : ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg) ? "http" : context.path !== void 0 && (operation === "read" || operation === "write" || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? "file" : "tool";
+  delete context["destination.loopback"];
+  if (context["destination.domain"] && isLoopbackHost(context["destination.domain"]) && (!isCodeExecTool || commandStaysOnLoopback(commandText))) {
+    context["destination.loopback"] = "true";
+  }
   delete context["destination.repository"];
   if (isCodeExecTool) {
     const repository = explicitGitHubWriteRepository(String(args.command || args.cmd || args.code || args.script || args.input || ""));

package/dist/blockExplanation.js

@@ -170,7 +170,10 @@ function buildBlockExplanation(input) {
         // "Blocked ..." reason must not turn a pending approval into a final denial.
         const reason = src.source === 'builtin' && (input.outcome === 'ask' || input.outcome === 'approval')
             ? src.reason.replace(/^Blocked\b/, 'Matched') : src.reason;
-        why = src.explanation ? `${reason} — ${src.explanation}` : reason;
+        // Catalog findings often carry the same words as reason and explanation
+        // ("…: gcloud access-token print." / "gcloud access-token print"); say it once.
+        const explanation = src.explanation?.trim().replace(/\.$/, '');
+        why = explanation && !reason.toLowerCase().includes(explanation.toLowerCase()) ? `${reason} — ${src.explanation}` : reason;
         unblock = [
             `Open the rule in the console: ${consoleLink}`,
             `An admin can set "${label}" to Ask the developer, Warn only, or Off — for everyone or only for ${input.developerName || 'this machine'}.`,

package/dist/commands/deterministicGuard.js

@@ -610,19 +610,53 @@ function containsSensitiveCredentialPath(value) {
     // is not a file read. Traversal and the file must sit in the SAME path token:
     // `../.github/x.yml` on one argument and `.env` on another are two unrelated
     // arguments, not a reach outside the workspace (recorded IDE false positive).
-    const envToken = text.split(/[\s'"]+/).find(token => /(?:^|\/)\.env(?:\.[a-z0-9_-]+)?(?:$|[?#])/.test(token));
-    if (envToken) {
+    // `=` ends a token too: `--env-file=.env` and `DOTENV_CONFIG_PATH=.env` name
+    // the file as much as a bare operand does.
+    for (const token of text.split(/[\s'"=]+/)) {
+        const fileClass = envFileClass(token);
+        if (fileClass === 'template')
+            continue;
+        if (fileClass !== 'secret-store')
+            continue;
         // Traversal to a .env outside the workspace stays a hard block
         // (env_traversal); a plain workspace .env is a separate warn-by-default
         // item (env_workspace) — agents legitimately read it during development,
         // but the fleet should still see every touch.
-        const reachesOutside = /(?:^|\/)\.\.(?:\/|$)/.test(envToken) || /%2e/i.test(envToken);
+        const reachesOutside = /(?:^|\/)\.\.(?:\/|$)/.test(token) || /%2e/i.test(token);
         return reachesOutside
             ? { itemId: 'env_traversal', label: 'environment file via path traversal' }
             : { itemId: 'env_workspace', label: 'workspace environment file' };
     }
     return undefined;
 }
+/**
+ * file.class of an environment file, decided by the filename's structure — not
+ * by the text around it.
+ *
+ *   secret-store  `.env`, `.env.local`, `.env.production`, `HEAD:.env`
+ *   template      `.env.example`, `.env.sample`, `.env.template`, `.env.dist`,
+ *                 `.env.defaults`, `.env.schema` — committed on purpose, keys
+ *                 with empty or placeholder values, the file a README says to
+ *                 copy. Reading, editing or staging a template is not a
+ *                 credential access, whatever program does it.
+ *
+ * A git object path (`HEAD:.env`, `origin/main:.env`, `:.env` for the index)
+ * names the same file inside a commit — `git show HEAD:.env` prints it — so the
+ * revision prefix is stripped before the filename is classified. A Windows
+ * drive letter (`c:/repo/.env`) survives the same strip as a path.
+ */
+const ENV_TEMPLATE_SUFFIXES = new Set(['example', 'examples', 'sample', 'template', 'tpl', 'dist', 'default', 'defaults', 'schema', 'skeleton', 'skel']);
+const ENV_FILE_RE = /(?:^|\/)\.env((?:\.[a-z0-9_-]+)*)(?:$|[?#])/;
+function envFileClass(token) {
+    if (!token.includes('.env'))
+        return undefined;
+    const filePath = token.replace(/^[^\s:]*:(?=[./~\w])/, '');
+    const match = ENV_FILE_RE.exec(filePath) || ENV_FILE_RE.exec(token);
+    if (!match)
+        return undefined;
+    const suffixes = match[1].split('.').filter(Boolean);
+    return suffixes.some(suffix => ENV_TEMPLATE_SUFFIXES.has(suffix)) ? 'template' : 'secret-store';
+}
 /**
  * Commands that PRINT stored credentials to stdout — the file-path rules are
  * useless against them because the secret never comes from a watched file
@@ -1027,8 +1061,10 @@ function credentialAccessCommandText(text) {
     // PowerShell 7 permits a pipeline to continue on a line starting with `|`,
     // even across comment lines. A trailing comma also continues an argument list.
     // Keep these forms intact so a later consumer cannot lose its source path.
+    // A lone `&` backgrounds or invokes (`& script.ps1`) and disqualifies the
+    // text; `2>&1` / `>&2` merely duplicate a file descriptor and do not.
     const allowMetadata = !(/(?:^|[\r\n])[ \t]*\||,[ \t]*(?:#[^\r\n]*)?[\r\n]/.test(text)
-        || /`|(?:^|[^&])&(?:[^&]|$)|@['"]|(?:^|[;&|\r\n])\s*\.\s|\b(?:iex|invoke-expression|invoke-command|eval|function|filter|set-alias|new-alias|sal|nal|set-item|new-item|update-typedata|add-type|import-module|ipmo|PSDefaultParameterValues)\b/i.test(text));
+        || /`|(?:^|[^&>])&(?:[^&\d]|$)|@['"]|(?:^|[;&|\r\n])\s*\.\s|\b(?:iex|invoke-expression|invoke-command|eval|function|filter|set-alias|new-alias|sal|nal|set-item|new-item|update-typedata|add-type|import-module|ipmo|PSDefaultParameterValues)\b/i.test(text));
     const statements = [];
     let current = '', quote = '', depth = 0;
     for (let i = 0; i < text.length; i++) {
@@ -1068,7 +1104,86 @@ function credentialAccessCommandText(text) {
         return text;
     statements.push(current);
     // A real shell separator is a boundary of the preceding path, even without spaces.
-    return statements.map(statement => allowMetadata && isFileMetadataQuery(statement) ? 'fcd_file_metadata' : statement).join('\n');
+    return statements.map(statement => allowMetadata && (isFileMetadataQuery(statement) || isMetadataOnlyStatement(statement)) ? 'fcd_file_metadata' : statement).join('\n');
+}
+/**
+ * access.role of a statement, from its LEADING PROGRAM: what does this program
+ * do with the paths it is given? The programs below answer questions ABOUT a
+ * file — tracked? ignored? present? how big? changed when? — and never print or
+ * move its content. A sensitive path handed to them is the subject of the
+ * question, not an access: `git status .env`, `git check-ignore -v .env`,
+ * `ls -la .env`, `test -f .env`. Anything not listed keeps the conservative
+ * default (the statement may read), so coverage grows without ever losing recall.
+ *
+ * Structural guards: no substitution, grouping or stdin redirection in the
+ * statement (`$(…)`, backticks, parentheses, braces, `<`); a pipe may only feed
+ * a pure text FILTER (`grep`, `wc`, `sort`, `Select-String`…) — metadata in,
+ * metadata out — never a program that turns names into content or runs them
+ * (`xargs cat`, `sh`, `ForEach-Object`). `git log -p` prints patches and
+ * `find -exec` runs a program on the match, so those flags return the
+ * statement to the default.
+ */
+// Programs that print a listing. `Get-Item` / `Get-ChildItem` emit FileInfo
+// OBJECTS and stay with isFileMetadataQuery above, which knows which object
+// properties are metadata. `ls` / `dir` alias them in PowerShell, but every way
+// an object becomes content again — an output variable, a script block, a
+// non-filter consumer — is rejected structurally before this table is consulted.
+const METADATA_ONLY_PROGRAMS = new Set([
+    'ls', 'dir', 'stat', 'test', '[', 'file', 'du', 'realpath', 'readlink', 'basename', 'dirname', 'test-path',
+]);
+const GIT_METADATA_SUBCOMMANDS = new Set(['status', 'check-ignore', 'check-attr', 'ls-files', 'ls-tree', 'log', 'shortlog', 'rev-parse', 'rev-list', 'branch', 'remote', 'tag', 'describe']);
+// Downstream of a metadata program, only these keep the pipe metadata-only.
+const TEXT_FILTER_PROGRAMS = new Set([
+    'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'wc', 'sort', 'uniq', 'head', 'tail', 'cut', 'tr', 'column', 'nl',
+    'select-string', 'sls', 'measure-object', 'measure', 'sort-object',
+    'format-table', 'ft', 'format-list', 'fl', 'format-wide', 'fw', 'out-string', 'out-null', 'out-host', 'more',
+]);
+// An output/pipeline variable keeps the result for a later statement to open.
+const CAPTURING_PARAMETER_RE = /^-(?:outvariable|ov|pipelinevariable|pv|outbuffer|ob)$/i;
+function leadingProgram(tokens) {
+    let i = 0;
+    while (i < tokens.length && (/^[A-Za-z_]\w*=/.test(tokens[i]) || /^(?:sudo|command)$/i.test(tokens[i])))
+        i++;
+    return { program: (tokens[i] || '').toLowerCase().replace(/^.*\//, '').replace(/\.exe$/, ''), args: tokens.slice(i + 1) };
+}
+function isMetadataOnlyStatement(statement) {
+    if (/[`(){}<]|\$\(/.test(statement))
+        return false;
+    const tokens = statement.trim().match(/"[^"\r\n]*"|'(?:[^'\r\n]|'')*'|[^\s"']+/g) || [];
+    if (tokens.some(token => CAPTURING_PARAMETER_RE.test(token)))
+        return false;
+    const segments = [[]];
+    for (const token of tokens) {
+        if (token === '|')
+            segments.push([]);
+        else
+            segments[segments.length - 1].push(token);
+    }
+    for (const segment of segments.slice(1)) {
+        if (!TEXT_FILTER_PROGRAMS.has(leadingProgram(segment).program))
+            return false;
+    }
+    const { program, args } = leadingProgram(segments[0]);
+    if (!program)
+        return false;
+    if (program === 'git') {
+        let j = 0;
+        while (j < args.length && args[j].startsWith('-')) {
+            if (/^-[cC]$/.test(args[j]))
+                j++;
+            j++;
+        }
+        const subcommand = (args[j] || '').toLowerCase();
+        if (!GIT_METADATA_SUBCOMMANDS.has(subcommand))
+            return false;
+        const rest = args.slice(j + 1);
+        if ((subcommand === 'log' || subcommand === 'rev-list') && rest.some(arg => /^(?:-p|-u|--patch|-L|--pretty|--format|-c|--cc)/.test(arg)))
+            return false;
+        return true;
+    }
+    if (program === 'find')
+        return !args.some(arg => /^-(?:exec|execdir|ok|okdir|delete|fprint\w*|fls)$/i.test(arg));
+    return METADATA_ONLY_PROGRAMS.has(program);
 }
 function scanTextValue(toolName, rawValue, options, commandContext = false) {
     // Honeypot decoys and org custom patterns scan the RAW value: a decoy path
@@ -1092,7 +1207,10 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     const sensitivePath = containsSensitiveCredentialPath(commandContext
         ? `${credentialAccessCommandText(value)}\n${interpreterFileArguments(rawValue)}` : value);
     if (sensitivePath) {
-        const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', `Blocked local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', 
+        // Verdict-neutral: the same finding is a warning on a monitor machine and
+        // a block on an enforcing one — the console shows the verdict, not this text.
+        `Local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
         if (finding)
             return finding;
     }

package/dist/commands/hook.js

@@ -2111,6 +2111,12 @@ async function enforceActionPolicy(ctx) {
         (0, policyGateHealth_1.recordGateSuccess)();
     }
     catch (err) {
+        // A verdict was already written inside the try (respondDegraded / respond →
+        // io.exit). In daemon mode io.exit unwinds with HookExitSignal; catching it
+        // here answered the IDE a SECOND time ("Hook error: {code:0}") and counted
+        // one rejected request as two gate failures, tripping fail-closed early.
+        if (err instanceof HookExitSignal)
+            throw err;
         const described = (0, describeError_1.describeError)(err);
         (0, hookIo_1.dbg)({ phase: 'policy_exception', event, error: described, failClosed: ctx.failClosed });
         const detail = `Hook error: ${described}.`;
@@ -2281,6 +2287,8 @@ async function enforceShieldText(ctx) {
         respond(true, `Blocked by FullCourtDefense — ${reason}.`, `FullCourtDefense blocked this ${event} as "${reason}". Do not retry; revise to remove the flagged content.`);
     }
     catch (err) {
+        if (err instanceof HookExitSignal)
+            throw err; // verdict already written (daemon-mode unwind)
         respondDegraded(ctx, `Hook error: ${(0, describeError_1.describeError)(err)}.`, 'prompt');
     }
 }

package/dist/devConfirm.js

@@ -212,14 +212,16 @@ function windowsDialogScript(message, timeoutSeconds, options, title, view) {
         "$bg=[Drawing.Color]::White; $muted=[Drawing.Color]::FromArgb(100,116,139); $ink=[Drawing.Color]::FromArgb(15,23,42)",
         `$accent=[Drawing.Color]::FromArgb(${argb(theme.icon)}); $badgeBg=[Drawing.Color]::FromArgb(${argb(theme.badgeBg)}); $badgeFg=[Drawing.Color]::FromArgb(${argb(theme.badgeFg)})`,
         "$f=New-Object Windows.Forms.Form; $f.Text=$title; $f.TopMost=$true; $f.StartPosition='CenterScreen'; $f.FormBorderStyle='FixedDialog'; $f.MaximizeBox=$false; $f.MinimizeBox=$false; $f.ShowInTaskbar=$true; $f.BackColor=$bg; $f.Font=New-Object Drawing.Font('Segoe UI',9.75); $f.ClientSize=New-Object Drawing.Size(700,640)",
-        "$root=New-Object Windows.Forms.Panel; $root.Dock='Fill'; $root.Padding=New-Object Windows.Forms.Padding(22,16,22,16); $root.AutoScroll=$true; $root.BackColor=$bg; $f.Controls.Add($root)",
-        "function AddLabel($parent,$text,$font,$color,$y,$w,$x){ $l=New-Object Windows.Forms.Label; $l.Text=$text; $l.Font=$font; $l.ForeColor=$color; $l.AutoSize=$true; $l.MaximumSize=New-Object Drawing.Size($w,0); $l.Location=New-Object Drawing.Point($(if($x){$x}else{0}),$y); $parent.Controls.Add($l); return $l }",
-        "$y=0; $w=640",
-        "AddLabel $root 'FullCourtDefense' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=28",
-        "$icon=New-Object Windows.Forms.Label; $icon.Text='${theme.glyph}'; $icon.Font=New-Object Drawing.Font('Segoe UI',18,[Drawing.FontStyle]::Bold); $icon.TextAlign='MiddleCenter'; $icon.Size=New-Object Drawing.Size(44,44); $icon.Location=New-Object Drawing.Point(0,$y); $icon.ForeColor=$accent; $icon.BackColor=$badgeBg; $root.Controls.Add($icon)",
-        "$badge=AddLabel $root ([string]$v.badge) (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $badgeFg $y 560 56; $badge.BackColor=$badgeBg",
-        "$h=AddLabel $root ([string]$v.headline) (New-Object Drawing.Font('Segoe UI',16,[Drawing.FontStyle]::Bold)) $ink ($badge.Bottom+4) 560 56",
-        "$s=AddLabel $root ([string]$v.subtitle) (New-Object Drawing.Font('Segoe UI',9.75)) $muted ($h.Bottom+4) 560 56; $y=[Math]::Max($icon.Bottom,$s.Bottom)+16",
+        // Panel.Padding does not move absolutely positioned children: every control takes $x0 explicitly.
+        "$root=New-Object Windows.Forms.Panel; $root.Dock='Fill'; $root.AutoScroll=$true; $root.BackColor=$bg; $f.Controls.Add($root)",
+        "function AddLabel($parent,$text,$font,$color,$y,$w,$x){ $l=New-Object Windows.Forms.Label; $l.Text=$text; $l.Font=$font; $l.ForeColor=$color; $l.AutoSize=$true; $l.MaximumSize=New-Object Drawing.Size($w,0); $l.Location=New-Object Drawing.Point($(if($x){$x}else{$x0}),$y); $parent.Controls.Add($l); return $l }",
+        "$x0=24; $y=18; $w=652",
+        "AddLabel $root 'FullCourtDefense' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=30",
+        `$icon=New-Object Windows.Forms.Label; $icon.Text='${theme.glyph}'; $icon.Font=New-Object Drawing.Font('Segoe UI',18,[Drawing.FontStyle]::Bold); $icon.TextAlign='MiddleCenter'; $icon.Size=New-Object Drawing.Size(44,44); $icon.Location=New-Object Drawing.Point($x0,$y); $icon.ForeColor=$accent; $icon.BackColor=$badgeBg; $root.Controls.Add($icon)`,
+        "$hx=$x0+58; $hw=$w-58",
+        "$badge=AddLabel $root ([string]$v.badge) (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $badgeFg $y $hw $hx; $badge.BackColor=$badgeBg; $badge.Padding=New-Object Windows.Forms.Padding(6,2,6,2)",
+        "$h=AddLabel $root ([string]$v.headline) (New-Object Drawing.Font('Segoe UI',16,[Drawing.FontStyle]::Bold)) $ink ($badge.Bottom+4) $hw $hx",
+        "$s=AddLabel $root ([string]$v.subtitle) (New-Object Drawing.Font('Segoe UI',9.75)) $muted ($h.Bottom+4) $hw $hx; $y=[Math]::Max($icon.Bottom,$s.Bottom)+18",
         "AddLabel $root 'Action' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $ink $y $w | Out-Null; $y+=22",
         "if($v.kind){ AddLabel $root ([string]$v.kind) (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=18 }",
         "if($v.action){ $a=AddLabel $root ([string]$v.action) (New-Object Drawing.Font('Consolas',9.75)) $ink $y $w; $y=$a.Bottom+12 } else { $y+=8 }",
@@ -228,13 +230,17 @@ function windowsDialogScript(message, timeoutSeconds, options, title, view) {
         "foreach($item in @($v.why)){ $row=AddLabel $root ('•  '+$item) (New-Object Drawing.Font('Segoe UI',9.75)) $ink $y $w; $y=$row.Bottom+2 }",
         "$y+=10; AddLabel $root 'What happens next' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $ink $y $w | Out-Null; $y+=22",
         "foreach($item in @($v.next)){ $row=AddLabel $root ('•  '+$item) (New-Object Drawing.Font('Segoe UI',9.75)) $ink $y $w; $y=$row.Bottom+2 }",
-        "$y+=16; $b=New-Object Windows.Forms.FlowLayoutPanel; $b.FlowDirection='RightToLeft'; $b.AutoSize=$true; $b.WrapContents=$false; $b.Location=New-Object Drawing.Point(0,$y)",
+        // Fixed-size row spanning the content width: RightToLeft flow puts Deny at the right edge,
+        // and a known height lets the footer and the form size be computed before the window exists.
+        "$y+=18; $b=New-Object Windows.Forms.FlowLayoutPanel; $b.FlowDirection='RightToLeft'; $b.AutoSize=$false; $b.WrapContents=$false; $b.Size=New-Object Drawing.Size($w,40); $b.Location=New-Object Drawing.Point($x0,$y)",
         `$deny=New-Object Windows.Forms.Button; $deny.Text='${exports.DIALOG_BUTTON_DENY}'; $deny.AutoSize=$true; $deny.MinimumSize=New-Object Drawing.Size(96,34); $deny.FlatStyle='Flat'; $deny.ForeColor=[Drawing.Color]::FromArgb(220,38,38); $deny.BackColor=$bg; $deny.FlatAppearance.BorderColor=[Drawing.Color]::FromArgb(254,202,202); $deny.DialogResult='Cancel'; $deny.TabIndex=0; $b.Controls.Add($deny)`,
         `$once=New-Object Windows.Forms.Button; $once.Text='${exports.DIALOG_BUTTON_ONCE}'; $once.AutoSize=$true; $once.MinimumSize=New-Object Drawing.Size(110,34); $once.FlatStyle='Flat'; $once.ForeColor=[Drawing.Color]::White; $once.BackColor=[Drawing.Color]::FromArgb(29,78,216); $once.FlatAppearance.BorderSize=0; $once.DialogResult='OK'; $once.TabIndex=1; $b.Controls.Add($once)`,
         options.allowAlways
             ? `$always=New-Object Windows.Forms.Button; $always.Text='${exports.DIALOG_BUTTON_ALWAYS}'; $always.AutoSize=$true; $always.MinimumSize=New-Object Drawing.Size(110,34); $always.FlatStyle='Flat'; $always.BackColor=$bg; $always.DialogResult='Yes'; $always.TabIndex=2; $b.Controls.Add($always)`
             : '',
-        "$root.Controls.Add($b); AddLabel $root ([string]$v.footer) (New-Object Drawing.Font('Segoe UI',8.25)) $muted ($b.Bottom+12) $w | Out-Null",
+        "$root.Controls.Add($b); $foot=AddLabel $root ([string]$v.footer) (New-Object Drawing.Font('Segoe UI',8.25)) $muted ($b.Bottom+14) $w",
+        // Fit the window to its content; only a very long action / reason list scrolls.
