fullcourtdefense-cli 1.35.3 → 1.35.5

package/dist/commandNarrative.js

@@ -265,6 +265,9 @@ function describeOne(segmentIn) {
             if (storage)
                 return step(`Sets variable ${name} to a location in storage bucket ${storage[1]}`);
             const interpolates = /\$\w+|\$\{|\$\(/.test(bare);
+            if (interpolates && /(?:\$(?:env:)?(?:TEMP|TMP|LOCALAPPDATA|HOME|PWD|PSScriptRoot|USERPROFILE)\b|%TEMP%|%TMP%|%LOCALAPPDATA%|%USERPROFILE%)/i.test(bare)) {
+                return step(`Sets variable ${name} to a path`);
+            }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
         const inner = rhs.replace(/^\(\s*/, '').replace(/\)\s*(?:\.\w+\(\))*$/, '');

package/dist/commands/deterministicGuard.d.ts

@@ -106,6 +106,12 @@ export interface SharedCommandRule {
  * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+/**
+ * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
+ * space. Detectors that ask "does this EXECUTE" must look here; the raw line
+ * still carries fixture strings and docs.
+ */
+export declare function unquotedCode(text: string): string;
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
@@ -126,6 +132,7 @@ export declare function scanDeterministicTextResponse(text: string, options?: Lo
  * command works would be stopped for typing its name. (action-only decision path)
  */
 export declare function scanDeterministicPrompt(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
+export declare function referencedScripts(command: string, cwd?: string): string[];
 export interface DeterministicScanOutcome {
     /** The finding that stops the action, if any. */
     blockingFinding?: DeterministicFinding;

package/dist/commands/deterministicGuard.js

@@ -35,10 +35,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.unquotedCode = unquotedCode;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
 exports.scanDeterministicPrompt = scanDeterministicPrompt;
+exports.referencedScripts = referencedScripts;
 exports.resolveDeterministicOutcome = resolveDeterministicOutcome;
 exports.resolveDeterministicTextResponse = resolveDeterministicTextResponse;
 const fs = __importStar(require("fs"));
@@ -698,9 +700,14 @@ exports.CREDENTIAL_COMMAND_RULES = [
         pattern: String.raw `\bvault\s+(?:kv\s+get|read)\b` },
 ];
 const CREDENTIAL_COMMAND_REGEXES = exports.CREDENTIAL_COMMAND_RULES.map(rule => ({ rule, re: new RegExp(rule.pattern, 'i') }));
-function credentialCommandReason(value) {
+function credentialCommandReason(value, options) {
     return matchCommand(value, text => {
         for (const { rule, re } of CREDENTIAL_COMMAND_REGEXES) {
+            // Skip suppressed / org-disabled items so a second credential command on
+            // the same line is still found after resolveDeterministicOutcome hides
+            // the first ask (gh then gcloud, not "gh forever").
+            if (!isEnabled(rule.itemId, options))
+                continue;
             if (re.test(text))
                 return { itemId: rule.itemId, reason: rule.reason };
         }
@@ -724,6 +731,11 @@ function destructiveCommandReason(value) {
         // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
         if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
             return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+        // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
+        // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
+        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
+            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        }
         // Bare `*` deletes the current directory tree — destructive on the HOST,
         // but inside a container exec/run it is the container workdir (cleanup).
         const bareStar = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/.exec(lower);
@@ -746,6 +758,10 @@ function destructiveCommandReason(value) {
             && /remove-item\b[^;|&]{0,80}?["']?\b[a-z]:[\\/]?["']?(?=\s|$|[;&|])/i.test(text)) {
             return { itemId: 'windows_drive_delete', reason: 'recursive Windows drive delete' };
         }
+        if (lower.includes('remove-item') && lower.includes('-recurse') && lower.includes('-force')
+            && /remove-item\b[^;|&]{0,80}?["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:[\\/]\*?)?["']?(?=\s|$|[;&|])/i.test(lower)) {
+            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        }
         if (/: *\(\) *\{ *: *\| *: *& *\} *; *:/.test(text))
             return { itemId: 'fork_bomb', reason: 'fork bomb' };
         if (/\bmkfs(?:\.[a-z0-9]+)?\s+\/dev\//i.test(text))
@@ -875,8 +891,12 @@ function isWebLookupTarget(toolName, candidate) {
  * must not block — the unconditional match over-blocked ordinary development work.
  */
 function isMetadataRequestContext(toolName, candidate) {
-    if (isCommandContext(toolName, candidate))
+    if (isCommandContext(toolName, candidate)) {
+        // `rg "169.254.169.254" scripts/` searches for the address; it does not request it.
