fullcourtdefense-cli 1.35.2 → 1.35.5

package/dist/actionPolicyEngine.js

@@ -6945,6 +6945,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
   if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
+  if (allowWordSlug && /[/.]/.test(token) && token.split(/[/.]/).length >= 2 && token.split(/[/.]/).every((part) => /^[A-Za-z][a-z]*(?:[A-Z][a-z0-9]*)*$/.test(part))) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
   if (allowWordSlug && /^[a-z]+(?:-[a-z]+)+(?:-\d+)?$/.test(token)) return false;
@@ -7033,7 +7034,7 @@ function hasSecretLikeValue(value) {
   return detectSecretKind(value) !== "none";
 }
 var PII_EMAIL_RE = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-var PII_EMAIL_IGNORE_RE = /(?:@(?:example\.(?:com|org|net)|test\.[a-z]+|localhost(?:\.[a-z]+)?|[\w.-]*\.(?:invalid|test|local|localdomain|example)|users\.noreply\.github\.com|noreply\.[\w.-]+)$|^(?:no-?reply|noreply|do-?not-?reply|test\d*|example|user\d*|admin|root|foo|bar|baz|someone|somebody|you|me|name|first\.last|john\.doe|jane\.doe|email)@)/i;
+var PII_EMAIL_IGNORE_RE = /(?:@(?:example\.(?:com|org|net)|test\.[a-z]+|localhost(?:\.[a-z]+)?|[\w.-]*\.(?:invalid|test|local|localdomain|example)|users\.noreply\.github\.com|noreply\.[\w.-]+|[\w.-]*\.gserviceaccount\.com|[\w.-]*\.svc\.id\.goog)$|^(?:no-?reply|noreply|do-?not-?reply|test\d*|example|user\d*|admin|root|foo|bar|baz|someone|somebody|you|me|name|first\.last|john\.doe|jane\.doe|email)@)/i;
 var PII_PHONE_RE = /(?:^|[^\w.@/:-])(\+?\(?\d{1,4}\)?[\s-]\(?\d{2,4}\)?[\s-]\d{2,4}(?:[\s-]\d{2,4}){0,2})(?![\w.@/:-])/g;
 function hasPiiLikeValue(raw) {
   if (!raw) return false;
@@ -7171,7 +7172,9 @@ function extractUrl(args, _argsText) {
     if (typeof raw !== "string") continue;
     const shellField = ["command", "cmd", "script", "input"].includes(field);
     const value = shellField ? splitShellSegments(shellUrlActionText(raw)).map(withoutUnattributedJavaScriptUrls).map(withoutGhMetadataProse).join("\n") : raw;
-    const firstUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0] || text.match(/\b(?:s3|gs|ftp|sftp|smb):\/\/[^\s"'<>`]+/i)?.[0];
+    const firstWebUrl = (text) => text.match(/https?:\/\/[^\s"'<>`]+/i)?.[0];
+    const firstStorageUrl = (text) => text.match(/\b(?:s3|gs|az|ftp|sftp|smb):\/\/[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[^\s"'<>`]*)?/i)?.[0];
+    const firstUrl = (text) => firstWebUrl(text) || firstStorageUrl(text);
     const outboundUrls = shellField ? splitShellSegments(value).filter((segment) => /^(?:curl(?:\.exe)?|wget(?:\.exe)?|invoke-restmethod|invoke-webrequest|irm|iwr)$/i.test(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write").map(firstUrl).filter((url) => Boolean(url)) : [];
     const externalOutbound = outboundUrls.find((url) => {
       try {
@@ -7180,7 +7183,8 @@ function extractUrl(args, _argsText) {
         return false;
       }
     });
-    const found = externalOutbound || outboundUrls[0] || firstUrl(shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)).join("\n") : value);
+    const networkSegments = shellField ? segmentsThatMayReachNetwork(splitShellSegments(value)) : [value];
+    const found = externalOutbound || outboundUrls[0] || firstWebUrl(networkSegments.join("\n")) || (shellField ? firstStorageUrl(networkSegments.filter((segment, index, all) => storageUriIsDestination(segment, index, all)).join("\n")) : void 0) || firstStorageUrl(networkSegments.join("\n"));
     if (found) return found;
   }
   return "";
@@ -7827,6 +7831,24 @@ function shellSegmentLead(segment) {
 }
 var PS_SESSION_VARIABLE_ASSIGN_RE = /^\s*\$(?:psdefaultparametervalues|psmodulepath|profile|executioncontext|env:(?:path|pathext|psmodulepath))\s*(?:\[[^\]]*\]\s*)?(?:\+?=)/i;
 var PS_VALUE_EXECUTOR_RE = /\b(?:invoke-expression|iex|invoke-command|icm|start-process|saps|invoke-item|ii)\b|&\s*[$(]|\.\s*invoke\s*\(/i;
