fullcourtdefense-cli 1.35.6 → 1.35.8

package/dist/actionPolicyEngine.d.ts

@@ -234,6 +234,43 @@ export declare function toolCapabilities(value: string): Set<string>;
  */
 export type SecretKind = 'github_token' | 'aws_access_key' | 'google_api_key' | 'openai_key' | 'slack_token' | 'jwt' | 'private_key' | 'assignment' | 'high_entropy' | 'none';
 export declare function detectSecretKind(raw: string): SecretKind;
+export type ShellAstMode = 'off' | 'shadow' | 'primary';
+/** Structural subset of shellAst.ts ShellFacts that the engine reads. */
+export interface ShellAstFactsLike {
+    complete: boolean;
+    commands: Array<{
+        name: string;
+        argv: string[];
+        literal: boolean[];
+        text: string;
+        pipeline: number;
+        cwdScope: 'scoped' | 'unscoped' | 'unknown';
+        depth?: {
+            subshell: number;
+            function: number;
+            loop: number;
+            conditional: number;
+            substitution: number;
+        };
+        wrapper?: {
+            kind: string;
+            program: string;
+            inner?: ShellAstFactsLike;
+        };
+    }>;
+}
+export interface ShellAstOperationComparison {
+    mode: ShellAstMode;
+    complete: boolean;
+    regex: string;
+    ast?: string;
+    agree: boolean;
+}
+export declare function setShellAstProvider(provider: ((command: string) => ShellAstFactsLike | undefined) | undefined): void;
+export declare function setShellAstMode(mode: ShellAstMode): void;
+export declare function getShellAstMode(): ShellAstMode;
+/** Shadow telemetry: the comparison recorded by the most recent top-level shell classification (consumed once). */
+export declare function takeShellAstOperationComparison(): ShellAstOperationComparison | undefined;
 /**
  * Check a tool call against action policies.
  * Returns the most restrictive matching verdict (pure — callers do their own logging).

package/dist/actionPolicyEngine.js

@@ -31,6 +31,7 @@ __export(actionPolicyEngine_exports, {
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
+  getShellAstMode: () => getShellAstMode,
   inferBundledToolContext: () => inferBundledToolContext,
   inferToolContext: () => inferToolContext,
   inventoryToolMatchesActionPolicy: () => inventoryToolMatchesActionPolicy,
@@ -40,6 +41,9 @@ __export(actionPolicyEngine_exports, {
   resolveApprovalOptions: () => resolveApprovalOptions,
   roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
+  setShellAstMode: () => setShellAstMode,
+  setShellAstProvider: () => setShellAstProvider,
+  takeShellAstOperationComparison: () => takeShellAstOperationComparison,
   toolCapabilities: () => toolCapabilities
 });
 module.exports = __toCommonJS(actionPolicyEngine_exports);
@@ -7726,7 +7730,17 @@ function shellCommandWords(command, depth = 0) {
   }
   return parts.join(" ; ");
 }
-function isWorkspaceScopedRemoval(command) {
+function cdScopeOfSegment(segment) {
+  const m = /^\s*(?:(?:then|do|else)\s+)?cd\s+(?:--\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/i.exec(segment);
+  if (!m) return void 0;
+  const target = m[1].replace(/^["']|["']$/g, "").trim().replace(/\\/g, "/");
+  const lower = target.toLowerCase();
+  if (!lower) return "unscoped";
+  if (/^(?:\/+\*?|~\/*\*?|\.{1,2}\/?|-|\$home\/?|\$\{home\}\/?|%userprofile%\/?|\$env:userprofile\/?|[a-z]:\/*\*?)$/.test(lower)) return "unscoped";
+  if (/^(?:\$\{?[a-z_][a-z0-9_]*\}?|%[a-z_][a-z0-9_]*%|\$env:[a-z_][a-z0-9_]*)\/?$/.test(lower)) return "unscoped";