+        "$wa=[Windows.Forms.Screen]::PrimaryScreen.WorkingArea; $f.ClientSize=New-Object Drawing.Size(($w+2*$x0),[Math]::Min($foot.Bottom+18,[Math]::Max(360,$wa.Height-120)))",
         "$f.CancelButton=$deny; $f.AcceptButton=$deny; $f.ActiveControl=$deny",
         `$timer=New-Object Windows.Forms.Timer; $timer.Interval=${timeoutSeconds * 1000}; $timer.Add_Tick({ $f.DialogResult='Abort'; $f.Close() })`,
         "$f.Add_Load({ $f.WindowState='Minimized'; $f.WindowState='Normal' })",
@@ -765,6 +771,10 @@ function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PEN
 // ---------------------------------------------------------------------------
 /** Shell words that run the program that follows them, not a program of their own. */
 const SHELL_LEAD_WRAPPERS = new Set(['sudo', 'doas', 'env', 'nice', 'nohup', 'time', 'command', 'builtin', 'exec', 'xargs', 'timeout', 'stdbuf', 'chronic', 'busybox', 'call', 'start', '&']);
+/** Control-flow words (sh / bash / PowerShell): structure, never a program of their own. */
+const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|switch|break|continue)$/i;
+/** Words a body follows directly (`then rm x`, `do echo`, PowerShell `else { … }`). */
+const SHELL_BODY_LEADS = /^(then|do|else)$/i;
 /** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
 function splitShellSegments(command) {
     const segments = [];
@@ -808,11 +818,20 @@ function splitShellSegments(command) {
 function shellPrograms(command) {
     const out = new Set();
     for (const raw of splitShellSegments(command)) {
-        const words = raw.trim().replace(/^[\s({]+/, '').split(/\s+/).filter(Boolean);
+        const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
-        // `$r = Invoke-WebRequest …` / `$r=Invoke-WebRequest …` / `FOO=bar cmd …`
+        // `$r = Invoke-WebRequest …` / `$r=Invoke-WebRequest …` / `FOO=bar cmd …` / `$t = (gcloud …)`
         while (i < words.length) {
             const w = words[i];
+            // Grouping before the program: `( gcloud`, `{ gcloud`, `(gcloud` — the program is inside.
+            if (/^[({]+$/.test(w)) {
+                i++;
+                continue;
+            }
+            if (/^[({]/.test(w)) {
+                words[i] = w.replace(/^[({]+/, '');
+                continue;
+            }
             if (/^\$[\w:.]+$/.test(w) && words[i + 1] && /^[+-]?=$/.test(words[i + 1])) {
                 i += 2;
                 continue;
@@ -825,10 +844,32 @@ function shellPrograms(command) {
                 i++;
                 continue;
             }
+            if (SHELL_BODY_LEADS.test(w)) {
+                i++;
+                continue;
+            }
+            if (SHELL_CONTROL_WORDS.test(w)) {
+                // `if (cond) { body }` / `foreach ($x in $y) { body }` / `else { body }`: the program
+                // runs in the body, so skip to the first `{` and read on from there.
+                const open = words.findIndex((word, index) => index > i && word.includes('{'));
+                if (open < 0) {
+                    i = words.length;
+                    break;
+                }
+                const rest = words[open].slice(words[open].indexOf('{') + 1);
+                if (rest) {
+                    words[open] = rest;
+                    i = open;
+                }
+                else {
+                    i = open + 1;
+                }
+                continue;
+            }
             break;
         }
         const lead = words[i];
-        if (!lead || /^[$@(){}\]\[|&;<>#'"`-]/.test(lead) || /^(if|then|else|elif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|switch|break|continue)$/i.test(lead))
+        if (!lead || /^[$@(){}\]\[|&;<>#'"`-]/.test(lead) || SHELL_CONTROL_WORDS.test(lead))
             continue;
         const name = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop().replace(/\.(exe|cmd|bat|ps1|sh)$/i, '').toLowerCase();
         if (name)

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.1"
+  "version": "1.35.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.1",
+  "version": "1.35.2",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {