fullcourtdefense-cli 1.35.2 → 1.35.5

package/dist/devConfirm.d.ts

@@ -95,19 +95,30 @@ export interface ConfirmedAction {
 }
 /**
  * WHAT an "Always allow" covers. Structural, parsed from the action — never the
- * command text or a pattern over it: the programs a shell line runs (all of them,
- * so `git push && gh pr create` and `gh pr view` are different sets), the MCP
+ * command text or a pattern over it: the real programs a shell line runs (so
+ * `git push && gh pr create` and `gh pr view` are different sets), the MCP
  * server + tool, the operation the engine derived, and the destination host when
- * the action reaches one. A grant for `gh` writing to `github.com` never covers
- * `curl` writing to `github.com`, nor `gh` writing to `gitlab.com`.
+ * the action reaches one. Pipeline cmdlets and generic shells (`cmd`,
+ * `powershell`, `bash -c`) are not programs — a grant for `gcloud` never
+ * becomes a grant for every command. A grant for `gh` writing to `github.com`
+ * never covers `curl` writing to `github.com`, nor `gh` writing to `gitlab.com`.
  */
 export interface GrantScope {
     /** Hook event: shell | mcp | file | read | prompt. */
     event: string;
     /** Shell: the IDE tool (Bash / shell). MCP: `mcp__<server>__<tool>`. Files: the tool. */
     toolName: string;
-    /** Shell only: sorted, de-duplicated leading programs of every segment. */
+    /**
+     * Shell only: sorted, de-duplicated real programs. Wrappers (`foreach-object`,
+     * `write-output`) and generic shells (`cmd`, `powershell`) are stripped; `cmd /c gcloud`
+     * is `{gcloud}`.
+     */
     programs?: string[];
+    /**
+     * Shell only: referenced script paths this line executes (`node scripts/x.js`).
+     * When present, "Always allow" is bound to these files, not every `node`.
+     */
+    scripts?: string[];
     /** Engine-derived operation (read / write / SHELL / DELETE / …). */
     operation: string;
     /** Host the action reaches (engine `destination.domain`), when any. */
@@ -277,16 +288,23 @@ export declare function rejectDeveloperConfirmation(event: string, toolName: str
  */
 export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): PendingConfirmation[];
 /**
- * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
- * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
- * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
- * program (pure block structure like `} catch {`) contributes nothing.
+ * The real programs a shell line runs — one per segment, wrappers (`sudo`,
+ * `env`) and `$var =` peeled off. Pipeline cmdlets and generic shells are not
+ * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
+ * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
+ * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
+ * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
+ * is stripped. Sorted and unique.
  */
 export declare function shellPrograms(command: string): string[];
+/** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
+export declare function splitLocalSafetyRuleIds(matchedRule?: string): string[] | undefined;
 /**
- * Does a live grant cover this action under this exact rule? Shell programs match by
- * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
- * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ * Does a live grant cover this action under this rule? Combined Local Safety
+ * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
+ * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
+ * Touch counts a use.
  *
  * `limits` are the caps in force NOW (rule + org ceiling). A grant older or wider than
  * they allow is ignored — tightening the org setting takes effect on the next action,
@@ -314,7 +332,6 @@ export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 export declare function revokeDeveloperGrants(key?: string): number;
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 export declare function describeGrantScope(scope: GrantScope): string;
-/** The scope a grant would have for this action — from engine facts, never from text. */
 export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
 /**
  * Is this exact action covered in the same session and policy context?

package/dist/devConfirm.js

@@ -55,6 +55,7 @@ exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
 exports.shellPrograms = shellPrograms;
+exports.splitLocalSafetyRuleIds = splitLocalSafetyRuleIds;
 exports.findDeveloperGrant = findDeveloperGrant;
 exports.recordDeveloperGrant = recordDeveloperGrant;
 exports.listDeveloperGrants = listDeveloperGrants;
@@ -91,6 +92,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const approvalPrompt_1 = require("./approvalPrompt");
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
  * the dialog, read at least the tool name and press a button; MCP clients that
@@ -163,7 +165,8 @@ function dialogCardHtml(view, options) {
 h1{margin:0 0 4px;font-size:22px}.sub{color:#64748b;margin:0 0 14px}
 .box{border:1px solid #e2e8f0;border-radius:12px;padding:12px 14px;margin:0 0 10px;background:#f8fafc}
 h2{margin:0 0 6px;font-size:13px}.k{color:#64748b;font-size:11px;font-weight:700}
-.action{font-family:ui-monospace,Menlo,Consolas,monospace;font-size:12px;white-space:pre-wrap;word-break:break-word;background:#fff;border:1px solid #e2e8f0;border-radius:8px;padding:8px 10px}
+.action{font-family:ui-monospace,Menlo,Consolas,monospace;font-size:12px;white-space:pre-wrap;word-break:break-word;background:#fff;border:1px solid #e2e8f0;border-radius:8px;padding:8px 10px;max-height:180px;overflow:auto}
+.steps{margin:0 0 8px}.steps li{margin:3px 0}.steps .n{color:#64748b;font-weight:700;min-width:18px}
 ul{list-style:none;margin:0;padding:0}li{display:flex;gap:8px;margin:6px 0}
 .dot{width:8px;height:8px;border-radius:50%;margin-top:6px;flex:none}
 .row{display:flex;justify-content:flex-end;gap:8px;align-items:center;margin-top:14px;flex-wrap:wrap}
@@ -180,6 +183,7 @@ button{font:600 13px/1 -apple-system,Segoe UI,sans-serif;border-radius:8px;paddi
 </div></div>
 <div class="box"><h2>Action</h2>
 ${view.kind ? `<div class="k">${htmlEsc(view.kind)}</div>` : ''}
+${view.steps.length ? `<div class="k" style="margin-top:6px">What it does</div><ol class="steps">${view.steps.map((step, index) => `<li><span class="n">${index + 1}.</span>${htmlEsc(step)}</li>`).join('')}</ol><div class="k">Full script</div>` : ''}
 ${view.action ? `<div class="action">${htmlEsc(view.action)}</div>` : '<p class="sub">The action is described in the IDE message.</p>'}
 </div>
 ${view.policy ? `<div class="box"><h2>Matched policy</h2><div><span class="k">Policy</span> ${htmlEsc(view.policy)}</div>${view.scope ? `<div><span class="k">Scope</span> ${htmlEsc(view.scope)}</div>` : ''}</div>` : ''}
@@ -224,7 +228,10 @@ function windowsDialogScript(message, timeoutSeconds, options, title, view) {
         "$s=AddLabel $root ([string]$v.subtitle) (New-Object Drawing.Font('Segoe UI',9.75)) $muted ($h.Bottom+4) $hw $hx; $y=[Math]::Max($icon.Bottom,$s.Bottom)+18",
         "AddLabel $root 'Action' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $ink $y $w | Out-Null; $y+=22",
         "if($v.kind){ AddLabel $root ([string]$v.kind) (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=18 }",
-        "if($v.action){ $a=AddLabel $root ([string]$v.action) (New-Object Drawing.Font('Consolas',9.75)) $ink $y $w; $y=$a.Bottom+12 } else { $y+=8 }",
+        // What it does: one numbered plain-words line per step, then the FULL script in a
+        // read-only scrolling box (fixed height, so a long script never pushes the buttons away).
+        "$steps=@($v.steps); if($steps.Count -gt 0){ AddLabel $root 'What it does' (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=18; $n=0; foreach($st in $steps){ $n++; $row=AddLabel $root (\"$n.  $st\") (New-Object Drawing.Font('Segoe UI',9.75)) $ink $y $w; $y=$row.Bottom+2 }; $y+=6; AddLabel $root 'Full script' (New-Object Drawing.Font('Segoe UI',8.25,[Drawing.FontStyle]::Bold)) $muted $y $w | Out-Null; $y+=18 }",
+        "if($v.action){ $a=New-Object Windows.Forms.TextBox; $a.Multiline=$true; $a.ReadOnly=$true; $a.WordWrap=$true; $a.ScrollBars='Vertical'; $a.BorderStyle='FixedSingle'; $a.BackColor=[Drawing.Color]::FromArgb(248,250,252); $a.ForeColor=$ink; $a.Font=New-Object Drawing.Font('Consolas',9.75); $a.Text=[string]$v.action; $lines=[Math]::Max(1,[Math]::Min(9,([string]$v.action).Length/80+([string]$v.action).Split([char]10).Count)); $a.Size=New-Object Drawing.Size($w,[int](18*$lines+12)); $a.Location=New-Object Drawing.Point($x0,$y); $a.TabStop=$false; $root.Controls.Add($a); $y=$a.Bottom+12 } else { $y+=8 }",
         "if($v.policy){ AddLabel $root 'Matched policy' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $ink $y $w | Out-Null; $y+=22; $pn=AddLabel $root ([string]$v.policy) (New-Object Drawing.Font('Segoe UI',9.75)) $ink $y $w; $y=$pn.Bottom+2; if($v.scope){ $ps=AddLabel $root ([string]$v.scope) (New-Object Drawing.Font('Segoe UI',9)) $muted $y $w; $y=$ps.Bottom+12 } }",
         "AddLabel $root 'Why it triggered' (New-Object Drawing.Font('Segoe UI',9.75,[Drawing.FontStyle]::Bold)) $ink $y $w | Out-Null; $y+=22",
         "foreach($item in @($v.why)){ $row=AddLabel $root ('•  '+$item) (New-Object Drawing.Font('Segoe UI',9.75)) $ink $y $w; $y=$row.Bottom+2 }",
@@ -771,8 +778,45 @@ function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PEN
 // ---------------------------------------------------------------------------
 /** Shell words that run the program that follows them, not a program of their own. */
 const SHELL_LEAD_WRAPPERS = new Set(['sudo', 'doas', 'env', 'nice', 'nohup', 'time', 'command', 'builtin', 'exec', 'xargs', 'timeout', 'stdbuf', 'chronic', 'busybox', 'call', 'start', '&']);
+/**
+ * Interpreters that can run *any* command. Never a grant program of their own —
+ * Always allow on `cmd` / `powershell` / `bash` would cover the next curl.
+ * `cmd /c gcloud` peels to `gcloud` via the nested `-c` / `/c` body.
+ */
+const GENERIC_SHELLS = new Set(['cmd', 'powershell', 'pwsh', 'bash', 'sh', 'zsh', 'fish', 'wsl', 'dash']);
+/**
+ * Pipeline / formatting cmdlets. They are not the app the rule asked about.
+ * Binding Always allow to `foreach-object` made every differently-wrapped
+ * `gcloud` line ask again (assaf-desktop / this machine, 2026-09-18..20).
+ */
+const SHELL_PIPELINE_NOISE = new Set([
+    'foreach-object', 'where-object', 'select-object', 'sort-object', 'measure-object',
+    'group-object', 'tee-object', 'compare-object', 'foreach',
+    'format-table', 'format-list', 'format-wide', 'format-custom',
+    'write-output', 'write-host', 'write-error', 'write-warning', 'write-verbose', 'write-debug', 'write-information',
+    'out-string', 'out-null', 'out-host', 'out-default', 'out-gridview',
+    '%', '?',
+]);
+/**
+ * Local inspect — listing, presence, identity, conversion. Not the app the
+ * rule asked about and not an exfil path. Dropped so Always allow on
+ * `gcloud …; Get-ChildItem; Test-Path` is `{gcloud}` and covers the next
+ * `gh` / `aws` / `kubectl` line the same way. Readers (`Get-Content`) and
+ * script/exfil hosts (`node`, `curl`, `Invoke-RestMethod`) stay in the set.
+ */
+const SHELL_INCIDENTAL = new Set([
+    'get-childitem', 'get-item', 'get-itemproperty', 'get-nettcpconnection', 'get-netadapter',
+    'get-netipaddress', 'get-netroute', 'get-process', 'get-service', 'get-command',
+    'get-help', 'get-alias', 'get-member', 'get-variable', 'get-location', 'get-host',
+    'get-date', 'get-history', 'get-psdrive', 'get-psprovider', 'get-module', 'get-job',
+    'get-computerinfo', 'test-path', 'resolve-path', 'split-path', 'join-path',
+    'convertfrom-json', 'convertto-json', 'convertfrom-csv', 'convertto-csv',
+    'ls', 'dir', 'pwd', 'cd', 'set-location', 'push-location', 'pop-location',
+    'hostname', 'whoami', 'uname', 'id', 'true', 'false', 'clear', 'cls',
+    'sleep', 'start-sleep', 'which', 'where.exe', 'where',
+]);
 /** Control-flow words (sh / bash / PowerShell): structure, never a program of their own. */
-const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|switch|break|continue)$/i;
+const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|exit|switch|break|continue)$/i;
 /** Words a body follows directly (`then rm x`, `do echo`, PowerShell `else { … }`). */
 const SHELL_BODY_LEADS = /^(then|do|else)$/i;
 /** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
@@ -809,14 +853,28 @@ function splitShellSegments(command) {
     segments.push(current);
     return segments;
 }
-/**
- * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
- * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
- * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
- * program (pure block structure like `} catch {`) contributes nothing.
- */
-function shellPrograms(command) {
-    const out = new Set();
+/** `out-string).trim()` is not a program — take the leading identifier only. */
+function programToken(lead) {
+    const unquoted = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop() || '';
+    const stripped = unquoted.replace(/\.(exe|cmd|bat|ps1|com)$/i, '');
+    const ident = stripped.match(/^[A-Za-z%][A-Za-z0-9_.%-]*/);
+    return ident ? ident[0].toLowerCase() : undefined;
+}
+/** Body of `cmd /c …` / `powershell -Command …` / `bash -c …`. Encoded payloads are unreadable — no grant. */
+function nestedShellBody(segment) {
+    if (/\s--?encodedcommand(?:\s|$)/i.test(segment) || /\s-ec(?:\s|$)/i.test(segment))
+        return undefined;
+    const match = segment.match(/\s(?:\/c|--?c|--?command)\s+/i);
+    if (!match || match.index === undefined)
+        return undefined;
+    let rest = segment.slice(match.index + match[0].length).trim();
+    if ((rest.startsWith('"') && rest.endsWith('"')) || (rest.startsWith("'") && rest.endsWith("'")))
+        rest = rest.slice(1, -1);
+    return rest.trim() || undefined;
+}
+function collectPrograms(command, out, depth) {
+    if (depth > 3 || !command.trim())
+        return;
     for (const raw of splitShellSegments(command)) {
         const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
@@ -871,19 +929,94 @@ function shellPrograms(command) {
         const lead = words[i];
         if (!lead || /^[$@(){}\]\[|&;<>#'"`-]/.test(lead) || SHELL_CONTROL_WORDS.test(lead))
             continue;
-        const name = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop().replace(/\.(exe|cmd|bat|ps1|sh)$/i, '').toLowerCase();
-        if (name)
-            out.add(name);
+        const name = programToken(lead);
+        if (!name || SHELL_PIPELINE_NOISE.has(name) || SHELL_INCIDENTAL.has(name))
+            continue;
+        if (GENERIC_SHELLS.has(name)) {
+            const nested = nestedShellBody(raw);
+            if (nested)
+                collectPrograms(nested, out, depth + 1);
+            continue;
+        }
+        out.add(name);
     }
+}
+/**
+ * The real programs a shell line runs — one per segment, wrappers (`sudo`,
+ * `env`) and `$var =` peeled off. Pipeline cmdlets and generic shells are not
+ * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
+ * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
+ * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
+ * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
+ * is stripped. Sorted and unique.
+ */
+function shellPrograms(command) {
+    const out = new Set();
+    collectPrograms(command, out, 0);
     return [...out].sort();
 }
+/** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
+function splitLocalSafetyRuleIds(matchedRule) {
+    if (!matchedRule || !matchedRule.includes('+'))
+        return undefined;
+    const parts = matchedRule.split('+').map(part => part.trim()).filter(Boolean);
+    if (parts.length < 2 || !parts.every(part => /^[a-z][a-z0-9_]*$/.test(part)))
+        return undefined;
+    return parts;
+}
+function localSafetyItemIds(value) {
+    if (!value)
+        return [];
+    const prefix = 'local-safety:';
+    const raw = value.startsWith(prefix) ? value.slice(prefix.length) : value;
+    return splitLocalSafetyRuleIds(raw) || (raw ? [raw] : []);
+}
+function grantRuleApplies(grant, rule) {
+    const grantItems = localSafetyItemIds(grant.matchedRule);
+    const liveItems = localSafetyItemIds(rule.matchedRule);
+    const namesOverlap = grantItems.length > 0 && liveItems.length > 0 && liveItems.some(id => grantItems.includes(id));
+    const exactName = (grant.matchedRule || null) === (rule.matchedRule || null);
+    const exactId = (grant.policyId || null) === (rule.policyId || null);
+    const grantPolicyItems = localSafetyItemIds(grant.policyId);
+    const livePolicyItems = localSafetyItemIds(rule.policyId);
+    const policyOverlap = grantPolicyItems.length > 0 && livePolicyItems.length > 0
+        && livePolicyItems.some(id => grantPolicyItems.includes(id));
+    if (!exactId && !policyOverlap)
+        return false;
+    if (grant.policyHash === rule.policyHash && (exactName || namesOverlap))
+        return true;
+    if (!namesOverlap)
+        return false;
+    // Per-item grant (new) vs a combined live finding (joined hash).
+    if (grantItems.length === 1 && liveItems.length > 1) {
+        return grant.policyHash === localSafetyRuleHash({ itemId: grantItems[0], source: 'builtin', action: 'ask' });
+    }
+    // Combined leftover grant (joined id + joined hash) vs a later single-rule ask.
+    if (grantItems.length > 1 && liveItems.length === 1)
+        return true;
+    return false;
+}
+function expandGrantRuleIdentities(rule) {
+    const parts = splitLocalSafetyRuleIds(rule.matchedRule);
+    if (!parts)
+        return [rule];
+    const fromPolicy = rule.policyId?.startsWith('local-safety:') ? 'local-safety:' : undefined;
+    return parts.map(itemId => ({
+        policyId: fromPolicy ? `${fromPolicy}${itemId}` : rule.policyId,
+        policyName: rule.policyName?.includes('+') ? `Local Safety · ${itemId}` : rule.policyName,
+        matchedRule: itemId,
+        policyHash: localSafetyRuleHash({ itemId, source: 'builtin', action: 'ask' }),
+    }));
+}
 function grantKey(scope, policyId, matchedRule, policyHash) {
-    return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
+    return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.scripts || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
 }
 /**
- * Does a live grant cover this action under this exact rule? Shell programs match by
- * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
- * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ * Does a live grant cover this action under this rule? Combined Local Safety
+ * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
+ * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
+ * Touch counts a use.
  *
  * `limits` are the caps in force NOW (rule + org ceiling). A grant older or wider than
  * they allow is ignored — tightening the org setting takes effect on the next action,
@@ -898,9 +1031,7 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
     const ttlCap = Math.min(exports.GRANT_TTL_MS, limits.ttlMs);
     return mutateLedger(undefined, () => {
         const ledger = readLedger();
-        const hit = ledger.grants.find(g => g.policyHash === rule.policyHash
-            && (g.policyId || null) === (rule.policyId || null)
-            && (g.matchedRule || null) === (rule.matchedRule || null)
+        const hit = ledger.grants.find(g => grantRuleApplies(g, rule)
             && g.scope.event === scope.event
             && g.scope.toolName === scope.toolName
             && g.scope.operation === scope.operation
@@ -912,7 +1043,9 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
             && now.getTime() - Date.parse(g.grantedAt) < ttlCap
             && !grantExhausted(g, limits)
             && (scope.event !== 'shell'
-                || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p)))));
+                || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p))))
+            && (!(g.scope.scripts && g.scope.scripts.length)
+                || ((scope.scripts || []).length > 0 && (scope.scripts || []).every(s => g.scope.scripts.includes(s)))));
         if (!hit)
             return undefined;
         hit.lastUsedAt = now.toISOString();
@@ -930,26 +1063,31 @@ function recordDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_M
         return undefined;
     const ttlMs = Math.max(60_000, Math.min(exports.GRANT_TTL_MS, limits.ttlMs));
     const maxUses = positiveCap(limits.maxUses, exports.GRANT_MAX_USES_LIMIT);
-    const grant = {
-        key: grantKey(scope, rule.policyId, rule.matchedRule, rule.policyHash),
-        scope,
-        policyId: rule.policyId,
-        policyName: rule.policyName,
-        matchedRule: rule.matchedRule,
-        policyHash: rule.policyHash,
-        grantedAt: now.toISOString(),
-        expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
-        uses: 0,
-        ...(maxUses !== undefined ? { maxUses } : {}),
-    };
+    const identities = expandGrantRuleIdentities(rule);
     return mutateLedger(undefined, () => {
         const ledger = readLedger();
-        ledger.grants = ledger.grants.filter(g => g.key !== grant.key && Date.parse(g.expiresAt) > now.getTime() && !grantExhausted(g));
-        ledger.grants.push(grant);
+        let last;
+        for (const ident of identities) {
+            const grant = {
+                key: grantKey(scope, ident.policyId, ident.matchedRule, ident.policyHash),
+                scope,
+                policyId: ident.policyId,
+                policyName: ident.policyName,
+                matchedRule: ident.matchedRule,
+                policyHash: ident.policyHash,
+                grantedAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+                uses: 0,
+                ...(maxUses !== undefined ? { maxUses } : {}),
+            };
+            ledger.grants = ledger.grants.filter(g => g.key !== grant.key && Date.parse(g.expiresAt) > now.getTime() && !grantExhausted(g));
+            ledger.grants.push(grant);
+            last = grant;
+        }
         if (ledger.grants.length > MAX_GRANTS)
             ledger.grants = ledger.grants.slice(-MAX_GRANTS);
         writeLedger(ledger);
-        return grant;
+        return last;
     });
 }
 /** Live grants: not expired and not spent. */
@@ -970,7 +1108,9 @@ function revokeDeveloperGrants(key) {
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 function describeGrantScope(scope) {
     const what = scope.event === 'shell'
-        ? `\`${(scope.programs || []).join('`, `')}\` commands`
+        ? (scope.scripts && scope.scripts.length
+            ? `running ${scope.scripts.map(s => `\`${s}\``).join(', ')}`
+            : `\`${(scope.programs || []).join('`, `')}\` commands`)
         : scope.event === 'mcp'
             ? `${scope.toolName.replace(/^mcp__/, '').replace(/__/g, ' / ')} calls`
             : `${scope.toolName} ${scope.event} actions`;
@@ -979,11 +1119,27 @@ function describeGrantScope(scope) {
     return `${what}${op}${where}`;
 }
 /** The scope a grant would have for this action — from engine facts, never from text. */
+function scriptGrantKeys(command, cwd) {
+    const base = cwd && cwd.trim() ? cwd : process.cwd();
+    const keys = (0, deterministicGuard_1.referencedScripts)(command, base)
+        .filter(script => !script.startsWith('npm:'))
+        .map(script => {
+        const rel = path.relative(base, script);
+        if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+            return rel.replace(/\\/g, '/');
+        return path.basename(script);
+    });
+    return [...new Set(keys)].sort();
+}
 function grantScopeFor(event, toolName, toolArgs, operation, context) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
         scope.programs = shellPrograms(command);
+        const cwd = typeof toolArgs?.cwd === 'string' ? toolArgs.cwd : undefined;
+        const scripts = scriptGrantKeys(command, cwd);
+        if (scripts.length)
+            scope.scripts = scripts;
     }
     const domain = context?.['destination.domain'];
     if (typeof domain === 'string' && domain.trim())

package/dist/index.js

@@ -197,6 +197,9 @@ function printHelp() {
                 fleet expires it automatically after --ttl-hours of silence.
                 Add --http-gateway true to also gate the agent's direct API calls
                 (starts http-gateway; the env file gains HTTP_PROXY / HTTPS_PROXY).
+                --enrolled-via <heroku|kubernetes|aws|gcp> (or FCD_ENROLLED_VIA)
+                files the row under that connection in the console; Heroku dynos
+                are detected from DYNO / HEROKU_APP_NAME.
                 Auth: FCD_API_KEY secret (org API key).
     approve     Resolve a taint-guard "approve once" request from YOUR terminal.
                 When the hook holds an agent action (unrequested network/git
@@ -737,6 +740,7 @@ async function main() {
                 force: flags.force,
                 httpGateway: flags['http-gateway'],
                 agentName: flags['agent-name'],
+                enrolledVia: flags['enrolled-via'],
             };
             const { workloadProtectCommand } = await Promise.resolve().then(() => __importStar(require('./commands/workloadProtect')));
             await workloadProtectCommand(args, config);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.2"
+  "version": "1.35.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.2",
+  "version": "1.35.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -20,6 +20,7 @@
     "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
     "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
     "build": "tsc && node scripts/bundle-policy-engine.js && node scripts/copy-attack-corpus.js && node scripts/bundle-containment-runtime.js",
+    "test:ask-dialog": "npm run build && node scripts/test-ask-dialog.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",
     "test:msi-stop-filter": "node scripts/test-msi-stop-filter.js",
@@ -99,6 +100,7 @@
     "test:qa-loop": "node scripts/test-qa-command-generator.js && node scripts/test-qa-loop-offline.js && node scripts/test-qa-loop-server.js",
     "qa-loop": "node scripts/run-machine-qa-loop.js --offline",
     "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
+    "test:web-dev-policy-eval": "npm run build && node scripts/test-web-dev-policy-eval.js",
     "test:secret-shapes": "npm run build && node scripts/test-secret-locator-shapes.js",
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",