+  return lower.split("/").some((part) => part && part !== "." && part !== "..") ? "scoped" : "unscoped";
+}
+function isWorkspaceScopedRemoval(command, cwdScoped = false) {
   const segments = splitShellSegments(command, true);
   const removal = segments.find((seg) => /\b(rm|del|remove-item|rmdir)\b/i.test(seg)) || command;
   const tokens = removal.trim().split(/\s+/).slice(1);
@@ -7734,7 +7748,8 @@ function isWorkspaceScopedRemoval(command) {
   if (targets.length === 0) return false;
   return targets.every((raw) => {
     const t = raw.replace(/^["']|["']$/g, "");
-    if (!t || t === "*" || t === "." || t === ".." || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t)) return false;
+    if (t === "*" || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t)) return cwdScoped;
+    if (!t || t === "." || t === "..") return false;
     if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t)) return false;
     if (/\$|%|\$\{|\$\(|`/.test(t)) return false;
     if (/(^|[\/\\])\.\.([\/\\]|$)/.test(t)) return false;
@@ -7860,7 +7875,7 @@ function isInertValueExpression(raw) {
   return /^(?:""|-?\d)/.test(body);
 }
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
-function classifyShellSegment(segment, depth = 0) {
+function classifyShellSegment(segment, depth = 0, cwdScoped = false) {
   const raw = segment.trim();
   if (!raw) return "read";
   if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
@@ -7892,9 +7907,9 @@ function classifyShellSegment(segment, depth = 0) {
     }
     return worstShellOp([classifyShellWords(maskQuotedSpans(raw), raw, lead)], "SHELL");
   }
-  return classifyShellWords(maskQuotedSpans(raw), raw, lead);
+  return classifyShellWords(maskQuotedSpans(raw), raw, lead, cwdScoped);
 }
-function classifyShellWords(masked, raw, lead) {
+function classifyShellWords(masked, raw, lead, cwdScoped = false) {
   const value = masked.trim().toLowerCase();
   if (!value) return "read";
   const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
@@ -7942,8 +7957,10 @@ function classifyShellWords(masked, raw, lead) {
     if (GCLOUD_WRITE_VERB_RE.test(gcloudVerb)) return pipesIntoInterpreter ? "SHELL" : "write";
   }
   if (/^(?:kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
-  if (/\b(rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r|del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
-    return isWorkspaceScopedRemoval(segment) ? "write" : "DELETE";
+  const rmFlags = /\brm\s+((?:--?[a-z][a-z-]*\s+)+)/.exec(value) || /\brm\s+((?:--?[a-z][a-z-]*\s+)+)/.exec(maskQuotedSpans(raw.replace(/["'](--?[A-Za-z][A-Za-z-]*)["']/g, "$1")).toLowerCase());
+  const rmRecursiveForce = Boolean(rmFlags && /(?:^|\s)(?:-[a-z]*r[a-z]*|--recursive)\s/.test(rmFlags[1]) && /(?:^|\s)(?:-[a-z]*f[a-z]*|--force)\s/.test(rmFlags[1]));
+  if (rmRecursiveForce || /\b(del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
+    return isWorkspaceScopedRemoval(segment, cwdScoped) ? "write" : "DELETE";
   }
   if (/\b(drop\s+(database|table|schema)|truncate\s+table|kubectl\s+delete|terraform\s+destroy|gcloud\s+(?:sql\s+instances|compute\s+instances|projects|run\s+services)\s+delete|az\s+(?:group|vm|sql\s+server)\s+delete|aws\s+(?:s3\s+rb|rds\s+delete-db-instance|ec2\s+terminate-instances)|docker\s+(?:system\s+prune|volume\s+rm|rm\s+-f)|mkfs|dd\s+if=)\b/.test(value)) {
     return "DELETE";
@@ -8002,12 +8019,159 @@ function storageUriIsDestination(segment, index = 0, all = []) {
   return false;
 }
 var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
+var shellAstProvider;
+var shellAstMode = "shadow";
+var lastShellAstOperationComparison;
+function setShellAstProvider(provider) {
+  shellAstProvider = provider;
+}
+function setShellAstMode(mode) {
+  shellAstMode = mode;
+}
+function getShellAstMode() {
+  return shellAstMode;
+}
+function takeShellAstOperationComparison() {
+  const value = lastShellAstOperationComparison;
+  lastShellAstOperationComparison = void 0;
+  return value;
+}
+function shellAstFactsFullyComplete(facts) {
+  if (!facts || !facts.complete) return false;
+  for (const command of facts.commands) if (command.wrapper?.inner && !shellAstFactsFullyComplete(command.wrapper.inner)) return false;
+  return true;
+}
+var AST_TRANSPARENT_WRAPPERS = /* @__PURE__ */ new Set(["sudo", "doas", "pkexec", "run0", "gosu", "runuser", "env", "nice", "nohup", "ionice", "chrt", "stdbuf", "timeout", "command", "builtin", "time", "exec"]);
+function astRemovalOperation(command, inContainer) {
+  let argv = command.argv;
+  let literal2 = command.literal;
+  let name = command.name;
+  for (let guard = 0; guard < 4 && AST_TRANSPARENT_WRAPPERS.has(name); guard++) {
+    let i2 = 1;
+    while (i2 < argv.length && (argv[i2].startsWith("-") && argv[i2] !== "-" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i2]))) {
+      if (/^-(?:u|g|h|C|p|r|t|U|D)$/.test(argv[i2])) i2++;
+      i2++;
+    }
+    if (i2 >= argv.length || !literal2[i2]) return void 0;
+    argv = argv.slice(i2);
+    literal2 = literal2.slice(i2);
+    name = argv[0].replace(/^.*\//, "").replace(/\.exe$/i, "").toLowerCase();
+  }
+  if (name !== "rm") return void 0;
+  let recursive = false;
+  let force = false;
+  const targets = [];
+  let flagsDone = false;
+  for (let i2 = 1; i2 < argv.length; i2++) {
+    const word = argv[i2];
+    if (!flagsDone && word === "--") {
+      flagsDone = true;
+      continue;
+    }
+    if (!flagsDone && /^--/.test(word)) {
+      if (/^--recursive$/i.test(word)) recursive = true;
+      if (/^--force$/i.test(word)) force = true;
+      continue;
+    }
+    if (!flagsDone && /^-[A-Za-z]+$/.test(word)) {
+      if (/[rR]/.test(word)) recursive = true;
+      if (/f/.test(word)) force = true;
+      continue;
+    }
+    targets.push(word);
+  }
+  if (!recursive || !force) return void 0;
+  if (targets.length === 0) return "write";
+  const scoped = targets.every((raw) => {
+    const t = raw.trim().replace(/\\/g, "/");
+    if (/^(?:\*|\.\/+\*)$/.test(t)) return inContainer || command.cwdScope === "scoped";
+    if (!t || t === "." || t === "..") return false;
+    if (/^[\/]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t)) return false;
+    if (/\$|%|`/.test(t)) return false;
+    if (/(^|\/)\.\.(\/|$)/.test(t)) return false;
+    return true;
+  });
+  return scoped ? "write" : "DELETE";
+}
+function classifyShellFromAst(facts, depth, inContainer = false) {
+  const ops = [];
+  let pipeline = 0;
+  let pipelineText = [];
+  let pipelineScoped = false;
+  let pipelineFloor = "read";
+  const flush = () => {
+    if (pipelineText.length) ops.push(worstShellOp([classifyShellSegment(pipelineText.join(" | "), depth, pipelineScoped)], pipelineFloor));
+    pipelineText = [];
+    pipeline = 0;
+    pipelineFloor = "read";
+  };
+  const floorFor = (command) => command.depth && (command.depth.loop > 0 || command.depth.function > 0) ? "SHELL" : "read";
+  for (const command of facts.commands) {
+    if (command.wrapper?.inner) {
+      const inner = classifyShellFromAst(command.wrapper.inner, depth + 1, inContainer || command.wrapper.kind === "container");
+      const rank = SHELL_OP_RANK[inner] || 0;
+      ops.push(command.wrapper.kind === "container" && rank > 1 && rank < 4 ? "SHELL" : inner);
+    }
+    const removal = astRemovalOperation(command, inContainer);
+    if (removal) {
+      flush();
+      ops.push(worstShellOp([removal], floorFor(command)));
+      continue;
+    }
+    if (command.pipeline && command.pipeline === pipeline) {
+      pipelineText.push(command.text);
+      continue;
+    }
+    flush();
+    if (command.pipeline) {
+      pipeline = command.pipeline;
+      pipelineText = [command.text];
+      pipelineScoped = command.cwdScope === "scoped";
+      pipelineFloor = floorFor(command);
+      continue;
+    }
+    ops.push(worstShellOp([classifyShellSegment(command.text, depth, command.cwdScope === "scoped")], floorFor(command)));
+  }
+  flush();
+  return worstShellOp(ops, "read");
+}
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
   const segments = splitShellSegments(command);
   if (segments.length === 0) return "SHELL";
-  return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
+  let cwdScoped = false;
+  const ops = segments.map((segment) => {
+    const op = classifyShellSegment(segment, depth, cwdScoped);
+    const cd = cdScopeOfSegment(segment);
+    if (cd) cwdScoped = cd === "scoped";
+    return op;
+  });
+  return worstShellOp(ops, "read");
+}
+function reconcileShellOperation(command, regexOp) {
+  if (shellAstMode === "off" || !shellAstProvider) return regexOp;
+  let facts;
+  try {
+    facts = shellAstProvider(command);
+  } catch {
+    facts = void 0;
+  }
+  const complete = shellAstFactsFullyComplete(facts);
+  let astOp;
+  if (complete && facts) {
+    astOp = provenPowerShellReadSequence(command) ? "read" : shellUrlActionText(command) !== command ? "write" : classifyShellFromAst(facts, 0);
+  }
+  lastShellAstOperationComparison = { mode: shellAstMode, complete, regex: regexOp, ast: astOp, agree: !complete || astOp === regexOp };
+  return shellAstMode === "primary" && complete && astOp ? astOp : regexOp;
+}
+function classifyShellCommandForTool(command) {
+  return reconcileShellOperation(command, classifyShellCommandOperation(command));
+}
+function shellCommandTextOf(toolName, args) {
+  if (!CODE_EXEC_TOOL_NAME_RE.test(toolName.toLowerCase().replace(/[_\-.]/g, " "))) return void 0;
+  const text = String(args.command || args.cmd || args.code || args.script || args.input || "");
+  return text || void 0;
 }
 function isPowerShellReadFormatter(segment) {
   if (/^(?:Select-Object\s+[\w., *-]+|Format-Table(?:\s+[\w., *-]+)?|Format-List(?:\s+[\w., *-]+)?|Out-Null|ConvertFrom-Json)$/i.test(segment)) return true;
@@ -8378,6 +8542,8 @@ function inferToolContext(toolName, args) {
   }
   const updated = (0, import_detectorRuntime.updatedDetectorFacts)(toolName, detectorArgs);
   if (!updated) return inferBundledToolContext(toolName, args);
+  const shellText = shellCommandTextOf(toolName, args);
+  const operation = shellText && updated.operation !== toolName ? reconcileShellOperation(shellText, updated.operation) : updated.operation;
   const context = { ...updated.context };
   for (const key of RESERVED_INPUT_FACTS) delete context[key];
   const argsText = stringifyArgs(args);
@@ -8391,7 +8557,7 @@ function inferToolContext(toolName, args) {
     context["destination.type"] = context["request.destination.type"];
     context["destination.domain"] = context["request.destination.domain"];
   }
-  return { operation: updated.operation, context };
+  return { operation, context };
 }
 function inferBundledToolContext(toolName, args) {
   const context = {};
@@ -8432,7 +8598,7 @@ function inferBundledToolContext(toolName, args) {
     }
   }
   if (operation === toolName && CODE_EXEC_TOOL_NAME_RE.test(nameWords)) {
-    operation = classifyShellCommandOperation(commandText);
+    operation = classifyShellCommandForTool(commandText);
   }
   const pathArg = args.path || args.filepath || args.file || args.filename || "";
   if (typeof pathArg === "string" && pathArg.length > 0) {
@@ -8610,6 +8776,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,
+  getShellAstMode,
   inferBundledToolContext,
   inferToolContext,
   inventoryToolMatchesActionPolicy,
@@ -8619,5 +8786,8 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   resolveApprovalOptions,
   roleExceptionError,
   ruleNeedsContentFact,
+  setShellAstMode,
+  setShellAstProvider,
+  takeShellAstOperationComparison,
   toolCapabilities
 });

package/dist/commands/deterministicGuard.d.ts

@@ -106,6 +106,38 @@ export interface SharedCommandRule {
  * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
+export type ShellAstMode = 'off' | 'shadow' | 'primary';
+/** Structural subset of shellAst.ts ShellFacts that the guard reads. */
+export interface ShellAstFactsLike {
+    complete: boolean;
+    incompleteReason?: string;
+    dynamicExecution?: boolean;
+    commands: Array<{
+        name: string;
+        argv: string[];
+        literal: boolean[];
+        cwdScope: 'scoped' | 'unscoped' | 'unknown';
+        wrapper?: {
+            kind: string;
+            program: string;
+            inner?: ShellAstFactsLike;
+        };
+    }>;
+}
+export interface ShellAstComparison {
+    mode: ShellAstMode;
+    complete: boolean;
+    /** Destructive-rm item id the regex floor produced (undefined = clean). */
+    regex?: string;
+    /** Destructive-rm item id the AST produced (undefined = clean). */
+    ast?: string;
+    agree: boolean;
+}
+export declare function setShellAstProvider(provider: ((command: string) => ShellAstFactsLike | undefined) | undefined): void;
+export declare function setShellAstMode(mode: ShellAstMode): void;
+export declare function getShellAstMode(): ShellAstMode;
+/** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
+export declare function takeShellAstComparison(): ShellAstComparison | undefined;
 /**
  * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
  * space. Detectors that ask "does this EXECUTE" must look here; the raw line

package/dist/commands/deterministicGuard.js

@@ -35,6 +35,10 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CREDENTIAL_COMMAND_RULES = exports.DEFAULT_DISABLED_BUILT_INS = void 0;
 exports.toLocalSafetyRuleAction = toLocalSafetyRuleAction;
+exports.setShellAstProvider = setShellAstProvider;
+exports.setShellAstMode = setShellAstMode;
+exports.getShellAstMode = getShellAstMode;
+exports.takeShellAstComparison = takeShellAstComparison;
 exports.unquotedCode = unquotedCode;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
@@ -722,25 +726,211 @@ function credentialCommandReason(value, options) {
 // stall. Root targets (`/`, `/*`) stay blocked even inside containers (the
 // Patria case: an agent nuking a running container's filesystem).
 const CONTAINER_EXEC_BEFORE = /\b(?:docker|podman|nerdctl|kubectl)(?:\.exe)?\s+(?:compose\s+)?(?:exec|run)\b[^;&|]*$/i;
-function destructiveCommandReason(value) {
+let shellAstProvider;
+let shellAstMode = 'shadow';
+let lastShellAstComparison;
+function setShellAstProvider(provider) {
+    shellAstProvider = provider;
+}
+function setShellAstMode(mode) { shellAstMode = mode; }
+function getShellAstMode() { return shellAstMode; }
+/** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
+function takeShellAstComparison() {
+    const value = lastShellAstComparison;
+    lastShellAstComparison = undefined;
+    return value;
+}
+function shellAstFactsFullyComplete(facts) {
+    if (!facts || !facts.complete)
+        return false;
+    for (const command of facts.commands)
+        if (command.wrapper?.inner && !shellAstFactsFullyComplete(command.wrapper.inner))
+            return false;
+    return true;
+}
+const AST_TRANSPARENT_WRAPPERS = new Set(['sudo', 'doas', 'pkexec', 'run0', 'gosu', 'runuser', 'env', 'nice', 'nohup', 'ionice', 'chrt', 'stdbuf', 'timeout', 'command', 'builtin', 'time', 'exec']);
+/**
+ * The destructive-rm decision from structure: which program really runs
+ * (through `sudo` / `env` / `time` / `exec`), which words are its flags after
+ * quote resolution (`rm "-rf" /` ≡ `rm -rf /`, `-r -f` ≡ `-rf`, `--recursive
+ * --force`), and what each target is once the cwd scope is known. Inner scripts
+ * of `bash -c` / `docker run … sh -c` are included; inside a container a bare
+ * `*` is the container workdir (cleanup), the root `/` is still the root.
+ */
+function astDestructiveRm(facts, inContainer = false) {
+    for (const command of facts.commands) {
+        if (command.wrapper?.inner) {
+            const hit = astDestructiveRm(command.wrapper.inner, inContainer || command.wrapper.kind === 'container');
+            if (hit)
+                return hit;
+        }
+        let argv = command.argv;
+        let literal = command.literal;
+        let name = command.name;
+        // Unwrap transparent wrappers: `sudo -u root rm -rf /`, `env X=1 rm -rf /`.
+        for (let guard = 0; guard < 4 && AST_TRANSPARENT_WRAPPERS.has(name); guard++) {
+            let i = 1;
+            while (i < argv.length && ((argv[i].startsWith('-') && argv[i] !== '-') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i]))) {
+                // `sudo -u root`: the option value follows on the next word.
+                if (/^-(?:u|g|h|C|p|r|t|U|D)$/.test(argv[i]))
+                    i++;
+                i++;
+            }
+            if (i >= argv.length || !literal[i]) {
+                name = '';
+                break;
+            }
+            argv = argv.slice(i);
+            literal = literal.slice(i);
+            name = argv[0].replace(/^.*\//, '').replace(/\.exe$/i, '').toLowerCase();
+        }
+        if (name !== 'rm')
+            continue;
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        let flagsDone = false;
+        for (let i = 1; i < argv.length; i++) {
+            const word = argv[i];
+            if (!flagsDone && word === '--') {
+                flagsDone = true;
+                continue;
+            }
+            if (!flagsDone && /^--/.test(word)) {
+                if (/^--recursive$/i.test(word))
+                    recursive = true;
+                if (/^--force$/i.test(word))
+                    force = true;
+                continue;
+            }
+            if (!flagsDone && /^-[A-Za-z]+$/.test(word)) {
+                if (/[rR]/.test(word))
+                    recursive = true;
+                if (/f/.test(word))
+                    force = true;
+                continue;
+            }
+            targets.push({ value: word, literal: literal[i] });
+        }
+        if (!recursive || !force)
+            continue;
+        for (const target of targets) {
+            const t = target.value.trim().replace(/\\/g, '/');
+            const lower = t.toLowerCase();
+            if (/^\/+\*?$/.test(t))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            if (/^(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/+\*?)?$/.test(lower))
+                return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+            if (/^(?:\*|\.\/+\*)$/.test(t)) {
+                if (inContainer || command.cwdScope === 'scoped')
+                    continue;
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
+            }
+        }
+    }
+    return undefined;
+}
+const RM_SCOPE_ITEMS = new Set(['rm_rf_root', 'rm_rf_home']);
+/**
+ * Destructive-command decision with the AST in the loop. Returns the regex
+ * verdict in 'off'/'shadow' (recording the comparison in shadow), and in
+ * 'primary' lets a fully complete AST decide the two rm-scope items — clearing
+ * a regex false positive or adding a structurally proven hit the regex missed —
+ * while every other destructive rule keeps its regex verdict.
+ */
+function destructiveCommandDecision(value) {
+    const regexHit = destructiveCommandReason(value);
+    if (shellAstMode === 'off' || !shellAstProvider)
+        return regexHit;
+    let facts;
+    try {
+        facts = shellAstProvider(value);
+    }
+    catch {
+        facts = undefined;
+    }
+    const complete = shellAstFactsFullyComplete(facts);
+    const astHit = complete && facts ? astDestructiveRm(facts) : undefined;
+    const regexRm = regexHit && RM_SCOPE_ITEMS.has(regexHit.itemId) ? regexHit.itemId : undefined;
+    lastShellAstComparison = { mode: shellAstMode, complete, regex: regexRm, ast: astHit?.itemId, agree: !complete || regexRm === astHit?.itemId };
+    if (shellAstMode !== 'primary' || !complete)
+        return regexHit;
+    if (astHit)
+        return astHit;
+    if (regexRm) {
+        // The AST cleared the rm-scope hit; other destructive rules still apply.
+        return destructiveCommandReason(value, { skipRmScope: true });
+    }
+    return regexHit;
+}
+// Every `cd <target>` statement start (cwd persists across `&&`, `;`, `|`,
+// newlines and `then`/`do`); the caller keeps the LAST one before the `rm`.
+const CD_STATEMENT = /(?:^|[;&|\n(]|\bthen\b|\bdo\b)\s*cd\s+(?:--\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/gi;
+/**
+ * Bare `rm -rf *` wipes whatever the CURRENT directory is. When the same
+ * script has already `cd`'d into a scoped directory — a literal subpath such
+ * as `x`, `./build`, `"$SP/chk"`, `/tmp/work` — the star is that directory's
+ * contents: everyday scratch cleanup (`mkdir -p x && cd x && rm -rf * && unzip …`
+ * on a bank workstation, 2026-09-24). It stays destructive when the cd target
+ * is a filesystem root, a home root, a drive root, `..`/`-`/`.`, or a BARE
+ * variable (`cd "$X"` with X unset lands in $HOME). No cd at all keeps the
+ * conservative reading: the agent's cwd is usually the project.
+ */
+function cdScopedBeforeBareStar(before) {
+    let last = null;
+    CD_STATEMENT.lastIndex = 0;
+    for (let m = CD_STATEMENT.exec(before); m; m = CD_STATEMENT.exec(before))
+        last = m;
+    if (!last)
+        return false;
+    // A `)` after the cd closes a subshell: `(cd x && …); rm -rf *` runs the rm
+    // back in the ORIGINAL directory, which the cd never changed.
+    if (before.slice(last.index + last[0].length).includes(')'))
+        return false;
+    const target = last[1].replace(/^["']|["']$/g, '').trim().replace(/\\/g, '/');
+    if (!target)
+        return false;
+    const lower = target.toLowerCase();
+    if (/^(?:\/+\*?|~\/*\*?|\.{1,2}\/?|-|\$home\/?|\$\{home\}\/?|%userprofile%\/?|\$env:userprofile\/?|[a-z]:\/*\*?)$/.test(lower))
+        return false;
+    if (/^(?:\$\{?[a-z_][a-z0-9_]*\}?|%[a-z_][a-z0-9_]*%|\$env:[a-z_][a-z0-9_]*)\/?$/.test(lower))
+        return false;
+    // At least one real path component that is not `.`/`..`.
+    return lower.split('/').some(part => part && part !== '.' && part !== '..');
+}
+function destructiveCommandReason(value, opts = {}) {
     return matchCommand(value, (text, lower) => {
-        // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
-        // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
-        // outer command — is caught too. Path-aware: only the root `/`, the root
-        // wildcard `/*`, and a bare `*` are treated as destructive — scoped paths
-        // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
-        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
-            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
-        // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
-        // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
-        if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
-            return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+        if (!opts.skipRmScope) {
+            // Flag cluster is order-independent (`-rf`, `-fr`, `-rfv`). Terminators
+            // include `)` so command substitution — `$(rm -rf /)` runs BEFORE the
+            // outer command — is caught too. Path-aware: only the root `/`, the root
+            // wildcard `/*`, and a bare `*` are treated as destructive — scoped paths
+            // (`/tmp/...`, `/var/cache/...`, `./build`) are everyday cleanup.
+            if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?\/\*?["']?(?:\s|$|[;&|)])/.test(lower))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            // Split or long flags: `rm -r -f /`, `rm -f -r /`, `rm --recursive --force /`
+            // (the structural parser saw these first — 2026-09-24; the floor must too).
+            const splitFlags = /\b(?:sudo\s+)?rm\s+((?:-(?:[a-z]+|-recursive|-force|-no-preserve-root)\s+){2,})["']?\/\*?["']?(?:\s|$|[;&|)])/.exec(lower);
+            if (splitFlags && /(?:^|\s)-(?:[a-z]*r|-recursive)/.test(splitFlags[1]) && /(?:^|\s)-(?:[a-z]*f|-force)/.test(splitFlags[1]))
+                return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
+            // Home-ROOT only (`~`, `$HOME`, `%USERPROFILE%`, optional `/` or `/*`).
+            // A subdirectory (`~/.cache`, `~/node_modules`) is everyday cleanup.
+            if (/\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+["']?(?:~|\$home|\$\{home\}|%userprofile%|\$env:userprofile)(?:\/\*?)?["']?(?:\s|$|[;&|)])/.test(lower)) {
+                return { itemId: 'rm_rf_home', reason: 'recursive force delete of the home directory' };
+            }
+            // Bare `*` deletes the current directory tree — destructive on the HOST,
+            // but inside a container exec/run it is the container workdir (cleanup),
+            // and after an explicit `cd <subdir>` it is that scratch folder's contents.
+            // EVERY bare-star rm on the line is judged: `(cd x && rm -rf *); rm -rf *`
+            // has one scoped and one unscoped removal, and the unscoped one wipes.
+            const bareStars = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/g;
+            for (let bareStar = bareStars.exec(lower); bareStar; bareStar = bareStars.exec(lower)) {
+                const before = lower.slice(0, bareStar.index);
+                if (!CONTAINER_EXEC_BEFORE.test(before) && !cdScopedBeforeBareStar(before)) {
+                    return { itemId: 'rm_rf_root', reason: 'recursive force delete of the current directory tree (rm -rf *)' };
+                }
+            }
         }
-        // Bare `*` deletes the current directory tree — destructive on the HOST,
-        // but inside a container exec/run it is the container workdir (cleanup).
-        const bareStar = /\b(?:sudo\s+)?rm\s+-(?=[a-z]*r)(?=[a-z]*f)[a-z]+\s+\*(?:\s|$|[;&|)])/.exec(lower);
-        if (bareStar && !CONTAINER_EXEC_BEFORE.test(lower.slice(0, bareStar.index)))
-            return { itemId: 'rm_rf_root', reason: 'recursive force delete of filesystem root' };
         // Windows recursive quiet drive delete via del/erase/rd/rmdir. Flag order
         // is independent (`/s /q` and `/q /s` both wipe), and the dequoted variant
         // handles `"C:\"`. rd/rmdir are the same wipe under a different verb — the
@@ -1353,7 +1543,7 @@ function scanTextValue(toolName, rawValue, options, commandContext = false) {
         if (finding)
             return finding;
     }
-    const destructive = destructiveCommandReason(value);
+    const destructive = destructiveCommandDecision(value);
     if (destructive) {
         return builtIn(destructive.itemId, 'destructive_filesystem', 'destructive_command', 'local-destructive-command', `Blocked ${destructive.reason}.`, value, destructive.reason, options);
     }