+        if (commandOnlySearchesMetadata(candidate.value))
+            return false;
         return true;
+    }
     if (isWebLookupTarget(toolName, candidate))
         return true;
     if (OUTBOUND_TOOL_HINT.test(toolName))
@@ -884,6 +904,76 @@ function isMetadataRequestContext(toolName, candidate) {
     const lastKey = candidate.keyPath.split('.').pop() || '';
     return /(?:url|uri|endpoint|host|address|webhook)/i.test(lastKey);
 }
+const METADATA_SEARCH_PROGRAMS = new Set([
+    'rg', 'grep', 'egrep', 'fgrep', 'findstr', 'ack', 'ag', 'select-string', 'sls',
+]);
+/**
+ * Split on unquoted `;` / `&&` / `||` / `|` / newline so a pipe cannot hide a
+ * later client (`rg … | curl http://169.254…`) while `rg "a|b"` stays one segment.
+ */
+function splitUnquotedCommandSegments(command) {
+    const out = [];
+    let cur = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (quote) {
+            cur += c;
+            if (c === '\\' && i + 1 < command.length) {
+                cur += command[++i];
+                continue;
+            }
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        if (c === '\n' || c === ';') {
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        if (c === '&' && command[i + 1] === '&') {
+            out.push(cur);
+            cur = '';
+            i += 1;
+            continue;
+        }
+        if (c === '|') {
+            if (command[i + 1] === '|')
+                i += 1;
+            out.push(cur);
+            cur = '';
+            continue;
+        }
+        cur += c;
+    }
+    if (cur)
+        out.push(cur);
+    return out;
+}
+/** True when every segment that mentions a metadata endpoint is a searcher, not a client. */
+function commandOnlySearchesMetadata(command) {
+    if (!containsMetadataEndpoint(command))
+        return false;
+    const segments = splitUnquotedCommandSegments(command);
+    let saw = false;
+    for (const raw of segments) {
+        const seg = raw.trim();
+        if (!seg || !containsMetadataEndpoint(seg))
+            continue;
+        saw = true;
+        const token = (seg.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/) || [''])[0];
+        const program = token.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.exe$/, '');
+        if (!METADATA_SEARCH_PROGRAMS.has(program))
+            return false;
+    }
+    return saw;
+}
 /**
  * Sensitive credential PATHS only matter where the string is used AS a path (a file access,
  * a path-typed argument) or inside a command. File CONTENTS being written/edited routinely
@@ -978,8 +1068,36 @@ const INERT_DATA = ' fcd_inert_data ';
 // Code position immediately before a quoted span: interpreter code flags or a
 // remote/nested executor earlier in the same statement (no ; & | between).
 const CODE_CONTEXT_BEFORE = /(?:(?:^|[;&|(]|\s)(?:-c|\/c|-e|-command|-scriptblock|-filter)[= ]\s*|(?:^|[;&|(]\s*)(?:\S*[\\/])?(?:sudo\s+|doas\s+)?(?:ssh|wsl(?:\.exe)?|chroot|su|screen|tmux)(?:\s[^;&|"']*)?\s|(?:\S*[\\/])?(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b[^;&|"']*\s)$/i;
+/**
+ * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
+ * space. Detectors that ask "does this EXECUTE" must look here; the raw line
+ * still carries fixture strings and docs.
+ */
+function unquotedCode(text) {
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === "'" || c === '"' || c === '`') {
+            const q = c;
+            i += 1;
+            while (i < text.length) {
+                if (text[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                if (text[i] === q)
+                    break;
+                i += 1;
+            }
+            out += ' ';
+            continue;
+        }
+        out += c;
+    }
+    return out;
+}
 function stripInertDataSegments(text) {
-    if (DATA_TO_INTERPRETER.test(text))
+    if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
         return text;
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
@@ -1201,22 +1319,27 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     // stripInertDataSegments invariants). This is the generic FP guard for
     // "wrote ABOUT a dangerous command" vs "ran one".
     const value = stripInertDataSegments(rawValue);
+    // Script files: path/metadata facts are judged on RAW lines, then
+    // `scriptActsOnFinding` keeps only unquoted access (fetch/http.get/curl).
+    // Shell-prose strip would eat `execSync('curl -s http://169.254…')` and miss
+    // a real call. Command-shaped rules below still use the stripped view.
+    const actingView = toolName === 'script_file' ? rawValue : value;
     // NOTE: a disabled item must FALL THROUGH to the later rules, not end the
     // scan — otherwise turning off (or gating) a path rule would mask a real
     // reverse shell / destructive command in the same value.
     const sensitivePath = containsSensitiveCredentialPath(commandContext
-        ? `${credentialAccessCommandText(value)}\n${interpreterFileArguments(rawValue)}` : value);
+        ? `${credentialAccessCommandText(actingView)}\n${interpreterFileArguments(rawValue)}` : actingView);
     if (sensitivePath) {
         const finding = builtIn(sensitivePath.itemId, 'sensitive_files', 'sensitive_file', 'local-sensitive-credential-path', 
         // Verdict-neutral: the same finding is a warning on a monitor machine and
         // a block on an enforcing one — the console shows the verdict, not this text.
-        `Local agent access to ${sensitivePath.label}.`, value, sensitivePath.label, options);
+        `Local agent access to ${sensitivePath.label}.`, actingView, sensitivePath.label, options);
         if (finding)
             return finding;
     }
-    const metadata = containsMetadataEndpoint(value);
+    const metadata = containsMetadataEndpoint(actingView);
     if (metadata) {
-        const finding = builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, value, metadata.value, options);
+        const finding = builtIn(metadata.itemId, 'metadata_ssrf', 'metadata_ssrf', 'local-cloud-metadata-ssrf', `Blocked request to ${metadata.label}.`, actingView, metadata.value, options);
         if (finding)
             return finding;
     }
@@ -1224,7 +1347,7 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
     if (reverseShell) {
         return builtIn(reverseShell.itemId, 'reverse_shells', 'reverse_shell', 'local-reverse-shell', `Blocked ${reverseShell.reason}.`, value, reverseShell.reason, options);
     }
-    const credentialCmd = credentialCommandReason(value);
+    const credentialCmd = credentialCommandReason(value, options);
     if (credentialCmd) {
         const finding = builtIn(credentialCmd.itemId, 'credential_commands', 'credential_command', 'local-credential-command', `Blocked credential-revealing command: ${credentialCmd.reason}.`, value, credentialCmd.reason, options);
         if (finding)
@@ -1434,13 +1557,23 @@ function referencedScripts(command, cwd) {
 // Collision-hardened forms: `ssh` must be a command start (NOT the `.ssh` of the
 // flagged path itself), `type` the cmd.exe read form (`type file`, not `type:` in
 // JSON/TS fixtures), `open` a call (`open(`), `requests.*` a python HTTP call.
-const SCRIPT_ACCESS_VERB = /\b(?:cat|gc|get-content|get-item|copy(?:-item)?|cp|xcopy|robocopy|move(?:-item)?|mv|scp|sftp|rsync|curl|wget|invoke-webrequest|invoke-restmethod|iwr|irm|openssl|tar|zip|7z|certutil|base64|readfile(?:sync)?|createreadstream|read_text|read_bytes|fopen|urlopen|fetch|upload|download)\b|\btype\s+\S|(?:^|[^.\w])ssh(?:-add|-keygen|\.exe)?\s|\bopen\s*\(|\brequests\.\w+\s*\(/i;
+const SCRIPT_ACCESS_VERB = /\b(?:cat|gc|get-content|get-item|copy(?:-item)?|cp|xcopy|robocopy|move(?:-item)?|mv|scp|sftp|rsync|curl|wget|invoke-webrequest|invoke-restmethod|iwr|irm|openssl|tar|zip|7z|certutil|base64|readfile(?:sync)?|createreadstream|read_text|read_bytes|fopen|urlopen|fetch|upload|download|exec(?:sync|file(?:sync)?)?|spawn(?:sync)?)\b|\btype\s+\S|(?:^|[^.\w])ssh(?:-add|-keygen|\.exe)?\s|\bopen\s*\(|\brequests\.\w+\s*\(/i;
+/** `http.get(` / `require(…).get(` — the call is code; the URL may be a literal. */
+const SCRIPT_ACCESS_CALL = /\.\s*(?:get|request|post|put|patch|delete|fetch|exec(?:sync|file(?:sync)?)?|spawn(?:sync)?)\s*\(/i;
 /**
  * A path/metadata finding inside a referenced script only counts when some LINE both
- * contains the flagged pattern AND acts on it. Scripts (and their tests, and security
- * tooling) routinely mention credential paths as inert strings — "found inside
- * referenced script" used to block running our own guard test suite over fixtures.
+ * contains the flagged pattern AND acts on it in CODE. The entire matched span
+ * sitting inside one string literal (`'curl http://169.254…'`) is data — that
+ * was the live IDE false positive on `node scripts/test-execution-view.js`.
+ * `fetch('http://169.254…')` / `http.get('…')` still fire: the CALL is unquoted.
  */
+function lineActsOnFinding(line) {
+    const code = unquotedCode(line)
+        .replace(/\/\/[^\n]*/g, ' ')
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .replace(/(^|[^$\w])#[^\n]*/g, '$1 ');
+    return SCRIPT_ACCESS_VERB.test(code) || SCRIPT_ACCESS_CALL.test(code);
+}
 function scriptActsOnFinding(content, category) {
     const matcher = category === 'sensitive_file'
         ? (line) => Boolean(containsSensitiveCredentialPath(line))
@@ -1448,7 +1581,7 @@ function scriptActsOnFinding(content, category) {
     for (const rawLine of content.split(/\r?\n/)) {
         if (!rawLine || rawLine.length > 4000)
             continue;
-        if (matcher(rawLine) && SCRIPT_ACCESS_VERB.test(rawLine))
+        if (matcher(rawLine) && lineActsOnFinding(rawLine))
             return true;
     }
     return false;

package/dist/commands/shellGuard.js

@@ -198,7 +198,7 @@ const BUILTIN_RULES = [
     compileSpec({ id: 'rm_rf_root', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of filesystem root',
         command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [T_UNIX_ROOT] }),
     compileSpec({ id: 'rm_rf_home', category: 'destructive_command', severity: 'critical', reason: 'recursive delete of the home directory',
-        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [String.raw `["']?(?:~|\$HOME)(?:/\S*)?["']?(?:\s|$|[;&|])`] }),
+        command: ['rm'], flags: [String.raw `-[a-z]*r[a-z]*|--recursive`], target: [String.raw `["']?(?:~|\$HOME|\$\{HOME\}|%USERPROFILE%|\$env:USERPROFILE)(?:[\\/]\*?)?["']?(?:\s|$|[;&|])`] }),
     compileSpec({ id: 'windows_drive_delete', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive delete',
         command: ['del', 'erase'], flags: [String.raw `/s\b`], target: [T_WIN_DRIVE] }),
     compileSpec({ id: 'windows_drive_rmdir', category: 'destructive_command', severity: 'critical', reason: 'recursive Windows drive remove directory',

package/dist/devConfirm.d.ts

@@ -95,19 +95,30 @@ export interface ConfirmedAction {
 }
 /**
  * WHAT an "Always allow" covers. Structural, parsed from the action — never the
- * command text or a pattern over it: the programs a shell line runs (all of them,
- * so `git push && gh pr create` and `gh pr view` are different sets), the MCP
+ * command text or a pattern over it: the real programs a shell line runs (so
+ * `git push && gh pr create` and `gh pr view` are different sets), the MCP
  * server + tool, the operation the engine derived, and the destination host when
- * the action reaches one. A grant for `gh` writing to `github.com` never covers
- * `curl` writing to `github.com`, nor `gh` writing to `gitlab.com`.
+ * the action reaches one. Pipeline cmdlets and generic shells (`cmd`,
+ * `powershell`, `bash -c`) are not programs — a grant for `gcloud` never
+ * becomes a grant for every command. A grant for `gh` writing to `github.com`
+ * never covers `curl` writing to `github.com`, nor `gh` writing to `gitlab.com`.
  */
 export interface GrantScope {
     /** Hook event: shell | mcp | file | read | prompt. */
     event: string;
     /** Shell: the IDE tool (Bash / shell). MCP: `mcp__<server>__<tool>`. Files: the tool. */
     toolName: string;
-    /** Shell only: sorted, de-duplicated leading programs of every segment. */
+    /**
+     * Shell only: sorted, de-duplicated real programs. Wrappers (`foreach-object`,
+     * `write-output`) and generic shells (`cmd`, `powershell`) are stripped; `cmd /c gcloud`
+     * is `{gcloud}`.
+     */
     programs?: string[];
+    /**
+     * Shell only: referenced script paths this line executes (`node scripts/x.js`).
+     * When present, "Always allow" is bound to these files, not every `node`.
+     */
+    scripts?: string[];
     /** Engine-derived operation (read / write / SHELL / DELETE / …). */
     operation: string;
     /** Host the action reaches (engine `destination.domain`), when any. */
@@ -277,16 +288,23 @@ export declare function rejectDeveloperConfirmation(event: string, toolName: str
  */
 export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): PendingConfirmation[];
 /**
- * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
- * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
- * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
- * program (pure block structure like `} catch {`) contributes nothing.
+ * The real programs a shell line runs — one per segment, wrappers (`sudo`,
+ * `env`) and `$var =` peeled off. Pipeline cmdlets and generic shells are not
+ * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
+ * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
+ * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
+ * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
+ * is stripped. Sorted and unique.
  */
 export declare function shellPrograms(command: string): string[];
+/** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
+export declare function splitLocalSafetyRuleIds(matchedRule?: string): string[] | undefined;
 /**
- * Does a live grant cover this action under this exact rule? Shell programs match by
- * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
- * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ * Does a live grant cover this action under this rule? Combined Local Safety
+ * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
+ * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
+ * Touch counts a use.
  *
  * `limits` are the caps in force NOW (rule + org ceiling). A grant older or wider than
  * they allow is ignored — tightening the org setting takes effect on the next action,
@@ -314,7 +332,6 @@ export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 export declare function revokeDeveloperGrants(key?: string): number;
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 export declare function describeGrantScope(scope: GrantScope): string;
-/** The scope a grant would have for this action — from engine facts, never from text. */
 export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
 /**
  * Is this exact action covered in the same session and policy context?

package/dist/devConfirm.js

@@ -55,6 +55,7 @@ exports.settleDeveloperConfirmation = settleDeveloperConfirmation;
 exports.rejectDeveloperConfirmation = rejectDeveloperConfirmation;
 exports.sweepExpiredConfirmations = sweepExpiredConfirmations;
 exports.shellPrograms = shellPrograms;
+exports.splitLocalSafetyRuleIds = splitLocalSafetyRuleIds;
 exports.findDeveloperGrant = findDeveloperGrant;
 exports.recordDeveloperGrant = recordDeveloperGrant;
 exports.listDeveloperGrants = listDeveloperGrants;
@@ -91,6 +92,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const approvalPrompt_1 = require("./approvalPrompt");
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 /**
  * Fastest plausible HUMAN answer to a confirmation prompt. A person has to notice
  * the dialog, read at least the tool name and press a button; MCP clients that
@@ -776,8 +778,45 @@ function sweepExpiredConfirmations(now = new Date(), ttlMs = exports.CONFIRM_PEN
 // ---------------------------------------------------------------------------
 /** Shell words that run the program that follows them, not a program of their own. */
 const SHELL_LEAD_WRAPPERS = new Set(['sudo', 'doas', 'env', 'nice', 'nohup', 'time', 'command', 'builtin', 'exec', 'xargs', 'timeout', 'stdbuf', 'chronic', 'busybox', 'call', 'start', '&']);
+/**
+ * Interpreters that can run *any* command. Never a grant program of their own —
+ * Always allow on `cmd` / `powershell` / `bash` would cover the next curl.
+ * `cmd /c gcloud` peels to `gcloud` via the nested `-c` / `/c` body.
+ */
+const GENERIC_SHELLS = new Set(['cmd', 'powershell', 'pwsh', 'bash', 'sh', 'zsh', 'fish', 'wsl', 'dash']);
+/**
+ * Pipeline / formatting cmdlets. They are not the app the rule asked about.
+ * Binding Always allow to `foreach-object` made every differently-wrapped
+ * `gcloud` line ask again (assaf-desktop / this machine, 2026-09-18..20).
+ */
+const SHELL_PIPELINE_NOISE = new Set([
+    'foreach-object', 'where-object', 'select-object', 'sort-object', 'measure-object',
+    'group-object', 'tee-object', 'compare-object', 'foreach',
+    'format-table', 'format-list', 'format-wide', 'format-custom',
+    'write-output', 'write-host', 'write-error', 'write-warning', 'write-verbose', 'write-debug', 'write-information',
+    'out-string', 'out-null', 'out-host', 'out-default', 'out-gridview',
+    '%', '?',
+]);
+/**
+ * Local inspect — listing, presence, identity, conversion. Not the app the
+ * rule asked about and not an exfil path. Dropped so Always allow on
+ * `gcloud …; Get-ChildItem; Test-Path` is `{gcloud}` and covers the next
+ * `gh` / `aws` / `kubectl` line the same way. Readers (`Get-Content`) and
+ * script/exfil hosts (`node`, `curl`, `Invoke-RestMethod`) stay in the set.
+ */
+const SHELL_INCIDENTAL = new Set([
+    'get-childitem', 'get-item', 'get-itemproperty', 'get-nettcpconnection', 'get-netadapter',
+    'get-netipaddress', 'get-netroute', 'get-process', 'get-service', 'get-command',
+    'get-help', 'get-alias', 'get-member', 'get-variable', 'get-location', 'get-host',
+    'get-date', 'get-history', 'get-psdrive', 'get-psprovider', 'get-module', 'get-job',
+    'get-computerinfo', 'test-path', 'resolve-path', 'split-path', 'join-path',
+    'convertfrom-json', 'convertto-json', 'convertfrom-csv', 'convertto-csv',
+    'ls', 'dir', 'pwd', 'cd', 'set-location', 'push-location', 'pop-location',
+    'hostname', 'whoami', 'uname', 'id', 'true', 'false', 'clear', 'cls',
+    'sleep', 'start-sleep', 'which', 'where.exe', 'where',
+]);
 /** Control-flow words (sh / bash / PowerShell): structure, never a program of their own. */
-const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|switch|break|continue)$/i;
+const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|exit|switch|break|continue)$/i;
 /** Words a body follows directly (`then rm x`, `do echo`, PowerShell `else { … }`). */
 const SHELL_BODY_LEADS = /^(then|do|else)$/i;
 /** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
@@ -814,14 +853,28 @@ function splitShellSegments(command) {
     segments.push(current);
     return segments;
 }
-/**
- * The programs a shell line runs — one per segment, the wrapper (`sudo`, `env`),
- * the `$var =` assignment, `KEY=value` prefixes and a leading `(` peeled off; the
- * path and `.exe` dropped; lower-cased. Sorted and unique. A segment with no
- * program (pure block structure like `} catch {`) contributes nothing.
- */
-function shellPrograms(command) {
-    const out = new Set();
+/** `out-string).trim()` is not a program — take the leading identifier only. */
+function programToken(lead) {
+    const unquoted = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop() || '';
+    const stripped = unquoted.replace(/\.(exe|cmd|bat|ps1|com)$/i, '');
+    const ident = stripped.match(/^[A-Za-z%][A-Za-z0-9_.%-]*/);
+    return ident ? ident[0].toLowerCase() : undefined;
+}
+/** Body of `cmd /c …` / `powershell -Command …` / `bash -c …`. Encoded payloads are unreadable — no grant. */
+function nestedShellBody(segment) {
+    if (/\s--?encodedcommand(?:\s|$)/i.test(segment) || /\s-ec(?:\s|$)/i.test(segment))
+        return undefined;
+    const match = segment.match(/\s(?:\/c|--?c|--?command)\s+/i);
+    if (!match || match.index === undefined)
+        return undefined;
+    let rest = segment.slice(match.index + match[0].length).trim();
+    if ((rest.startsWith('"') && rest.endsWith('"')) || (rest.startsWith("'") && rest.endsWith("'")))
+        rest = rest.slice(1, -1);
+    return rest.trim() || undefined;
+}
+function collectPrograms(command, out, depth) {
+    if (depth > 3 || !command.trim())
+        return;
     for (const raw of splitShellSegments(command)) {
         const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
@@ -876,19 +929,94 @@ function shellPrograms(command) {
         const lead = words[i];
         if (!lead || /^[$@(){}\]\[|&;<>#'"`-]/.test(lead) || SHELL_CONTROL_WORDS.test(lead))
             continue;
-        const name = lead.replace(/^["']|["']$/g, '').split(/[\\/]/).pop().replace(/\.(exe|cmd|bat|ps1|sh)$/i, '').toLowerCase();
-        if (name)
-            out.add(name);
+        const name = programToken(lead);
+        if (!name || SHELL_PIPELINE_NOISE.has(name) || SHELL_INCIDENTAL.has(name))
+            continue;
+        if (GENERIC_SHELLS.has(name)) {
+            const nested = nestedShellBody(raw);
+            if (nested)
+                collectPrograms(nested, out, depth + 1);
+            continue;
+        }
+        out.add(name);
     }
+}
+/**
+ * The real programs a shell line runs — one per segment, wrappers (`sudo`,
+ * `env`) and `$var =` peeled off. Pipeline cmdlets and generic shells are not
+ * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
+ * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
+ * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
+ * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
+ * is stripped. Sorted and unique.
+ */
+function shellPrograms(command) {
+    const out = new Set();
+    collectPrograms(command, out, 0);
     return [...out].sort();
 }
+/** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
+function splitLocalSafetyRuleIds(matchedRule) {
+    if (!matchedRule || !matchedRule.includes('+'))
+        return undefined;
+    const parts = matchedRule.split('+').map(part => part.trim()).filter(Boolean);
+    if (parts.length < 2 || !parts.every(part => /^[a-z][a-z0-9_]*$/.test(part)))
+        return undefined;
+    return parts;
+}
+function localSafetyItemIds(value) {
+    if (!value)
+        return [];
+    const prefix = 'local-safety:';
+    const raw = value.startsWith(prefix) ? value.slice(prefix.length) : value;
+    return splitLocalSafetyRuleIds(raw) || (raw ? [raw] : []);
+}
+function grantRuleApplies(grant, rule) {
+    const grantItems = localSafetyItemIds(grant.matchedRule);
+    const liveItems = localSafetyItemIds(rule.matchedRule);
+    const namesOverlap = grantItems.length > 0 && liveItems.length > 0 && liveItems.some(id => grantItems.includes(id));
+    const exactName = (grant.matchedRule || null) === (rule.matchedRule || null);
+    const exactId = (grant.policyId || null) === (rule.policyId || null);
+    const grantPolicyItems = localSafetyItemIds(grant.policyId);
+    const livePolicyItems = localSafetyItemIds(rule.policyId);
+    const policyOverlap = grantPolicyItems.length > 0 && livePolicyItems.length > 0
+        && livePolicyItems.some(id => grantPolicyItems.includes(id));
+    if (!exactId && !policyOverlap)
+        return false;
+    if (grant.policyHash === rule.policyHash && (exactName || namesOverlap))
+        return true;
+    if (!namesOverlap)
+        return false;
+    // Per-item grant (new) vs a combined live finding (joined hash).
+    if (grantItems.length === 1 && liveItems.length > 1) {
+        return grant.policyHash === localSafetyRuleHash({ itemId: grantItems[0], source: 'builtin', action: 'ask' });
+    }
+    // Combined leftover grant (joined id + joined hash) vs a later single-rule ask.
+    if (grantItems.length > 1 && liveItems.length === 1)
+        return true;
+    return false;
+}
+function expandGrantRuleIdentities(rule) {
+    const parts = splitLocalSafetyRuleIds(rule.matchedRule);
+    if (!parts)
+        return [rule];
+    const fromPolicy = rule.policyId?.startsWith('local-safety:') ? 'local-safety:' : undefined;
+    return parts.map(itemId => ({
+        policyId: fromPolicy ? `${fromPolicy}${itemId}` : rule.policyId,
+        policyName: rule.policyName?.includes('+') ? `Local Safety · ${itemId}` : rule.policyName,
+        matchedRule: itemId,
+        policyHash: localSafetyRuleHash({ itemId, source: 'builtin', action: 'ask' }),
+    }));
+}
 function grantKey(scope, policyId, matchedRule, policyHash) {
-    return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
+    return sha256(JSON.stringify([scope.event, scope.toolName, scope.programs || null, scope.scripts || null, scope.operation, scope.destinationDomain || null, policyId || null, matchedRule || null, policyHash]));
 }
 /**
- * Does a live grant cover this action under this exact rule? Shell programs match by
- * INCLUSION: a grant for `{gh, git}` covers a line that only runs `gh`, never a line
- * that also runs `curl`. Everything else must be equal. Touch counts a use.
+ * Does a live grant cover this action under this rule? Combined Local Safety
+ * asks (`a+b`) match a grant for `a` or `b`. Shell programs match by INCLUSION:
+ * a grant for `{gh, git}` covers a line that only runs `gh`, never a line that
+ * also runs `curl`. Generic shells and pipeline cmdlets are not in the set.
+ * Touch counts a use.
  *
  * `limits` are the caps in force NOW (rule + org ceiling). A grant older or wider than
  * they allow is ignored — tightening the org setting takes effect on the next action,
@@ -903,9 +1031,7 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
     const ttlCap = Math.min(exports.GRANT_TTL_MS, limits.ttlMs);
     return mutateLedger(undefined, () => {
         const ledger = readLedger();
-        const hit = ledger.grants.find(g => g.policyHash === rule.policyHash
-            && (g.policyId || null) === (rule.policyId || null)
-            && (g.matchedRule || null) === (rule.matchedRule || null)
+        const hit = ledger.grants.find(g => grantRuleApplies(g, rule)
             && g.scope.event === scope.event
             && g.scope.toolName === scope.toolName
             && g.scope.operation === scope.operation
@@ -917,7 +1043,9 @@ function findDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_MS
             && now.getTime() - Date.parse(g.grantedAt) < ttlCap
             && !grantExhausted(g, limits)
             && (scope.event !== 'shell'
-                || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p)))));
+                || (Array.isArray(g.scope.programs) && (scope.programs || []).length > 0 && (scope.programs || []).every(p => g.scope.programs.includes(p))))
+            && (!(g.scope.scripts && g.scope.scripts.length)
+                || ((scope.scripts || []).length > 0 && (scope.scripts || []).every(s => g.scope.scripts.includes(s)))));
         if (!hit)
             return undefined;
         hit.lastUsedAt = now.toISOString();
@@ -935,26 +1063,31 @@ function recordDeveloperGrant(scope, rule, limits = { ttlMs: exports.GRANT_TTL_M
         return undefined;
     const ttlMs = Math.max(60_000, Math.min(exports.GRANT_TTL_MS, limits.ttlMs));
     const maxUses = positiveCap(limits.maxUses, exports.GRANT_MAX_USES_LIMIT);
-    const grant = {
-        key: grantKey(scope, rule.policyId, rule.matchedRule, rule.policyHash),
-        scope,
-        policyId: rule.policyId,
-        policyName: rule.policyName,
-        matchedRule: rule.matchedRule,
-        policyHash: rule.policyHash,
-        grantedAt: now.toISOString(),
-        expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
-        uses: 0,
-        ...(maxUses !== undefined ? { maxUses } : {}),
-    };
+    const identities = expandGrantRuleIdentities(rule);
     return mutateLedger(undefined, () => {
         const ledger = readLedger();
-        ledger.grants = ledger.grants.filter(g => g.key !== grant.key && Date.parse(g.expiresAt) > now.getTime() && !grantExhausted(g));
-        ledger.grants.push(grant);
+        let last;
+        for (const ident of identities) {
+            const grant = {
+                key: grantKey(scope, ident.policyId, ident.matchedRule, ident.policyHash),
+                scope,
+                policyId: ident.policyId,
+                policyName: ident.policyName,
+                matchedRule: ident.matchedRule,
+                policyHash: ident.policyHash,
+                grantedAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+                uses: 0,
+                ...(maxUses !== undefined ? { maxUses } : {}),
+            };
+            ledger.grants = ledger.grants.filter(g => g.key !== grant.key && Date.parse(g.expiresAt) > now.getTime() && !grantExhausted(g));
+            ledger.grants.push(grant);
+            last = grant;
+        }
         if (ledger.grants.length > MAX_GRANTS)
             ledger.grants = ledger.grants.slice(-MAX_GRANTS);
         writeLedger(ledger);
-        return grant;
+        return last;
     });
 }
 /** Live grants: not expired and not spent. */
@@ -975,7 +1108,9 @@ function revokeDeveloperGrants(key) {
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 function describeGrantScope(scope) {
     const what = scope.event === 'shell'
-        ? `\`${(scope.programs || []).join('`, `')}\` commands`
+        ? (scope.scripts && scope.scripts.length
+            ? `running ${scope.scripts.map(s => `\`${s}\``).join(', ')}`
+            : `\`${(scope.programs || []).join('`, `')}\` commands`)
         : scope.event === 'mcp'
             ? `${scope.toolName.replace(/^mcp__/, '').replace(/__/g, ' / ')} calls`
             : `${scope.toolName} ${scope.event} actions`;
@@ -984,11 +1119,27 @@ function describeGrantScope(scope) {
     return `${what}${op}${where}`;
 }
 /** The scope a grant would have for this action — from engine facts, never from text. */
+function scriptGrantKeys(command, cwd) {
+    const base = cwd && cwd.trim() ? cwd : process.cwd();
+    const keys = (0, deterministicGuard_1.referencedScripts)(command, base)
+        .filter(script => !script.startsWith('npm:'))
+        .map(script => {
+        const rel = path.relative(base, script);
+        if (rel && !rel.startsWith('..') && !path.isAbsolute(rel))
+            return rel.replace(/\\/g, '/');
+        return path.basename(script);
+    });
+    return [...new Set(keys)].sort();
+}
 function grantScopeFor(event, toolName, toolArgs, operation, context) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
         scope.programs = shellPrograms(command);
+        const cwd = typeof toolArgs?.cwd === 'string' ? toolArgs.cwd : undefined;
+        const scripts = scriptGrantKeys(command, cwd);
+        if (scripts.length)
+            scope.scripts = scripts;
     }
     const domain = context?.['destination.domain'];
     if (typeof domain === 'string' && domain.trim())

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.3"
+  "version": "1.35.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.3",
+  "version": "1.35.5",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -20,6 +20,7 @@
     "test:endpoint-approvals": "npm run build && node scripts/audit-endpoint-mcp-shell.js",
     "test:endpoint-clients": "npm run build && node scripts/test-endpoint-client-matrix.js && node scripts/test-copilot-hook-install.js",
     "build": "tsc && node scripts/bundle-policy-engine.js && node scripts/copy-attack-corpus.js && node scripts/bundle-containment-runtime.js",
+    "test:ask-dialog": "npm run build && node scripts/test-ask-dialog.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
     "test:drive-delete-guard": "npm run build && node scripts/test-drive-delete-guard.js",
     "test:msi-stop-filter": "node scripts/test-msi-stop-filter.js",
@@ -99,6 +100,7 @@
     "test:qa-loop": "node scripts/test-qa-command-generator.js && node scripts/test-qa-loop-offline.js && node scripts/test-qa-loop-server.js",
     "qa-loop": "node scripts/run-machine-qa-loop.js --offline",
     "test:ide-fp-corpus": "npm run build && node scripts/test-ide-fp-corpus.js",
+    "test:web-dev-policy-eval": "npm run build && node scripts/test-web-dev-policy-eval.js",
     "test:secret-shapes": "npm run build && node scripts/test-secret-locator-shapes.js",
     "test:ide-fp-corpus:hook": "npm run build && node scripts/test-ide-fp-corpus.js --hook",
     "test:msi-payload-deps": "npm run build && node scripts/test-msi-payload-deps.js",