fullcourtdefense-cli 1.35.5 → 1.35.6

package/dist/devConfirm.d.ts

@@ -293,8 +293,10 @@ export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): P
  * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
  * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
  * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
- * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
- * is stripped. Sorted and unique.
+ * wrapper mix. Text filters after a pipe (`| Select-String`, `| grep | head`)
+ * are output shaping, not programs; the same names leading a statement
+ * (`head .env`) stay. `exit` is control flow. Trailing junk
+ * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 export declare function shellPrograms(command: string): string[];
 /** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */

package/dist/devConfirm.js

@@ -819,11 +819,31 @@ const SHELL_INCIDENTAL = new Set([
 const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|exit|switch|break|continue)$/i;
 /** Words a body follows directly (`then rm x`, `do echo`, PowerShell `else { … }`). */
 const SHELL_BODY_LEADS = /^(then|do|else)$/i;
-/** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
+/**
+ * Text filters. In PIPELINE position (`gcloud … | Select-String x`, `gh … | grep
+ * y | head -1`) they shape the previous program's output and are not the app the
+ * rule asked about — binding Always allow to `select-string` made the next
+ * `gcloud … | Select-Object` line ask again (this machine, 2026-09-20). As a
+ * statement LEAD they read the file they are given (`head .env`, `grep x
+ * ~/.aws/credentials`) and stay the program.
+ */
+const SHELL_TEXT_FILTERS = new Set([
+    'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'sls', 'awk', 'gawk', 'sed',
+    'head', 'tail', 'wc', 'sort', 'uniq', 'cut', 'tr', 'jq', 'yq', 'column', 'nl', 'more', 'less', 'cat', 'tee',
+]);
+/**
+ * Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not
+ * semantics. Separators inside `{ … }` do not split: a control statement's
+ * bodies (`if (…) { a; b } else { c }`) stay with their statement so every
+ * body is read (`braceBodies`). `piped` = this segment is a pipeline stage
+ * (`|`, not `||`).
+ */
 function splitShellSegments(command) {
     const segments = [];
     let current = '';
+    let piped = false;
     let quote = null;
+    let braces = 0;
     for (let i = 0; i < command.length; i++) {
         const ch = command[i];
         if (quote) {
@@ -839,18 +859,28 @@ function splitShellSegments(command) {
             current += ch;
             continue;
         }
-        if (ch === '\n' || ch === ';' || ch === '|' || (ch === '&' && command[i + 1] === '&')) {
+        if (ch === '{')
+            braces++;
+        else if (ch === '}' && braces > 0)
+            braces--;
+        if (braces === 0 && (ch === '\n' || ch === ';' || ch === '|' || (ch === '&' && command[i + 1] === '&'))) {
+            let nextPiped = false;
             if (ch === '&')
                 i++;
-            if (ch === '|' && command[i + 1] === '|')
-                i++;
-            segments.push(current);
+            if (ch === '|') {
+                if (command[i + 1] === '|')
+                    i++;
+                else
+                    nextPiped = true;
+            }
+            segments.push({ text: current, piped });
             current = '';
+            piped = nextPiped;
             continue;
         }
         current += ch;
     }
-    segments.push(current);
+    segments.push({ text: current, piped });
     return segments;
 }
 /** `out-string).trim()` is not a program — take the leading identifier only. */
@@ -872,10 +902,58 @@ function nestedShellBody(segment) {
         rest = rest.slice(1, -1);
     return rest.trim() || undefined;
 }
+/**
+ * Every top-level `{ … }` body of a control statement, quote-aware. An
+ * unterminated body (a segment cut before its `}`) yields what follows the
+ * `{` — under-reading a body is what let a branch hide a program.
+ */
+function braceBodies(statement) {
+    const bodies = [];
+    let quote = null;
+    let depth = 0;
+    let start = -1;
+    let data = false; // `${VAR}` / `@{ k = v }` — an expansion or a hashtable, not a script block
+    for (let i = 0; i < statement.length; i++) {
+        const ch = statement[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else if (ch === '\\' && quote === '"')
+                i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+            continue;
+        }
+        if (ch === '{') {
+            if (depth++ === 0) {
+                data = /[$@]/.test(statement[i - 1] || '');
+                start = i + 1;
+            }
+            continue;
+        }
+        if (ch === '}' && depth > 0 && --depth === 0) {
+            if (!data)
+                bodies.push(statement.slice(start, i));
+            start = -1;
+        }
+    }
+    if (start >= 0 && !data)
+        bodies.push(statement.slice(start));
+    return bodies.map(body => body.trim()).filter(Boolean);
+}
 function collectPrograms(command, out, depth) {
-    if (depth > 3 || !command.trim())
+    if (depth > 6 || !command.trim())
         return;
-    for (const raw of splitShellSegments(command)) {
+    for (const { text: raw, piped } of splitShellSegments(command)) {
+        // Script blocks anywhere in the statement run programs of their own —
+        // `if (c) { a } else { b }`, `… | ForEach-Object { curl … }`, `try { … } catch { … }`,
+        // `{ git status }`. EVERY body is read: reading only the first let a `{gh}`
+        // grant cover `if ($x) { gh auth token } else { curl https://evil… }`.
+        if (raw.includes('{'))
+            for (const body of braceBodies(raw))
+                collectPrograms(body, out, depth + 1);
         const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
         // `$r = Invoke-WebRequest …` / `$r=Invoke-WebRequest …` / `FOO=bar cmd …` / `$t = (gcloud …)`
@@ -906,23 +984,10 @@ function collectPrograms(command, out, depth) {
                 i++;
                 continue;
             }
+            // Control statement: its bodies were read above; the statement itself is not a program.
             if (SHELL_CONTROL_WORDS.test(w)) {
-                // `if (cond) { body }` / `foreach ($x in $y) { body }` / `else { body }`: the program
-                // runs in the body, so skip to the first `{` and read on from there.
-                const open = words.findIndex((word, index) => index > i && word.includes('{'));
-                if (open < 0) {
-                    i = words.length;
-                    break;
-                }
-                const rest = words[open].slice(words[open].indexOf('{') + 1);
-                if (rest) {
-                    words[open] = rest;
-                    i = open;
-                }
-                else {
-                    i = open + 1;
-                }
-                continue;
+                i = words.length;
+                break;
             }
             break;
         }
@@ -932,6 +997,8 @@ function collectPrograms(command, out, depth) {
         const name = programToken(lead);
         if (!name || SHELL_PIPELINE_NOISE.has(name) || SHELL_INCIDENTAL.has(name))
             continue;
+        if (piped && SHELL_TEXT_FILTERS.has(name))
+            continue;
         if (GENERIC_SHELLS.has(name)) {
             const nested = nestedShellBody(raw);
             if (nested)
@@ -947,8 +1014,10 @@ function collectPrograms(command, out, depth) {
  * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
  * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
  * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
- * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
- * is stripped. Sorted and unique.
+ * wrapper mix. Text filters after a pipe (`| Select-String`, `| grep | head`)
+ * are output shaping, not programs; the same names leading a statement
+ * (`head .env`) stay. `exit` is control flow. Trailing junk
+ * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 function shellPrograms(command) {
     const out = new Set();

package/dist/telemetry.js

@@ -84,6 +84,26 @@ const ACTION_EVIDENCE_KEYS = [
 ];
 /** Noise / secrets — never stamp these as activity evidence. */
 const EVIDENCE_SKIP_KEYS = /^(cwd|pwd|env|environment|headers|cookie|cookies|authorization|password|passwd|secret|token|api[_-]?key|private[_-]?key|session|retryCount|timeoutMs|timeout)$/i;
+/**
+ * Payload keys — a file body, a patch, message text — are business content,
+ * never evidence. The record carries the ACTION (tool, path, command, verdict,
+ * rule); what was written is the customer's. Only the size leaves the machine:
+ * a `.env` edit on a fleet machine shipped its whole body, signing secret
+ * included, before this (2026-09-18). The suffix is the backend's idempotency
+ * marker (`modules/runtime/tool-args.ts`), so re-sanitizing leaves it alone.
+ */
+const EVIDENCE_CONTENT_KEYS = /^(content|contents|body|file_?contents?|stdin|payload|diff|patch|new_?str(ing)?|old_?str(ing)?)$/i;
+/** Text a human or agent TYPED into a field or a page script — count only, the same rule the backend applies on read. */
+const EVIDENCE_TYPED_TEXT_KEYS = /^(text|value|input|keys|type_?text)$/i;
+function minimizedEvidenceValue(key, value) {
+    if (typeof value !== 'string')
+        return undefined;
+    if (EVIDENCE_CONTENT_KEYS.test(key))
+        return `[… ${value.length} chars total — content minimized]`;
+    if (EVIDENCE_TYPED_TEXT_KEYS.test(key))
+        return `[${value.length} character${value.length === 1 ? '' : 's'} typed]`;
+    return undefined;
+}
 function stringifyEvidenceValue(value) {
     // One value (the command line) may use most of the envelope; keys and quoting take the rest.
     if (typeof value === 'string' && value.trim())
@@ -128,7 +148,7 @@ function evidenceFromToolArgs(toolArgs) {
             continue;
         if (Object.keys(picked).length >= 8)
             break;
-        const text = stringifyEvidenceValue(value);
+        const text = minimizedEvidenceValue(key, value) || stringifyEvidenceValue(value);
         if (text)
             picked[key] = text;
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.5"
+  "version": "1.35.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.5",
+  "version": "1.35.6",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {