fullcourtdefense-cli 1.35.5 → 1.35.7

package/dist/commands/hook.js

@@ -820,7 +820,9 @@ function prepareDeveloperConfirmation(event, call, payload, source) {
     // this exact rule (same rule hash). Rules that forbid memory never reach here.
     // The caps in force come from the rule and the org ceiling in the cached bundle;
     // an org that switched "Always allow" off (`null`) honours no grant at all.
-    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context);
+    // The grant binds the facts THIS rule fired on: a credential-command rule is
+    // about the program, an egress / SSRF / exfil rule is about the host too.
+    const grantScope = (0, devConfirm_1.grantScopeFor)(event, call.toolName, call.toolArgs, operation, context, (0, devConfirm_1.grantRuleFactsFor)(source));
     const grantLimits = (0, devConfirm_1.resolveGrantLimits)(source.grantCaps, (0, runtimeConfig_1.getCachedDeveloperGrantPolicy)());
     const grant = source.remember === 'none' ? undefined : (0, devConfirm_1.findDeveloperGrant)(grantScope, { policyId: source.policyId, matchedRule: source.matchedRule, policyHash: memoryHash }, grantLimits);
     if (grant) {

package/dist/devConfirm.d.ts

@@ -293,8 +293,10 @@ export declare function sweepExpiredConfirmations(now?: Date, ttlMs?: number): P
  * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
  * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
  * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
- * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
- * is stripped. Sorted and unique.
+ * wrapper mix. Text filters after a pipe (`| Select-String`, `| grep | head`)
+ * are output shaping, not programs; the same names leading a statement
+ * (`head .env`) stay. `exit` is control flow. Trailing junk
+ * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 export declare function shellPrograms(command: string): string[];
 /** Local Safety item ids joined as `a+b` when two ask-rules fire in one dialog. */
@@ -332,7 +334,38 @@ export declare function listDeveloperGrants(now?: Date): DeveloperGrant[];
 export declare function revokeDeveloperGrants(key?: string): number;
 /** One line a person can read on the button and in the grant list: what "Always allow" covers. */
 export declare function describeGrantScope(scope: GrantScope): string;
-export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined): GrantScope;
+/**
+ * Which line-level facts the RULE that asked actually depends on. A grant binds
+ * the facts the rule fired on and nothing else: `gcloud_access_token_cmd` fired
+ * on `gcloud auth print-access-token`, so where a later `Invoke-RestMethod` in
+ * the same line posts (`logging.` vs `monitoring.googleapis.com`) and whether
+ * the engine classed the line `write` or `SHELL` must not partition the grant —
+ * that is what made every Always allow ask again (this machine, 2026-09-14..20).
+ * A rule that IS about the host (egress policy, SSRF, exfiltration, reverse
+ * shell) keeps the host in the grant so `evil.example` never rides on it.
+ */
+export interface GrantRuleFacts {
+    bindsDestination: boolean;
+}
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+export declare function grantRuleFactsFor(source: {
+    localFinding?: {
+        category?: string;
+    };
+    policyId?: string;
+    policies?: Array<{
+        id: string;
+        rules?: Array<{
+            constraints?: Array<{
+                field: string;
+            }>;
+        }>;
+    }>;
+}): GrantRuleFacts;
+export declare function grantScopeFor(event: string, toolName: string, toolArgs: Record<string, unknown> | undefined, operation: string, context: Record<string, unknown> | undefined, facts?: GrantRuleFacts): GrantScope;
 /**
  * Is this exact action covered in the same session and policy context?
  * The 1h choice is a shorter expiry, never authorization for another session.

package/dist/devConfirm.js

@@ -61,6 +61,7 @@ exports.recordDeveloperGrant = recordDeveloperGrant;
 exports.listDeveloperGrants = listDeveloperGrants;
 exports.revokeDeveloperGrants = revokeDeveloperGrants;
 exports.describeGrantScope = describeGrantScope;
+exports.grantRuleFactsFor = grantRuleFactsFor;
 exports.grantScopeFor = grantScopeFor;
 exports.isConfirmationRemembered = isConfirmationRemembered;
 /**
@@ -819,11 +820,31 @@ const SHELL_INCIDENTAL = new Set([
 const SHELL_CONTROL_WORDS = /^(if|then|else|elif|elseif|fi|do|done|for|while|until|case|esac|try|catch|finally|foreach|function|return|exit|switch|break|continue)$/i;
 /** Words a body follows directly (`then rm x`, `do echo`, PowerShell `else { … }`). */
 const SHELL_BODY_LEADS = /^(then|do|else)$/i;
-/** Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not semantics. */
+/**
+ * Text filters. In PIPELINE position (`gcloud … | Select-String x`, `gh … | grep
+ * y | head -1`) they shape the previous program's output and are not the app the
+ * rule asked about — binding Always allow to `select-string` made the next
+ * `gcloud … | Select-Object` line ask again (this machine, 2026-09-20). As a
+ * statement LEAD they read the file they are given (`head .env`, `grep x
+ * ~/.aws/credentials`) and stay the program.
+ */
+const SHELL_TEXT_FILTERS = new Set([
+    'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'sls', 'awk', 'gawk', 'sed',
+    'head', 'tail', 'wc', 'sort', 'uniq', 'cut', 'tr', 'jq', 'yq', 'column', 'nl', 'more', 'less', 'cat', 'tee',
+]);
+/**
+ * Cheap quote-aware split on `; && || | \n` — the grant needs program NAMES, not
+ * semantics. Separators inside `{ … }` do not split: a control statement's
+ * bodies (`if (…) { a; b } else { c }`) stay with their statement so every
+ * body is read (`braceBodies`). `piped` = this segment is a pipeline stage
+ * (`|`, not `||`).
+ */
 function splitShellSegments(command) {
     const segments = [];
     let current = '';
+    let piped = false;
     let quote = null;
+    let braces = 0;
     for (let i = 0; i < command.length; i++) {
         const ch = command[i];
         if (quote) {
@@ -839,18 +860,28 @@ function splitShellSegments(command) {
             current += ch;
             continue;
         }
-        if (ch === '\n' || ch === ';' || ch === '|' || (ch === '&' && command[i + 1] === '&')) {
+        if (ch === '{')
+            braces++;
+        else if (ch === '}' && braces > 0)
+            braces--;
+        if (braces === 0 && (ch === '\n' || ch === ';' || ch === '|' || (ch === '&' && command[i + 1] === '&'))) {
+            let nextPiped = false;
             if (ch === '&')
                 i++;
-            if (ch === '|' && command[i + 1] === '|')
-                i++;
-            segments.push(current);
+            if (ch === '|') {
+                if (command[i + 1] === '|')
+                    i++;
+                else
+                    nextPiped = true;
+            }
+            segments.push({ text: current, piped });
             current = '';
+            piped = nextPiped;
             continue;
         }
         current += ch;
     }
-    segments.push(current);
+    segments.push({ text: current, piped });
     return segments;
 }
 /** `out-string).trim()` is not a program — take the leading identifier only. */
@@ -872,10 +903,58 @@ function nestedShellBody(segment) {
         rest = rest.slice(1, -1);
     return rest.trim() || undefined;
 }
+/**
+ * Every top-level `{ … }` body of a control statement, quote-aware. An
+ * unterminated body (a segment cut before its `}`) yields what follows the
+ * `{` — under-reading a body is what let a branch hide a program.
+ */
+function braceBodies(statement) {
+    const bodies = [];
+    let quote = null;
+    let depth = 0;
+    let start = -1;
+    let data = false; // `${VAR}` / `@{ k = v }` — an expansion or a hashtable, not a script block
+    for (let i = 0; i < statement.length; i++) {
+        const ch = statement[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else if (ch === '\\' && quote === '"')
+                i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            quote = ch;
+            continue;
+        }
+        if (ch === '{') {
+            if (depth++ === 0) {
+                data = /[$@]/.test(statement[i - 1] || '');
+                start = i + 1;
+            }
+            continue;
+        }
+        if (ch === '}' && depth > 0 && --depth === 0) {
+            if (!data)
+                bodies.push(statement.slice(start, i));
+            start = -1;
+        }
+    }
+    if (start >= 0 && !data)
+        bodies.push(statement.slice(start));
+    return bodies.map(body => body.trim()).filter(Boolean);
+}
 function collectPrograms(command, out, depth) {
-    if (depth > 3 || !command.trim())
+    if (depth > 6 || !command.trim())
         return;
-    for (const raw of splitShellSegments(command)) {
+    for (const { text: raw, piped } of splitShellSegments(command)) {
+        // Script blocks anywhere in the statement run programs of their own —
+        // `if (c) { a } else { b }`, `… | ForEach-Object { curl … }`, `try { … } catch { … }`,
+        // `{ git status }`. EVERY body is read: reading only the first let a `{gh}`
+        // grant cover `if ($x) { gh auth token } else { curl https://evil… }`.
+        if (raw.includes('{'))
+            for (const body of braceBodies(raw))
+                collectPrograms(body, out, depth + 1);
         const words = raw.trim().split(/\s+/).filter(Boolean);
         let i = 0;
         // `$r = Invoke-WebRequest …` / `$r=Invoke-WebRequest …` / `FOO=bar cmd …` / `$t = (gcloud …)`
@@ -906,23 +985,10 @@ function collectPrograms(command, out, depth) {
                 i++;
                 continue;
             }
+            // Control statement: its bodies were read above; the statement itself is not a program.
             if (SHELL_CONTROL_WORDS.test(w)) {
-                // `if (cond) { body }` / `foreach ($x in $y) { body }` / `else { body }`: the program
-                // runs in the body, so skip to the first `{` and read on from there.
-                const open = words.findIndex((word, index) => index > i && word.includes('{'));
-                if (open < 0) {
-                    i = words.length;
-                    break;
-                }
-                const rest = words[open].slice(words[open].indexOf('{') + 1);
-                if (rest) {
-                    words[open] = rest;
-                    i = open;
-                }
-                else {
-                    i = open + 1;
-                }
-                continue;
+                i = words.length;
+                break;
             }
             break;
         }
@@ -932,6 +998,8 @@ function collectPrograms(command, out, depth) {
         const name = programToken(lead);
         if (!name || SHELL_PIPELINE_NOISE.has(name) || SHELL_INCIDENTAL.has(name))
             continue;
+        if (piped && SHELL_TEXT_FILTERS.has(name))
+            continue;
         if (GENERIC_SHELLS.has(name)) {
             const nested = nestedShellBody(raw);
             if (nested)
@@ -947,8 +1015,10 @@ function collectPrograms(command, out, depth) {
  * programs: `gcloud … | ForEach-Object` is `{gcloud}`, `cmd /c gcloud` is
  * `{gcloud}`. Inspect cmdlets (`Get-ChildItem`, `Test-Path`) are dropped so
  * Always allow is the real app (`gcloud` / `gh` / `aws` / …), not that
- * wrapper mix. `exit` is control flow. Trailing junk (`out-string).trim()`)
- * is stripped. Sorted and unique.
+ * wrapper mix. Text filters after a pipe (`| Select-String`, `| grep | head`)
+ * are output shaping, not programs; the same names leading a statement
+ * (`head .env`) stay. `exit` is control flow. Trailing junk
+ * (`out-string).trim()`) is stripped. Sorted and unique.
  */
 function shellPrograms(command) {
     const out = new Set();
@@ -1131,7 +1201,25 @@ function scriptGrantKeys(command, cwd) {
     });
     return [...new Set(keys)].sort();
 }
-function grantScopeFor(event, toolName, toolArgs, operation, context) {
+/** Local Safety categories whose finding is the destination host itself. */
+const DESTINATION_BOUND_CATEGORIES = new Set(['metadata_ssrf', 'secret_exfiltration', 'reverse_shell']);
+/**
+ * Derive `GrantRuleFacts` from the source of the ask. Unknown = bound (the
+ * narrower grant), so a policy the cache no longer holds never widens anything.
+ */
+function grantRuleFactsFor(source) {
+    if (source.localFinding) {
+        return { bindsDestination: DESTINATION_BOUND_CATEGORIES.has(String(source.localFinding.category || '')) };
+    }
+    const policy = source.policyId ? source.policies?.find(p => p.id === source.policyId) : undefined;
+    if (!policy)
+        return { bindsDestination: true };
+    const bindsDestination = (policy.rules || []).some(rule => (rule.constraints || []).some(c => typeof c.field === 'string' && c.field.startsWith('destination.')));
+    return { bindsDestination };
+}
+/** Grants made without rule facts (MCP gateway, older callers) keep the narrow, host-bound shape. */
+const DEFAULT_GRANT_RULE_FACTS = { bindsDestination: true };
+function grantScopeFor(event, toolName, toolArgs, operation, context, facts = DEFAULT_GRANT_RULE_FACTS) {
     const scope = { event, toolName, operation: String(operation || '').trim() || 'unknown' };
     if (event === 'shell') {
         const command = typeof toolArgs?.command === 'string' ? toolArgs.command : typeof toolArgs?.cmd === 'string' ? toolArgs.cmd : '';
@@ -1140,9 +1228,14 @@ function grantScopeFor(event, toolName, toolArgs, operation, context) {
         const scripts = scriptGrantKeys(command, cwd);
         if (scripts.length)
             scope.scripts = scripts;
+        // A shell line's identity is its programs. The engine verb (`write` for a
+        // POST, `SHELL` otherwise) describes the line, not the app the rule asked
+        // about, and it changed the key between two `gcloud … ; Invoke-RestMethod`
+        // lines that fired the very same rule. One verb for every shell grant.
+        scope.operation = 'SHELL';
     }
     const domain = context?.['destination.domain'];
-    if (typeof domain === 'string' && domain.trim())
+    if (facts.bindsDestination && typeof domain === 'string' && domain.trim())
         scope.destinationDomain = domain.trim().toLowerCase();
     return scope;
 }

package/dist/telemetry.js

@@ -84,6 +84,26 @@ const ACTION_EVIDENCE_KEYS = [
 ];
 /** Noise / secrets — never stamp these as activity evidence. */
 const EVIDENCE_SKIP_KEYS = /^(cwd|pwd|env|environment|headers|cookie|cookies|authorization|password|passwd|secret|token|api[_-]?key|private[_-]?key|session|retryCount|timeoutMs|timeout)$/i;
+/**
+ * Payload keys — a file body, a patch, message text — are business content,
+ * never evidence. The record carries the ACTION (tool, path, command, verdict,
+ * rule); what was written is the customer's. Only the size leaves the machine:
+ * a `.env` edit on a fleet machine shipped its whole body, signing secret
+ * included, before this (2026-09-18). The suffix is the backend's idempotency
+ * marker (`modules/runtime/tool-args.ts`), so re-sanitizing leaves it alone.
+ */
+const EVIDENCE_CONTENT_KEYS = /^(content|contents|body|file_?contents?|stdin|payload|diff|patch|new_?str(ing)?|old_?str(ing)?)$/i;
+/** Text a human or agent TYPED into a field or a page script — count only, the same rule the backend applies on read. */
+const EVIDENCE_TYPED_TEXT_KEYS = /^(text|value|input|keys|type_?text)$/i;
+function minimizedEvidenceValue(key, value) {
+    if (typeof value !== 'string')
+        return undefined;
+    if (EVIDENCE_CONTENT_KEYS.test(key))
+        return `[… ${value.length} chars total — content minimized]`;
+    if (EVIDENCE_TYPED_TEXT_KEYS.test(key))
+        return `[${value.length} character${value.length === 1 ? '' : 's'} typed]`;
+    return undefined;
+}
 function stringifyEvidenceValue(value) {
     // One value (the command line) may use most of the envelope; keys and quoting take the rest.
     if (typeof value === 'string' && value.trim())
@@ -128,7 +148,7 @@ function evidenceFromToolArgs(toolArgs) {
             continue;
         if (Object.keys(picked).length >= 8)
             break;
-        const text = stringifyEvidenceValue(value);
+        const text = minimizedEvidenceValue(key, value) || stringifyEvidenceValue(value);
         if (text)
             picked[key] = text;
     }

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.35.5"
+  "version": "1.35.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.35.5",
+  "version": "1.35.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {