fullcourtdefense-cli 1.35.1 → 1.35.3

package/dist/actionPolicyEngine.js

@@ -6925,6 +6925,13 @@ function plausibleTokenBody(body) {
 }
 var PLACEHOLDER_WORD_RE = /example|sample|placeholder|redacted|dummy|changeme|fake|xxxx/i;
 var REPEATED_CHUNK_RE = /(.{3,})\1{2,}/;
+var PUBLISHED_EXAMPLE_VALUES = /* @__PURE__ */ new Set([
+  "JBSWY3DPEHPK3PXP",
+  "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ",
+  "12345678901234567890",
+  ["AKIA", "IOSFODNN7", "EXAMPLE"].join(""),
+  ["wJalrXUtnFEMI/K7MDENG/bPxRfiCY", "EXAMPLEKEY"].join("")
+]);
 function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (token.length < 24 || token.length > 512) return false;
   const assignment = /^-{0,2}[A-Za-z_][\w.-]*=(.+)$/.exec(token);
@@ -6933,11 +6940,12 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (!/^[A-Za-z0-9._~+/=-]+$/.test(token)) return false;
   if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(token)) return false;
   if (/^[0-9a-f]+$/i.test(token)) return false;
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token)) return false;
+  if (/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token) && (token.length === 36 || /[^0-9a-f]/i.test(token[token.length - 37] || ""))) return false;
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
   if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
+  if (allowWordSlug && /[/.]/.test(token) && token.split(/[/.]/).length >= 2 && token.split(/[/.]/).every((part) => /^[A-Za-z][a-z]*(?:[A-Z][a-z0-9]*)*$/.test(part))) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
   if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token)) return false;
@@ -6959,6 +6967,7 @@ function looksLikeSecretValue(raw) {
   if (value.length < 8) return false;
   if (/^[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]/.test(value)) return false;
   if (/^--?[A-Za-z]/.test(value)) return false;
+  if (PUBLISHED_EXAMPLE_VALUES.has(value)) return false;
   if (SECRET_PLACEHOLDER_RE.test(value)) return false;
   if (SECRET_CODE_EXPR_RE.test(value)) return false;
   if (/^\/(?:[\[(^\\.]|.*\/[gimsuy]*$)/.test(value) || /[\[({]/.test(value)) return false;
@@ -7025,7 +7034,7 @@ function hasSecretLikeValue(value) {
   return detectSecretKind(value) !== "none";
 }
 var PII_EMAIL_RE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-var PII_EMAIL_IGNORE_RE = /(?:@(?:example\.(?:com|org|net)|test\.[a-z]+|localhost(?:\.[a-z]+)?|[\w.-]*\.(?:invalid|test|local|localdomain|example)|users\.noreply\.github\.com|noreply\.[\w.-]+)$|^(?:no-?reply|noreply|do-?not-?reply|test\d*|example|user\d*|admin|root|foo|bar|baz|someone|somebody|you|me|name|first\.last|john\.doe|jane\.doe|email)@)/i;
+var PII_EMAIL_IGNORE_RE = /(?:@(?:example\.(?:com|org|net)|test\.[a-z]+|localhost(?:\.[a-z]+)?|[\w.-]*\.(?:invalid|test|local|localdomain|example)|users\.noreply\.github\.com|noreply\.[\w.-]+|[\w.-]*\.gserviceaccount\.com|[\w.-]*\.svc\.id\.goog)$|^(?:no-?reply|noreply|do-?not-?reply|test\d*|example|user\d*|admin|root|foo|bar|baz|someone|somebody|you|me|name|first\.last|john\.doe|jane\.doe|email)@)/i;
 var PII_PHONE_RE = /(?:^|[^\w.@/:-])(\+?\(?\d{1,4}\)?[\s-]\(?\d{2,4}\)?[\s-]\d{2,4}(?:[\s-]\d{2,4}){0,2})(?![\w.@/:-])/g;
 function hasPiiLikeValue(raw) {
   if (!raw) return false;
@@ -7163,7 +7172,9 @@ function extractUrl(args, _argsText) {
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
     const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).map(withoutGhMetadataProse).join("\n") : raw;
-    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
+    const firstWebUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0];
+    const firstStorageUrl = (text) => text.match(/\b(?:s3|gs|az|ftp|sftp|smb):\/\/[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[^\s"'<>`]*)?/i)?.[0];
+    const firstUrl = (text) => firstWebUrl(text) || firstStorageUrl(text);
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
       try {
@@ -7172,7 +7183,8 @@ function extractUrl(args, _argsText) {
         return false;
       }
     });
-    const found = externalOutbound || outboundUrls[0] || firstUrl(shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)).join("\n") : value);
+    const networkSegments = shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)) : [value];
+    const found = externalOutbound || outboundUrls[0] || firstWebUrl(networkSegments.join("\n")) || (shellField ? firstStorageUrl(networkSegments.filter((segment, index, all) => storageUriIsDestination(segment, index, all)).join("\n")) : void 0) || firstStorageUrl(networkSegments.join("\n"));
     if (found) return found;
   }
   return "";
@@ -7819,6 +7831,24 @@ function shellSegmentLead(segment) {
 }
 var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
 var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
+var PS_VALUE_LEAD_RE = /^\$(?:env:)?\w+(?:\.\w+|\[\d+\])*$/;
+var PS_BLOCK_STAGE_LEADS = /* @__PURE__ */ new Set(["foreach-object", "foreach", "%", "where-object", "where", "?"]);
+function classifyPipelineStage(stage, depth) {
+  const trimmed = stage.trim();
+  if (!trimmed) return "read";
+  if (isPowerShellReadFormatter(trimmed)) return "read";
+  const lead = shellSegmentLead(trimmed);
+  if (PS_BLOCK_STAGE_LEADS.has(lead) && depth < 3) {
+    const open = trimmed.indexOf("{");
+    const close = trimmed.lastIndexOf("}");
+    if (open >= 0 && close > open) {
+      const rest = maskQuotedSpans(trimmed.slice(0, open) + trimmed.slice(close + 1));
+      if (!/^\s*(?:foreach-object|foreach|%|where-object|where|\?)\s*(?:-process\s*)?\s*$/i.test(rest)) return "SHELL";
+      return classifyShellCommandOperation(trimmed.slice(open + 1, close), depth + 1);
+    }
+  }
+  return classifyShellSegment(trimmed, depth + 1);
+}
 function isInertValueExpression(raw) {
   const masked = maskQuotedSpans(raw);
   if (/\$\(|`|&\s*[$(\w"']|[|<>]/.test(masked) || PS_VALUE_EXECUTOR_RE.test(masked)) return false;
@@ -7835,8 +7865,12 @@ function classifyShellSegment(segment, depth = 0) {
   if (!raw) return "read";
   if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
   const lead = shellSegmentLead(segment);
-  if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
-  if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
+  if (PS_VALUE_LEAD_RE.test(lead) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
+  if (SHELL_NEUTRAL_BUILTINS.has(lead)) return "read";
+  if (PS_VALUE_LEAD_RE.test(lead)) {
+    const stages = splitShellSegments(raw, true).slice(1);
+    return worstShellOp(stages.map((stage) => classifyPipelineStage(stage, depth)), "read");
+  }
   if (isInertValueExpression(raw)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
@@ -7888,7 +7922,26 @@ function classifyShellWords(masked, raw, lead) {
   if (lead === "git" && /\bgit\s+(?:status|diff|log|show|blame|clone|fetch|pull|ls-files|remote|branch(?!\s+-[dD])|describe|rev-parse|stash\s+(?:list|show)|tag$)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+(?:pr|issue|repo|run|release|workflow)\s+(?:view|list|status|checks|diff|download)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+auth\s+status\b/.test(value) && !/--show-token|\s-t\b/.test(value)) return "read";
-  if (/^(?:gcloud\s+run\s+services\s+(?:describe|logs\s+read)|kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
+  if (lead === "gh" && /\bgh\s+api(?=\s|$)/.test(value)) {
+    const method = /(?:\s-x|\s--method)[\s=]+["']?([a-z]+)/i.exec(segment);
+    const hasField = /\s(?:-f|-F|--field|--raw-field|--input)(?:[\s=]|$)/.test(segment);
+    if (method && method[1].toUpperCase() !== "GET" || hasField) return "write";
+    const header = /\s(?:-H|--header)(?:[\s=]|$)/.exec(segment);
+    if (header && /\$\(|`|\$env:|\(\s*[A-Za-z][\w-]*\s/.test(segment.slice(header.index))) return "write";
+    return pipesIntoInterpreter ? "SHELL" : "read";
+  }
+  const gcloudVerb = gcloudVerbWord(value);
+  if (gcloudVerb) {
+    if (GCLOUD_READ_VERB_RE.test(gcloudVerb)) {
+      if (pipesIntoInterpreter) return "SHELL";
+      const redirect = value.match(/(?:^|[^>0-9])>{1,2}\s*([^\s&|;]+)/);
+      if (redirect && !/^\/dev\/null$|^nul$|^\$null$/i.test(redirect[1])) return "write";
+      return "read";
+    }
+    if (gcloudVerb === "delete") return "DELETE";
+    if (GCLOUD_WRITE_VERB_RE.test(gcloudVerb)) return pipesIntoInterpreter ? "SHELL" : "write";
+  }
+  if (/^(?:kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
   if (/\b(rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r|del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
     return isWorkspaceScopedRemoval(segment) ? "write" : "DELETE";
   }
@@ -7919,6 +7972,35 @@ function classifyShellWords(masked, raw, lead) {
   if (SHELL_BLOCK_STRUCTURE_RE.test(value)) return "read";
   return "SHELL";
 }
+var GCLOUD_READ_VERB_RE = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check|versions)$/;
+var GCLOUD_WRITE_VERB_RE = /^(?:create|update|patch|replace|enable|disable|deploy|apply|import|export|start|stop|restart|resume|suspend|scale|promote|migrate|rollback|add-[a-z-]+|remove-[a-z-]+|set-[a-z-]+|unset|clear|activate|revoke|copy)$/;
+function gcloudVerbWord(value) {
+  const tokens = value.split("|")[0].trim().split(/\s+/);
+  if (!/^gcloud(?:\.cmd|\.exe)?$/.test(tokens.shift() || "")) return null;
+  let depth = 0;
+  for (const token of tokens) {
+    if (token.startsWith("-")) continue;
+    if (GCLOUD_READ_VERB_RE.test(token) || GCLOUD_WRITE_VERB_RE.test(token) || token === "delete") return token;
+    if (!/^[a-z][a-z0-9-]*$/.test(token) || ++depth > 6) return null;
+  }
+  return null;
+}
+var CLOUD_CLI_LEAD_RE = /^(?:gcloud(?:\.cmd|\.exe)?|gsutil|aws|az)$/i;
+var STORAGE_TRANSFER_RE = /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/i;
+var PIPES_INTO_INTERPRETER_RE = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/i;
+function storageUriIsDestination(segment, index = 0, all = []) {
+  const lead = shellSegmentLead(segment);
+  if (!CLOUD_CLI_LEAD_RE.test(lead)) return true;
+  const words = maskQuotedSpans(segment).toLowerCase();
+  if (PIPES_INTO_INTERPRETER_RE.test(words) || /\$\(|`|&\s*[$(]/.test(words) || PS_VALUE_EXECUTOR_RE.test(words)) return true;
+  if (STORAGE_TRANSFER_RE.test(words)) return true;
+  if (/^\s*(?:\$[\w:]+\s*=|[A-Za-z_]\w*=)/.test(segment) && all.slice(index + 1).some((later) => {
+    const laterWords = maskQuotedSpans(later).toLowerCase();
+    return PS_VALUE_EXECUTOR_RE.test(laterWords) || PIPES_INTO_INTERPRETER_RE.test(laterWords) || /(?:^|[\s;&|(])(?:sudo\s+)?(?:ba|z|da|k)?sh\s+-c\b|(?:^|[\s;&|(])(?:pwsh|powershell)(?:\.exe)?\s+-c(?:ommand)?\b|\beval\b|&\s*[$(]/.test(laterWords);
+  })) return true;
+  if (/^gcloud(?:\.cmd|\.exe)?\s+(?:--\S+\s+)*(?:alpha\s+|beta\s+)?[a-z-]+(?:\s+[a-z-]+){0,4}\s+export\b/.test(words.split("|")[0].trim())) return true;
+  return false;
+}
 var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
@@ -8093,6 +8175,16 @@ function provenPowerShellReadSequence(command) {
   }
   return requests > 0;
 }
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host === "0.0.0.0" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+var RAW_NETWORK_PROGRAM_RE = /(?:^|[\s;&|(`])(?:nc|ncat|netcat|socat|ssh|scp|sftp|rsync|telnet|ftp|tftp|mail|mailx|sendmail|msmtp|openssl\s+s_client)\b/i;
+function commandStaysOnLoopback(command) {
+  if (!command || RAW_NETWORK_PROGRAM_RE.test(command)) return false;
+  const hosts = [...command.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/(?:[^/\s@'"]*@)?([^/\s:'"?#]+)/gi)].map((match) => match[1]);
+  return hosts.length > 0 && hosts.every(isLoopbackHost);
+}
 function isInternalHost(hostname) {
   const host = hostname.toLowerCase();
   if (!host || host === "localhost" || host === "::1" || host.endsWith(".local") || host.endsWith(".internal")) return true;
@@ -8133,6 +8225,9 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   const matchText = buildOperationMatchText(toolName, context);
   const toolCaps = toolCapabilities(toolName || context.toolName || "");
   const localFileContentAction = isLocalFileContentAction(toolName, operation, context);
+  const loopbackContentAction = context["destination.loopback"] === "true";
+  const ruleNamesDestination = (rule) => (rule.constraints || []).some((c) => c.field.startsWith("destination."));
+  const contentCeilingApplies = (rule) => ruleNeedsContentFact(rule) && (localFileContentAction || loopbackContentAction && !ruleNamesDestination(rule));
   const isBareInvocation = !!operation && operation.toLowerCase() === (toolName || "").toLowerCase();
   const isCodeExecTool = toolCaps.has("code_execution");
   const candidateOperations = isBareInvocation && declaredOperations.length > 0 && !isCodeExecTool ? [operation, ...declaredOperations] : [operation];
@@ -8187,7 +8282,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
       const constraintDesc = rule.constraints?.map((c) => `${c.field} ${c.operator} ${c.value}`).join(", ");
       const matchedRule = `${rule.operations.join("/")} \u2192 ${rule.verdict}${constraintDesc ? ` (${constraintDesc})` : ""}`;
       if (isMonitorStage) {
-        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction;
+        const wouldOnlyWarn = rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule);
         if ((rule.verdict === "block" || rule.verdict === "require_approval") && !wouldOnlyWarn) {
           const match = { policyId: policy.id, policyName: policy.name, verdict: rule.verdict, matchedRule };
           monitorMatches.push(match);
@@ -8205,13 +8300,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
         reason: `Action policy "${policy.name}": ${rule.operations.join("/")} ${rule.verdict === "block" ? "blocked" : rule.verdict === "require_approval" ? "requires approval" : rule.verdict}`,
         ...rule.verdict === "require_approval" ? { approval: resolveApprovalOptions(rule.approval) } : {}
       };
-      if (rule.verdict === "block" && policy.enforcement !== "hard" && ruleNeedsContentFact(rule) && localFileContentAction) {
+      if (rule.verdict === "block" && policy.enforcement !== "hard" && contentCeilingApplies(rule)) {
         matched = {
           ...matched,
           allowed: true,
           verdict: "log",
           loggedInsteadOfBlocked: true,
-          reason: `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)`
+          reason: localFileContentAction ? `${matched.reason} \u2014 recorded as a warning: this only touches a file on this machine and nothing leaves it (the same content leaving the machine still blocks; mark the policy Hard block to stop file edits too)` : `${matched.reason} \u2014 recorded as a warning: the destination is this machine (${context["destination.domain"]}) and nothing leaves it (the same content sent to an outside host still blocks; add a destination.type constraint to the rule to enforce on loopback too)`
         };
       }
       if (matched.verdict === "require_approval") {
@@ -8365,11 +8460,17 @@ function inferBundledToolContext(toolName, args) {
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
       const requestHasSecret = recordHttpRequestFacts(context, args, detectedUrl);
-      if (inbound) {
+      const storageResourceOnly = isCodeExecTool && /^(?:gs|s3|az):\/\//i.test(detectedUrl) && (() => {
+        const segments = splitShellSegments(commandText);
+        const bucket = (detectedUrl.match(/^[a-z0-9]+:\/\/[^/\s"'<>`]+/i) || [detectedUrl])[0].toLowerCase();
+        const carriers = segments.map((segment, index) => [segment, index]).filter(([segment]) => segment.toLowerCase().includes(bucket));
+        return carriers.length > 0 && carriers.every(([segment, index]) => !storageUriIsDestination(segment, index, segments));
+      })();
+      if (inbound || storageResourceOnly) {
         context["source.domain"] = parsed.hostname;
         context["source.type"] = hostType;
       }
-      if (!inbound || requestHasSecret) {
+      if (!inbound && !storageResourceOnly || requestHasSecret) {
         context["destination.type"] = hostType;
       }
     } catch {
@@ -8388,6 +8489,10 @@ function inferBundledToolContext(toolName, args) {
     context.amount = String(args.amount ?? args.price ?? args.total);
   }
   context["action.kind"] = isCodeExecTool || toolNameLower === "shell" ? "shell" : context.query !== void 0 && operation !== toolName && /^(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|SHOW|DESCRIBE|EXPLAIN)$/.test(operation) ? "database" : ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].includes(methodArg) ? "http" : context.path !== void 0 && (operation === "read" || operation === "write" || LOCAL_FILE_ACTION_RE.test(toolName) || FILE_REMOVAL_TOOL_RE.test(toolName)) ? "file" : "tool";
+  delete context["destination.loopback"];
+  if (context["destination.domain"] && isLoopbackHost(context["destination.domain"]) && (!isCodeExecTool || commandStaysOnLoopback(commandText))) {
+    context["destination.loopback"] = "true";
+  }
   delete context["destination.repository"];
   if (isCodeExecTool) {
     const repository = explicitGitHubWriteRepository(String(args.command || args.cmd || args.code || args.script || args.input || ""));

package/dist/approvalPrompt.d.ts

@@ -16,7 +16,10 @@ export interface NativeDialogView {
     headline: string;
     subtitle: string;
     kind?: string;
+    /** The action: the whole script when the explanation carried it, else the short "What" line. */
     action?: string;
+    /** Plain-words line per step of a shell script ("Exports Firestore data … to storage bucket …"). */
+    steps: string[];
     policy?: string;
     scope?: string;
     agent?: string;

package/dist/approvalPrompt.js

@@ -12,6 +12,8 @@ function line(value, limit) {
     const head = Math.ceil((limit - 3) * 0.6);
     return `${text.slice(0, head)} … ${text.slice(-(limit - head - 3))}`;
 }
+/** The full script is shown in a scrolling box; this only guards against a runaway payload. */
+const MAX_DIALOG_SCRIPT = 6000;
 const CEILING_NOTE_RE = /\s*This policy is set to Block[.;]\s*(?:Because it is not marked "Hard block", your workstation requires your approval before continuing\.|on a developer workstation it asks you instead\.)?\s*(?:An admin can (?:review the matching rule and its scope in the console|mark it "Hard block" in the console to stop this without asking)\.)?/;
 const CEILING_NOTE_SHORT = 'set to Block; on your workstation it asks you first.';
 /** Parse the `Rule:` line the block explanation writes into the name the console lists and its scope. */
@@ -39,6 +41,20 @@ function promptFacts(reason) {
     const facts = { agent, ide: field('IDE') };
     if (rule)
         Object.assign(facts, ruleParts(rule));
+    const script = field('Script');
+    if (script)
+        facts.script = script.length > MAX_DIALOG_SCRIPT ? `${script.slice(0, MAX_DIALOG_SCRIPT - 1)}…` : script;
+    const doesAt = rows.findIndex(row => /^Does:\s*$/.test(row));
+    if (doesAt >= 0) {
+        const steps = [];
+        for (const row of rows.slice(doesAt + 1)) {
+            if (!row.startsWith('- '))
+                break;
+            steps.push(row.slice(2).trim());
+        }
+        if (steps.length)
+            facts.steps = steps;
+    }
     if (what) {
         // summarizeAction ends with the kind in parentheses: "… (shell command)".
         const kind = /^(.*)\s\(([a-z][a-z /-]{2,30})\)$/i.exec(what);
@@ -94,7 +110,9 @@ function nativeDialogView(reason, options = {}) {
                 ? 'A security policy paused this action for an admin or manager.'
                 : 'A security policy paused this action. Review the details and choose what to do next.',
         kind: f.kind,
-        action: f.action ? line(f.action, 280) : undefined,
+        // The whole script when we have it (the box scrolls); the short line otherwise.
+        action: f.script ? f.script.replace(/ ⏎ /g, '\n') : f.action ? line(f.action, 280) : undefined,
+        steps: (f.steps || []).slice(0, 14).map(step => line(step, 220)),
         policy: f.policy ? line(f.policy, 160) : undefined,
         scope: f.scope ? line(f.scope, 220) : undefined,
         agent: f.agent ? line(f.agent, 80) : undefined,
@@ -117,6 +135,7 @@ function nativeApprovalMessage(reason, options = {}) {
         f.policy ? `Policy:  ${line(f.policy, 160)}` : '',
         f.scope ? `         ${line(f.scope, 200)}` : '',
         f.action ? `Action:  ${f.kind ? `${f.kind} — ` : ''}${line(f.action, 230)}` : '',
+        ...(f.steps || []).slice(0, 6).map((step, index) => `${index === 0 ? 'Does:    ' : '         '}${index + 1}. ${line(step, 160)}`),
         f.agent ? `Agent: ${line(f.agent, 80)}` : '',
         f.ide ? `IDE: ${line(f.ide, 40)}` : '',
         f.tool ? `Tool: ${line(f.tool, 230)}` : '',

package/dist/blockExplanation.js

@@ -19,7 +19,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.summarizeAction = summarizeAction;
 exports.buildBlockExplanation = buildBlockExplanation;
 exports.oneLineExplanation = oneLineExplanation;
+const commandNarrative_1 = require("./commandNarrative");
 const MAX_WHAT = 160;
+/** The full script travels to the approval dialog; anything longer is still cut, but far later. */
+const MAX_SCRIPT = 6000;
+/** Newlines flattened so the multi-line explanation grammar (one `Field:` per row) still parses. */
+function scriptLine(command) {
+    const flat = command.replace(/\r?\n/g, ' ⏎ ').trim();
+    return flat.length > MAX_SCRIPT ? `${flat.slice(0, MAX_SCRIPT - 1)}…` : flat;
+}
 function str(v) {
     return typeof v === 'string' && v.trim() ? v : undefined;
 }
@@ -170,7 +178,10 @@ function buildBlockExplanation(input) {
         // "Blocked ..." reason must not turn a pending approval into a final denial.
         const reason = src.source === 'builtin' && (input.outcome === 'ask' || input.outcome === 'approval')
             ? src.reason.replace(/^Blocked\b/, 'Matched') : src.reason;
-        why = src.explanation ? `${reason} — ${src.explanation}` : reason;
+        // Catalog findings often carry the same words as reason and explanation
+        // ("…: gcloud access-token print." / "gcloud access-token print"); say it once.
+        const explanation = src.explanation?.trim().replace(/\.$/, '');
+        why = explanation && !reason.toLowerCase().includes(explanation.toLowerCase()) ? `${reason} — ${src.explanation}` : reason;
         unblock = [
             `Open the rule in the console: ${consoleLink}`,
             `An admin can set "${label}" to Ask the developer, Warn only, or Off — for everyone or only for ${input.developerName || 'this machine'}.`,
@@ -226,9 +237,18 @@ function buildBlockExplanation(input) {
     if (input.note)
         why = `${why} ${input.note}`.trim();
     const headline = headlineFor(input.outcome, noun);
+    // Shell / terminal: say what each step of the script does, in plain words,
+    // and carry the whole script when the short "What" line had to cut it.
+    const command = (input.event === 'shell' || input.event === 'terminal')
+        ? (str(input.toolArgs?.command) || str(input.toolArgs?.cmd) || str(input.toolArgs?.commandLine) || str(input.toolArgs?.script))
+        : undefined;
+    const steps = command ? (0, commandNarrative_1.describeShellCommandLines)(command) : [];
+    const script = command && command.replace(/\s+/g, ' ').trim().length > MAX_WHAT - 1 ? scriptLine(command) : undefined;
     const userMessage = [
         headline,
         `What:    ${what}`,
+        ...(steps.length ? ['Does:', ...steps.map(step => `  - ${step}`)] : []),
+        ...(script ? [`Script:  ${script}`] : []),
         `Rule:    ${rule}`,
         `Why:     ${why}`,
         stepsTitle(input.outcome),

package/dist/commandNarrative.d.ts

@@ -0,0 +1,29 @@
+/**
+ * What a shell script DOES, one plain-words line per step — for the approval
+ * dialog and the IDE message. A developer asked to approve
+ *
+ *   $prefix="gs://b/prod-export"; gcloud firestore export $prefix --project acme-prod; gcloud firestore import $prefix --project acme-staging
+ *
+ * should read "Exports Firestore data from project acme-prod to bucket b ·
+ * Imports Firestore data into project acme-staging from bucket b", not a
+ * truncated command line.
+ *
+ * Fixed templates only, keyed on the program and its verb — no model, no
+ * scoring, nothing that could decide anything. This module never influences a
+ * verdict; it only words one. A program the grammar does not know is reported
+ * as exactly that ("Runs `foo bar`"), never guessed. Pure: no I/O.
+ */
+export interface CommandStep {
+    /** The segment as written (trimmed). */
+    segment: string;
+    /** Plain-words description of what it does. */
+    text: string;
+    /** The grammar recognised the program and its verb. */
+    known: boolean;
+}
+/** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
+export declare function splitCommandSteps(command: string): string[];
+/** One plain-words line per step, in order. */
+export declare function describeShellCommand(command: string): CommandStep[];
+/** The step lines as the explanation prints them (`- …`). */
+export declare function describeShellCommandLines(command: string): string[];