+var PS_VALUE_LEAD_RE = /^\$(?:env:)?\w+(?:\.\w+|\[\d+\])*$/;
+var PS_BLOCK_STAGE_LEADS = /* @__PURE__ */ new Set(["foreach-object", "foreach", "%", "where-object", "where", "?"]);
+function classifyPipelineStage(stage, depth) {
+  const trimmed = stage.trim();
+  if (!trimmed) return "read";
+  if (isPowerShellReadFormatter(trimmed)) return "read";
+  const lead = shellSegmentLead(trimmed);
+  if (PS_BLOCK_STAGE_LEADS.has(lead) && depth < 3) {
+    const open = trimmed.indexOf("{");
+    const close = trimmed.lastIndexOf("}");
+    if (open >= 0 && close > open) {
+      const rest = maskQuotedSpans(trimmed.slice(0, open) + trimmed.slice(close + 1));
+      if (!/^\s*(?:foreach-object|foreach|%|where-object|where|\?)\s*(?:-process\s*)?\s*$/i.test(rest)) return "SHELL";
+      return classifyShellCommandOperation(trimmed.slice(open + 1, close), depth + 1);
+    }
+  }
+  return classifyShellSegment(trimmed, depth + 1);
+}
 function isInertValueExpression(raw) {
   const masked = maskQuotedSpans(raw);
   if (/\$\(|`|&\s*[$(\w"']|[|<>]/.test(masked) || PS_VALUE_EXECUTOR_RE.test(masked)) return false;
@@ -7843,8 +7865,12 @@ function classifyShellSegment(segment, depth = 0) {
   if (!raw) return "read";
   if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
   const lead = shellSegmentLead(segment);
-  if ((/^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
-  if (SHELL_NEUTRAL_BUILTINS.has(lead) || /^\$env:[\w]+$/.test(lead) || /^\$\w+$/.test(lead)) return "read";
+  if (PS_VALUE_LEAD_RE.test(lead) && PS_VALUE_EXECUTOR_RE.test(maskQuotedSpans(raw))) return "SHELL";
+  if (SHELL_NEUTRAL_BUILTINS.has(lead)) return "read";
+  if (PS_VALUE_LEAD_RE.test(lead)) {
+    const stages = splitShellSegments(raw, true).slice(1);
+    return worstShellOp(stages.map((stage) => classifyPipelineStage(stage, depth)), "read");
+  }
   if (isInertValueExpression(raw)) return "read";
   const rawLower = raw.toLowerCase();
   const sqlClient = SHELL_SQL_CLIENTS.has(lead) || /\|\s*(?:sudo\s+)?(?:psql|mysql|mariadb|sqlcmd|sqlite3|mongosh?|clickhouse-client|bq|cockroach|usql)\b/.test(rawLower);
@@ -7896,7 +7922,26 @@ function classifyShellWords(masked, raw, lead) {
   if (lead === "git" && /\bgit\s+(?:status|diff|log|show|blame|clone|fetch|pull|ls-files|remote|branch(?!\s+-[dD])|describe|rev-parse|stash\s+(?:list|show)|tag$)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+(?:pr|issue|repo|run|release|workflow)\s+(?:view|list|status|checks|diff|download)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+auth\s+status\b/.test(value) && !/--show-token|\s-t\b/.test(value)) return "read";
-  if (/^(?:gcloud\s+run\s+services\s+(?:describe|logs\s+read)|kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
+  if (lead === "gh" && /\bgh\s+api(?=\s|$)/.test(value)) {
+    const method = /(?:\s-x|\s--method)[\s=]+["']?([a-z]+)/i.exec(segment);
+    const hasField = /\s(?:-f|-F|--field|--raw-field|--input)(?:[\s=]|$)/.test(segment);
+    if (method && method[1].toUpperCase() !== "GET" || hasField) return "write";
+    const header = /\s(?:-H|--header)(?:[\s=]|$)/.exec(segment);
+    if (header && /\$\(|`|\$env:|\(\s*[A-Za-z][\w-]*\s/.test(segment.slice(header.index))) return "write";
+    return pipesIntoInterpreter ? "SHELL" : "read";
+  }
+  const gcloudVerb = gcloudVerbWord(value);
+  if (gcloudVerb) {
+    if (GCLOUD_READ_VERB_RE.test(gcloudVerb)) {
+      if (pipesIntoInterpreter) return "SHELL";
+      const redirect = value.match(/(?:^|[^>0-9])>{1,2}\s*([^\s&|;]+)/);
+      if (redirect && !/^\/dev\/null$|^nul$|^\$null$/i.test(redirect[1])) return "write";
+      return "read";
+    }
+    if (gcloudVerb === "delete") return "DELETE";
+    if (GCLOUD_WRITE_VERB_RE.test(gcloudVerb)) return pipesIntoInterpreter ? "SHELL" : "write";
+  }
+  if (/^(?:kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
   if (/\b(rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r|del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
     return isWorkspaceScopedRemoval(segment) ? "write" : "DELETE";
   }
@@ -7927,6 +7972,35 @@ function classifyShellWords(masked, raw, lead) {
   if (SHELL_BLOCK_STRUCTURE_RE.test(value)) return "read";
   return "SHELL";
 }
+var GCLOUD_READ_VERB_RE = /^(?:describe|list|ls|get-iam-policy|get-value|get-ancestors|read|check|versions)$/;
+var GCLOUD_WRITE_VERB_RE = /^(?:create|update|patch|replace|enable|disable|deploy|apply|import|export|start|stop|restart|resume|suspend|scale|promote|migrate|rollback|add-[a-z-]+|remove-[a-z-]+|set-[a-z-]+|unset|clear|activate|revoke|copy)$/;
+function gcloudVerbWord(value) {
+  const tokens = value.split("|")[0].trim().split(/\s+/);
+  if (!/^gcloud(?:\.cmd|\.exe)?$/.test(tokens.shift() || "")) return null;
+  let depth = 0;
+  for (const token of tokens) {
+    if (token.startsWith("-")) continue;
+    if (GCLOUD_READ_VERB_RE.test(token) || GCLOUD_WRITE_VERB_RE.test(token) || token === "delete") return token;
+    if (!/^[a-z][a-z0-9-]*$/.test(token) || ++depth > 6) return null;
+  }
+  return null;
+}
+var CLOUD_CLI_LEAD_RE = /^(?:gcloud(?:\.cmd|\.exe)?|gsutil|aws|az)$/i;
+var STORAGE_TRANSFER_RE = /\b(?:aws\s+s3\s+(?:cp|sync|mv)|gsutil\s+(?:-m\s+)?(?:cp|rsync|mv)|gcloud(?:\.cmd|\.exe)?\s+storage\s+(?:cp|rsync|mv)|az\s+storage\s+blob\s+upload|scp|rsync|sftp)\b/i;
+var PIPES_INTO_INTERPRETER_RE = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/i;
+function storageUriIsDestination(segment, index = 0, all = []) {
+  const lead = shellSegmentLead(segment);
+  if (!CLOUD_CLI_LEAD_RE.test(lead)) return true;
+  const words = maskQuotedSpans(segment).toLowerCase();
+  if (PIPES_INTO_INTERPRETER_RE.test(words) || /\$\(|`|&\s*[$(]/.test(words) || PS_VALUE_EXECUTOR_RE.test(words)) return true;
+  if (STORAGE_TRANSFER_RE.test(words)) return true;
+  if (/^\s*(?:\$[\w:]+\s*=|[A-Za-z_]\w*=)/.test(segment) && all.slice(index + 1).some((later) => {
+    const laterWords = maskQuotedSpans(later).toLowerCase();
+    return PS_VALUE_EXECUTOR_RE.test(laterWords) || PIPES_INTO_INTERPRETER_RE.test(laterWords) || /(?:^|[\s;&|(])(?:sudo\s+)?(?:ba|z|da|k)?sh\s+-c\b|(?:^|[\s;&|(])(?:pwsh|powershell)(?:\.exe)?\s+-c(?:ommand)?\b|\beval\b|&\s*[$(]/.test(laterWords);
+  })) return true;
+  if (/^gcloud(?:\.cmd|\.exe)?\s+(?:--\S+\s+)*(?:alpha\s+|beta\s+)?[a-z-]+(?:\s+[a-z-]+){0,4}\s+export\b/.test(words.split("|")[0].trim())) return true;
+  return false;
+}
 var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
@@ -8386,11 +8460,17 @@ function inferBundledToolContext(toolName, args) {
       context["destination.domain"] = parsed.hostname;
       context["url.risk"] = hostType;
       const requestHasSecret = recordHttpRequestFacts(context, args, detectedUrl);
-      if (inbound) {
+      const storageResourceOnly = isCodeExecTool && /^(?:gs|s3|az):\/\//i.test(detectedUrl) && (() => {
+        const segments = splitShellSegments(commandText);
+        const bucket = (detectedUrl.match(/^[a-z0-9]+:\/\/[^/\s"'<>`]+/i) || [detectedUrl])[0].toLowerCase();
+        const carriers = segments.map((segment, index) => [segment, index]).filter(([segment]) => segment.toLowerCase().includes(bucket));
+        return carriers.length > 0 && carriers.every(([segment, index]) => !storageUriIsDestination(segment, index, segments));
+      })();
+      if (inbound || storageResourceOnly) {
         context["source.domain"] = parsed.hostname;
         context["source.type"] = hostType;
       }
-      if (!inbound || requestHasSecret) {
+      if (!inbound && !storageResourceOnly || requestHasSecret) {
         context["destination.type"] = hostType;
       }
     } catch {

package/dist/approvalPrompt.d.ts

@@ -16,7 +16,10 @@ export interface NativeDialogView {
     headline: string;
     subtitle: string;
     kind?: string;
+    /** The action: the whole script when the explanation carried it, else the short "What" line. */
     action?: string;
+    /** Plain-words line per step of a shell script ("Exports Firestore data … to storage bucket …"). */
+    steps: string[];
     policy?: string;
     scope?: string;
     agent?: string;

package/dist/approvalPrompt.js

@@ -12,6 +12,8 @@ function line(value, limit) {
     const head = Math.ceil((limit - 3) * 0.6);
     return `${text.slice(0, head)} … ${text.slice(-(limit - head - 3))}`;
 }
+/** The full script is shown in a scrolling box; this only guards against a runaway payload. */
+const MAX_DIALOG_SCRIPT = 6000;
 const CEILING_NOTE_RE = /\s*This policy is set to Block[.;]\s*(?:Because it is not marked "Hard block", your workstation requires your approval before continuing\.|on a developer workstation it asks you instead\.)?\s*(?:An admin can (?:review the matching rule and its scope in the console|mark it "Hard block" in the console to stop this without asking)\.)?/;
 const CEILING_NOTE_SHORT = 'set to Block; on your workstation it asks you first.';
 /** Parse the `Rule:` line the block explanation writes into the name the console lists and its scope. */
@@ -39,6 +41,20 @@ function promptFacts(reason) {
     const facts = { agent, ide: field('IDE') };
     if (rule)
         Object.assign(facts, ruleParts(rule));
+    const script = field('Script');
+    if (script)
+        facts.script = script.length > MAX_DIALOG_SCRIPT ? `${script.slice(0, MAX_DIALOG_SCRIPT - 1)}…` : script;
+    const doesAt = rows.findIndex(row => /^Does:\s*$/.test(row));
+    if (doesAt >= 0) {
+        const steps = [];
+        for (const row of rows.slice(doesAt + 1)) {
+            if (!row.startsWith('- '))
+                break;
+            steps.push(row.slice(2).trim());
+        }
+        if (steps.length)
+            facts.steps = steps;
+    }
     if (what) {
         // summarizeAction ends with the kind in parentheses: "… (shell command)".
         const kind = /^(.*)\s\(([a-z][a-z /-]{2,30})\)$/i.exec(what);
@@ -94,7 +110,9 @@ function nativeDialogView(reason, options = {}) {
                 ? 'A security policy paused this action for an admin or manager.'
                 : 'A security policy paused this action. Review the details and choose what to do next.',
         kind: f.kind,
-        action: f.action ? line(f.action, 280) : undefined,
+        // The whole script when we have it (the box scrolls); the short line otherwise.
+        action: f.script ? f.script.replace(/ ⏎ /g, '\n') : f.action ? line(f.action, 280) : undefined,
+        steps: (f.steps || []).slice(0, 14).map(step => line(step, 220)),
         policy: f.policy ? line(f.policy, 160) : undefined,
         scope: f.scope ? line(f.scope, 220) : undefined,
         agent: f.agent ? line(f.agent, 80) : undefined,
@@ -117,6 +135,7 @@ function nativeApprovalMessage(reason, options = {}) {
         f.policy ? `Policy:  ${line(f.policy, 160)}` : '',
         f.scope ? `         ${line(f.scope, 200)}` : '',
         f.action ? `Action:  ${f.kind ? `${f.kind} — ` : ''}${line(f.action, 230)}` : '',
+        ...(f.steps || []).slice(0, 6).map((step, index) => `${index === 0 ? 'Does:    ' : '         '}${index + 1}. ${line(step, 160)}`),
         f.agent ? `Agent: ${line(f.agent, 80)}` : '',
         f.ide ? `IDE: ${line(f.ide, 40)}` : '',
         f.tool ? `Tool: ${line(f.tool, 230)}` : '',

package/dist/blockExplanation.js

@@ -19,7 +19,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.summarizeAction = summarizeAction;
 exports.buildBlockExplanation = buildBlockExplanation;
 exports.oneLineExplanation = oneLineExplanation;
+const commandNarrative_1 = require("./commandNarrative");
 const MAX_WHAT = 160;
+/** The full script travels to the approval dialog; anything longer is still cut, but far later. */
+const MAX_SCRIPT = 6000;
+/** Newlines flattened so the multi-line explanation grammar (one `Field:` per row) still parses. */
+function scriptLine(command) {
+    const flat = command.replace(/\r?\n/g, ' ⏎ ').trim();
+    return flat.length > MAX_SCRIPT ? `${flat.slice(0, MAX_SCRIPT - 1)}…` : flat;
+}
 function str(v) {
     return typeof v === 'string' && v.trim() ? v : undefined;
 }
@@ -229,9 +237,18 @@ function buildBlockExplanation(input) {
     if (input.note)
         why = `${why} ${input.note}`.trim();
     const headline = headlineFor(input.outcome, noun);
+    // Shell / terminal: say what each step of the script does, in plain words,
+    // and carry the whole script when the short "What" line had to cut it.
+    const command = (input.event === 'shell' || input.event === 'terminal')
+        ? (str(input.toolArgs?.command) || str(input.toolArgs?.cmd) || str(input.toolArgs?.commandLine) || str(input.toolArgs?.script))
+        : undefined;
+    const steps = command ? (0, commandNarrative_1.describeShellCommandLines)(command) : [];
+    const script = command && command.replace(/\s+/g, ' ').trim().length > MAX_WHAT - 1 ? scriptLine(command) : undefined;
     const userMessage = [
         headline,
         `What:    ${what}`,
+        ...(steps.length ? ['Does:', ...steps.map(step => `  - ${step}`)] : []),
+        ...(script ? [`Script:  ${script}`] : []),
         `Rule:    ${rule}`,
         `Why:     ${why}`,
         stepsTitle(input.outcome),

package/dist/commandNarrative.d.ts

@@ -0,0 +1,29 @@
+/**
+ * What a shell script DOES, one plain-words line per step — for the approval
+ * dialog and the IDE message. A developer asked to approve
+ *
+ *   $prefix="gs://b/prod-export"; gcloud firestore export $prefix --project acme-prod; gcloud firestore import $prefix --project acme-staging
+ *
+ * should read "Exports Firestore data from project acme-prod to bucket b ·
+ * Imports Firestore data into project acme-staging from bucket b", not a
+ * truncated command line.
+ *
+ * Fixed templates only, keyed on the program and its verb — no model, no
+ * scoring, nothing that could decide anything. This module never influences a
+ * verdict; it only words one. A program the grammar does not know is reported
+ * as exactly that ("Runs `foo bar`"), never guessed. Pure: no I/O.
+ */
+export interface CommandStep {
+    /** The segment as written (trimmed). */
+    segment: string;
+    /** Plain-words description of what it does. */
+    text: string;
+    /** The grammar recognised the program and its verb. */
+    known: boolean;
+}
+/** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
+export declare function splitCommandSteps(command: string): string[];
+/** One plain-words line per step, in order. */
+export declare function describeShellCommand(command: string): CommandStep[];
+/** The step lines as the explanation prints them (`- …`). */
+export declare function describeShellCommandLines(command: string): string[];