fullcourtdefense-cli 1.35.7 → 1.35.9

package/dist/actionPolicyEngine.js

@@ -27,10 +27,12 @@ __export(actionPolicyEngine_exports, {
   MACHINE_KINDS: () => MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL: () => WORKSTATION_ASK_APPROVAL,
   approvalExceptionError: () => approvalExceptionError,
+  canonicalAgentClient: () => canonicalAgentClient,
   deriveToolOperations: () => deriveToolOperations,
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
+  getShellAstMode: () => getShellAstMode,
   inferBundledToolContext: () => inferBundledToolContext,
   inferToolContext: () => inferToolContext,
   inventoryToolMatchesActionPolicy: () => inventoryToolMatchesActionPolicy,
@@ -40,6 +42,9 @@ __export(actionPolicyEngine_exports, {
   resolveApprovalOptions: () => resolveApprovalOptions,
   roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
+  setShellAstMode: () => setShellAstMode,
+  setShellAstProvider: () => setShellAstProvider,
+  takeShellAstOperationComparison: () => takeShellAstOperationComparison,
   toolCapabilities: () => toolCapabilities
 });
 module.exports = __toCommonJS(actionPolicyEngine_exports);
@@ -6039,16 +6044,93 @@ function provenJavaScriptReadUrls(code) {
     return [];
   }
 }
+var PY_READ_IMPORTS = /* @__PURE__ */ new Set(["urllib", "urllib.request", "urllib.parse", "urllib.error", "json", "re", "sys", "time", "datetime", "pprint", "textwrap", "collections", "itertools", "functools", "math", "string", "requests"]);
+var PY_INPUT_OR_EFFECT_RE = /__|"""|#|\b(?:open|input|stdin|argv|orig_argv|environ|getenv|getproxies\w*|proxy_bypass\w*|netrc|get_netrc_auth|get_environ_proxies|modules|exec|eval|compile|execfile|breakpoint\w*|help|codecs|importlib|getattr|setattr|delattr|globals|locals|vars|subprocess|system|popen|socket|pickle|marshal|ctypes|os|io|shutil|pathlib|glob|platform|getpass|builtins|_getframe|gi_frame|cr_frame|ag_frame|tb_frame|f_builtins|f_globals|f_locals|format|format_map|Formatter|Template|chr|post|put|patch|delete|urlretrieve|build_opener|install_opener|add_header|add_unredirected_header|add_data|Session|session|lambda|partial)\b|(?<!urllib\.)\brequest\b|\.(?:data|method|full_url|selector|host)\s*=|\b(?:urlopen|Request|get)\s*=(?!=)|\bsys\s*\.\s*(?!(?:exit|stdout|stderr)\b)\w|\.\s*sys\b|[)\]]\s*\(|"\s*\+|\+\s*"|%\s*[(\w]/;
+function maskPythonStrings(code) {
+  return code.replace(/(?<!\w)([rRfF]{0,2})"((?:[^"\\\n]|\\.)*)"/g, (_m, prefix, body) => /f/i.test(prefix) ? `"${(body.match(/\{[^{}]*\}/g) || []).join(" ")}"` : '""');
+}
+var PY_REQUEST_CALL_RE = /\b(?:urllib\.request\.)?(?:urlopen|Request)\b|\brequests\.(?:get|head)\b/g;
+function pythonCallArguments(code, open) {
+  const args = [];
+  let depth = 0;
+  let quote = "";
+  let current2 = "";
+  for (let i2 = open + 1; i2 < code.length; i2++) {
+    const ch = code[i2];
+    if (quote) {
+      current2 += ch;
+      if (ch === "\\") {
+        current2 += code[++i2] ?? "";
+        continue;
+      }
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current2 += ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) {
+        if (ch !== ")") return void 0;
+        args.push(current2.trim());
+        return args.filter(Boolean);
+      }
+      depth--;
+    }
+    if (ch === "," && depth === 0) {
+      args.push(current2.trim());
+      current2 = "";
+      continue;
+    }
+    current2 += ch;
+  }
+  return void 0;
+}
+function provenPythonReadUrls(code) {
+  if (code.length > 16384) return [];
+  const words = maskPythonStrings(code);
+  if (PY_INPUT_OR_EFFECT_RE.test(words)) return [];
+  for (const statement of words.matchAll(/(?:^|[\n;])[ \t]*(?:from[ \t]+([\w.]+)[ \t]+import\b([^\n;]*)|import[ \t]+([^\n;]+))/g)) {
+    if (/\bas\b/.test(statement[2] ?? statement[3] ?? "")) return [];
+    const modules = statement[1] !== void 0 ? [statement[1]] : statement[3].split(",").map((name) => name.trim());
+    if (!modules.every((name) => PY_READ_IMPORTS.has(name))) return [];
+  }
+  const requestVariables = new Set([...words.matchAll(/\b([A-Za-z_]\w*)\s*=\s*(?:urllib\.request\.)?Request\s*\(/g)].map((m) => m[1]));
+  const urls = [];
+  for (const call of code.matchAll(PY_REQUEST_CALL_RE)) {
+    const after = (call.index ?? 0) + call[0].length;
+    const open = code.slice(after).search(/\S/) + after;
+    if (code[open] !== "(") return [];
+    const args = pythonCallArguments(code, open);
+    if (!args || args.length === 0) return [];
+    const [target, ...options] = args;
+    if (!options.every((option) => /^timeout\s*=\s*\d+(?:\.\d+)?$/.test(option) || /^context\s*=\s*[A-Za-z_]\w*$/.test(option) || /^headers\s*=\s*\{\s*(?:"[^"\\{}]*"\s*:\s*"[^"\\{}]*"\s*,?\s*)*\}$/.test(option))) return [];
+    if (/urlopen$/.test(call[0]) && requestVariables.has(target)) continue;
+    const literal2 = /^[fr]?"(https?:\/\/([A-Za-z0-9.-]+)(?::\d+)?)([/?][^"\\]*)?"$/.exec(target);
+    if (!literal2) return [];
+    if (/^[\d.]+$/.test(literal2[2]) || isInternalHost(literal2[2])) return [];
+    urls.push(literal2[1] + (literal2[3] || "/").replace(/\{[\s\S]*$/, ""));
+  }
+  return urls;
+}
 function provenInlineJavaScriptReadUrls(command) {
   const urls = [];
   for (const segment of splitShellSegments(command)) {
     const here = segment.match(/^\s*@'\r?\n([\s\S]*?)\r?\n'@\s*\|\s*node(?:\.exe)?(?:\s+-)?\s*$/i);
     const inline = segment.match(/^\s*node(?:\.exe)?\s+(?:-e|--eval)\s+'([^']*)'\s*$/i);
+    const python = segment.match(/^\s*python3?\s+-c\s+'([^']*)'\s*$/);
     const code = here?.[1] ?? inline?.[1];
     if (code !== void 0) {
       const proven = provenJavaScriptReadUrls(code);
       if (!proven.length) return [];
       urls.push(...proven);
+    } else if (python) {
+      const proven = provenPythonReadUrls(python[1]);
+      if (!proven.length) return [];
+      urls.push(...proven);
     } else {
       const lead = shellSegmentLead(segment);
       if (!(SHELL_READ_PROGRAMS.has(lead) || ["git", "gh", "cd", "set-location"].includes(lead)) || classifyShellCommandOperation(segment) !== "read" || /https?:\/\//i.test(segment)) return [];
@@ -6481,14 +6563,21 @@ function toolCapabilities(value) {
   addCapabilityIfAny(capabilities, words, "mcp", ["mcp", "tool", "server"]);
   return capabilities;
 }
-function toolNameIdentityMatches(actual, expected) {
-  const actualLower = actual.toLowerCase();
-  const expectedLower = expected.toLowerCase();
-  if (actualLower === expectedLower) return true;
-  if (actualLower.includes(expectedLower) || expectedLower.includes(actualLower)) return true;
-  const actualWords = normalizedWords(actual);
-  const expectedWords = normalizedWords(expected);
-  return [...expectedWords].some((word) => word.length >= 4 && actualWords.has(word));
+function canonicalToolIdentity(value) {
+  const lower = value.trim().toLowerCase();
+  const mcp = /^mcp__(.+?)__(.+)$/.exec(lower);
+  if (mcp) return { server: mcp[1], tool: mcp[2] };
+  const slash = lower.lastIndexOf("/");
+  if (slash > 0 && slash < lower.length - 1) return { server: lower.slice(0, slash).replace(/^@/, ""), tool: lower.slice(slash + 1) };
+  const qualified = /^.+(?:__|\.)(.+)$/.exec(lower);
+  return { tool: qualified ? qualified[1] : lower };
+}
+function toolNameIdentityMatches(actual, expected, actualServer) {
+  const call = canonicalToolIdentity(actual);
+  const rule = canonicalToolIdentity(expected);
+  if (call.tool !== rule.tool) return false;
+  const server = call.server || actualServer?.trim().toLowerCase();
+  return !rule.server || !server || server === rule.server;
 }
 var IDENTITY_CONSTRAINT_FIELDS = /* @__PURE__ */ new Set(["developerName", "machineName"]);
 function normalizeHostPart(value) {
@@ -6505,6 +6594,11 @@ var PATH_CONSTRAINT_FIELDS = /* @__PURE__ */ new Set(["path"]);
 function normalizePathValue(value) {
   return value.replace(/\\/g, "/");
 }
+var AGENT_CLIENT_ALIASES = { gemini: "gemini-cli", "vs-code": "vscode" };
+function canonicalAgentClient(value) {
+  const id = value.trim().toLowerCase().replace(/[\s_]+/g, "-");
+  return AGENT_CLIENT_ALIASES[id] || id;
+}
 function evaluateConstraint(constraint, context) {
   let actual = context[constraint.field] || "";
   let expected = constraint.value;
@@ -6512,6 +6606,10 @@ function evaluateConstraint(constraint, context) {
     actual = normalizePathValue(actual);
     expected = normalizePathValue(expected);
   }
+  if (constraint.field === "agentClient") {
+    actual = canonicalAgentClient(actual);
+    expected = canonicalAgentClient(expected);
+  }
   if (COMMAND_LINE_FIELDS.has(constraint.field) && /^(?:not_)?(?:matches|contains)$/.test(constraint.operator)) {
     actual = shellCommandWords(actual);
   }
@@ -6538,9 +6636,9 @@ function evaluateConstraint(constraint, context) {
   if (constraint.field === "toolName") {
     switch (constraint.operator) {
       case "equals":
-        return toolNameIdentityMatches(actual, expected);
+        return toolNameIdentityMatches(actual, expected, context.mcpServer);
       case "not_equals":
-        return actual.toLowerCase() !== expected.toLowerCase();
+        return !toolNameIdentityMatches(actual, expected, context.mcpServer);
       case "contains":
         return actual.toLowerCase().includes(expected.toLowerCase());
       case "not_contains":
@@ -6944,7 +7042,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
-  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
+  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/\w[\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
   if (allowWordSlug && /[/.]/.test(token) && token.split(/[/.]/).length >= 2 && token.split(/[/.]/).every((part) => /^[A-Za-z][a-z]*(?:[A-Z][a-z0-9]*)*$/.test(part))) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
@@ -6960,6 +7058,12 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
 var SECRET_NAME = String.raw`(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key|secret|password|passwd|pwd|credentials?|private[_-]?key|token)`;
 var SECRET_ASSIGNMENT_RE = new RegExp(String.raw`(?:^|[^\w])[\w.-]*?${SECRET_NAME}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{8,})`, "gi");
 var SECRET_FLAG_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>-][^\s\\"',;&|)}\]<>]{7,})/gi;
+var SECRET_FLAG_QUOTED_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)\\?(["'])([^\s"'\\-][^\s"'\\]{7,})\\?\1/gi;
+function isWordPhraseWithCounters(value) {
+  const parts = value.split(/[-_.]/);
+  const words = parts.filter((part) => /^(?:[a-z]+|[A-Z]+|[A-Z][a-z]+)$/.test(part));
+  return parts.length >= 3 && words.length >= 2 && words.some((word) => word.length >= 3) && parts.every((part) => words.includes(part) || /^\d{1,6}(?:[a-z]+)?$/.test(part));
+}
 var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an)(?:[-_.][\w.-]*)?|(?:some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
 var SECRET_CODE_EXPR_RE = /^(?:[A-Za-z_$][\w$]*(?:[.\[][^\s=]*)+|[A-Za-z_$][\w$]*\(.*\)?|process\.env\.\w+|os\.environ.*|env(?:iron)?\.\w+|new\s+\w+.*|await\s+.*|require\(.*)$/;
 function looksLikeSecretValue(raw) {
@@ -6980,6 +7084,7 @@ function looksLikeSecretValue(raw) {
   if (REPEATED_CHUNK_RE.test(value)) return false;
   if (PLACEHOLDER_WORD_RE.test(value)) return false;
   if (/^[a-z]+(?:[-_.][a-z]+)+$/i.test(value)) return false;
+  if (isWordPhraseWithCounters(value)) return false;
   if (/^(?:change|replace|your|my|our|example|sample|dummy|fake|test|mock|placeholder|not[-_]?real|do[-_]?not[-_]?use|insert|enter|put|paste)[-_]/i.test(value)) return false;
   let classes = 0;
   if (/[a-z]/.test(value)) classes++;
@@ -7018,6 +7123,10 @@ function detectSecretKind(raw) {
       if (looksLikeSecretValue(m[1])) return "assignment";
     }
   }
+  SECRET_FLAG_QUOTED_RE.lastIndex = 0;
+  for (let m = SECRET_FLAG_QUOTED_RE.exec(value); m !== null; m = SECRET_FLAG_QUOTED_RE.exec(value)) {
+    if (looksLikeSecretValue(m[2])) return "assignment";
+  }
   for (const re of [GENERIC_VALUE_RE, AUTH_HEADER_RE]) {
     re.lastIndex = 0;
     let m;
@@ -7167,6 +7276,8 @@ function withoutUnattributedJavaScriptUrls(segment) {
 function extractUrl(args, _argsText) {
   const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href || args.link;
   if (typeof direct === "string" && direct.trim()) return direct.trim();
+  const listed = Array.isArray(args.urls) ? args.urls.find((url) => typeof url === "string" && url.trim()) : void 0;
+  if (listed) return listed.trim();
   for (const field of URL_ACTION_FIELDS) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
@@ -7726,7 +7837,27 @@ function shellCommandWords(command, depth = 0) {
   }
   return parts.join(" ; ");
 }
-function isWorkspaceScopedRemoval(command) {
+function cdScopeOfSegment(segment) {
+  const m = /^\s*(?:(?:then|do|else)\s+)?cd\s+(?:--\s+)?("[^"]*"|'[^']*'|[^\s;&|)]+)/i.exec(segment);
+  if (!m) return void 0;
+  const target = m[1].replace(/^["']|["']$/g, "").trim().replace(/\\/g, "/");
+  const lower = target.toLowerCase();
+  if (!lower) return "unscoped";
+  if (/^(?:\/+\*?|~\/*\*?|\.{1,2}\/?|-|\$home\/?|\$\{home\}\/?|%userprofile%\/?|\$env:userprofile\/?|[a-z]:\/*\*?)$/.test(lower)) return "unscoped";
+  if (/^(?:\$\{?[a-z_][a-z0-9_]*\}?|%[a-z_][a-z0-9_]*%|\$env:[a-z_][a-z0-9_]*)\/?$/.test(lower)) return "unscoped";
+  return lower.split("/").some((part) => part && part !== "." && part !== "..") ? "scoped" : "unscoped";
+}
+function isNestedScratchOrWorkPath(target) {
+  const t = target.replace(/\\/g, "/").replace(/\/+$/, "");
+  const named = (parts2) => parts2.every((part) => part && !part.startsWith(".") && !/[*?[\]{}$%`]/.test(part));
+  const tmp = /^(?:\/private)?\/(?:tmp|var\/tmp)\/(.+)$/.exec(t);
+  if (tmp) return named(tmp[1].split("/"));
+  const home = /^(?:~|\$\{?HOME\}?|\/home\/[^/.$*?]+|\/Users\/[^/.$*?]+|[A-Za-z]:\/Users\/[^/.$*?]+)\/(.+)$/i.exec(t);
+  if (!home) return false;
+  const parts = home[1].split("/");
+  return parts.length >= 2 && named(parts) && !/^(?:Library|AppData)$/i.test(parts[0]);
+}
+function isWorkspaceScopedRemoval(command, cwdScoped = false) {
   const segments = splitShellSegments(command, true);
   const removal = segments.find((seg) => /\b(rm|del|remove-item|rmdir)\b/i.test(seg)) || command;
   const tokens = removal.trim().split(/\s+/).slice(1);
@@ -7734,8 +7865,9 @@ function isWorkspaceScopedRemoval(command) {
   if (targets.length === 0) return false;
   return targets.every((raw) => {
     const t = raw.replace(/^["']|["']$/g, "");
-    if (!t || t === "*" || t === "." || t === ".." || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t)) return false;
-    if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t)) return false;
+    if (t === "*" || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t)) return cwdScoped;
+    if (!t || t === "." || t === "..") return false;
+    if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t) || /^\$\{?HOME\}?[\/\\]/.test(t)) return isNestedScratchOrWorkPath(t);
     if (/\$|%|\$\{|\$\(|`/.test(t)) return false;
     if (/(^|[\/\\])\.\.([\/\\]|$)/.test(t)) return false;
     if (/^\*\*?$|^[\/\\]?\*$/.test(t)) return false;
@@ -7860,7 +7992,7 @@ function isInertValueExpression(raw) {
   return /^(?:""|-?\d)/.test(body);
 }
 var worstShellOp = (ops, floor = "read") => ops.reduce((w, op) => (SHELL_OP_RANK[op] || 0) > (SHELL_OP_RANK[w] || 0) ? op : w, floor);
-function classifyShellSegment(segment, depth = 0) {
+function classifyShellSegment(segment, depth = 0, cwdScoped = false) {
   const raw = segment.trim();
   if (!raw) return "read";
   if (PS_SESSION_VARIABLE_ASSIGN_RE.test(raw)) return "SHELL";
@@ -7892,12 +8024,30 @@ function classifyShellSegment(segment, depth = 0) {
     }
     return worstShellOp([classifyShellWords(maskQuotedSpans(raw), raw, lead)], "SHELL");
   }
-  return classifyShellWords(maskQuotedSpans(raw), raw, lead);
-}
-function classifyShellWords(masked, raw, lead) {
+  return classifyShellWords(maskQuotedSpans(raw), raw, lead, cwdScoped);
+}
+var STDIN_DATA_MODULES = /* @__PURE__ */ new Set(["json.tool", "base64"]);
+var CODE_RUNS_OR_SENDS_INPUT_RE = /\b(?:exec|eval|compile|execfile|runpy|runsource|importlib|import_module|getattr|setattr|delattr|globals|locals|vars|builtins|modules|_getframe|gi_frame|f_builtins|f_globals|f_locals|Function|constructor|binding|vm|pickle|cPickle|marshal|shelve|dill|yaml|jsonpickle|require|import\s*\(|open|write|writeFile\w*|os|shutil|pathlib|fs|socket|urllib|requests|httpx|http|https|fetch|net|system|spawn|popen|Popen|subprocess|Open3|qx|readpipe|do|send|breakpoint\w*|set_trace|pdb|pty|code|interact|timeit|cProfile|profile|doctest)\b|__|(?:instance|class|module)_eval\b|[)\]]\s*\(|["']\s*\+|\+\s*["']|chr\s*\(|%x[\[{(]|`/;
+var PERL_CODE_REGEX_RE = /(?:^|[^\w$@%&])s\s*[^\w\s]|\(\?\??\{/;
+function interpreterStageReadsStdinAsData(stage) {
+  const pieces = stage.trim().match(/"(?:[^"\\]|\\.)*"|'[^']*'|[^\s"']+/g) || [];
+  if (pieces.join("").replace(/\s/g, "") !== stage.replace(/\s/g, "")) return false;
+  const lead = pieces.shift() || "";
+  if (!/^(?:python3?|perl)$/.test(lead)) return false;
+  if (lead.startsWith("python") && pieces.length === 2 && pieces[0] === "-m") return STDIN_DATA_MODULES.has(pieces[1]);
+  const flag = lead.startsWith("python") ? /^-c$/ : /^-[lnapF]*e$/;
+  if (pieces.length !== 2 || !flag.test(pieces[0])) return false;
+  const program = pieces[1];
+  if (!/^'[^']*'$/.test(program) && !/^"[^"$`\\]*"$/.test(program)) return false;
+  const code = program.slice(1, -1);
+  if (lead === "perl" && PERL_CODE_REGEX_RE.test(code)) return false;
+  return !CODE_RUNS_OR_SENDS_INPUT_RE.test(code) && !codeSpawnsProcess(code, lead);
+}
+function classifyShellWords(masked, raw, lead, cwdScoped = false) {
   const value = masked.trim().toLowerCase();
   if (!value) return "read";
-  const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
+  const interpreterStages = splitShellSegments(raw, true).slice(1).filter((stage) => /^(?:sudo\s+)?(?:python3?|node|perl|ruby)\b/i.test(stage));
+  const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:sudo\s+)?(?:pwsh|powershell)\b/.test(value) || /\|\s*(?:sudo\s+)?(?:python3?|node|perl|ruby)\b/.test(value) && !(interpreterStages.length > 0 && interpreterStages.every(interpreterStageReadsStdinAsData));
   const segment = raw;
   if (/\b(curl|wget|invoke-restmethod|invoke-webrequest|iwr|irm)\b/.test(value)) {
     const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
@@ -7942,8 +8092,10 @@ function classifyShellWords(masked, raw, lead) {
     if (GCLOUD_WRITE_VERB_RE.test(gcloudVerb)) return pipesIntoInterpreter ? "SHELL" : "write";
   }
   if (/^(?:kubectl\s+(?:get|describe|logs|top|config\s+(?:current-context|get-contexts|view(?!\s+--raw)))|docker\s+(?:ps|images|logs|inspect|version|info)|terraform\s+(?:plan|validate|fmt|show|state\s+list|output)|aws\s+(?:s3\s+ls|sts\s+get-caller-identity)|az\s+account\s+show|npm\s+(?:ls|list|view|outdated|--version)|node\s+--version|python3?\s+--version)\b/.test(value)) return "read";
-  if (/\b(rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r|del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
-    return isWorkspaceScopedRemoval(segment) ? "write" : "DELETE";
+  const rmFlags = /\brm\s+((?:--?[a-z][a-z-]*\s+)+)/.exec(value) || /\brm\s+((?:--?[a-z][a-z-]*\s+)+)/.exec(maskQuotedSpans(raw.replace(/["'](--?[A-Za-z][A-Za-z-]*)["']/g, "$1")).toLowerCase());
+  const rmRecursiveForce = Boolean(rmFlags && /(?:^|\s)(?:-[a-z]*r[a-z]*|--recursive)\s/.test(rmFlags[1]) && /(?:^|\s)(?:-[a-z]*f[a-z]*|--force)\s/.test(rmFlags[1]));
+  if (rmRecursiveForce || /\b(del\s+\/[fqs]|remove-item\b.*\s-recurse\b|rmdir\s+\/s)\b/.test(value)) {
+    return isWorkspaceScopedRemoval(segment, cwdScoped) ? "write" : "DELETE";
   }
   if (/\b(drop\s+(database|table|schema)|truncate\s+table|kubectl\s+delete|terraform\s+destroy|gcloud\s+(?:sql\s+instances|compute\s+instances|projects|run\s+services)\s+delete|az\s+(?:group|vm|sql\s+server)\s+delete|aws\s+(?:s3\s+rb|rds\s+delete-db-instance|ec2\s+terminate-instances)|docker\s+(?:system\s+prune|volume\s+rm|rm\s+-f)|mkfs|dd\s+if=)\b/.test(value)) {
     return "DELETE";
@@ -8002,12 +8154,159 @@ function storageUriIsDestination(segment, index = 0, all = []) {
   return false;
 }
 var SHELL_BLOCK_STRUCTURE_RE = /^(?:\s|[{}()=\-\d]|\+=|""|\$[\w:.]+|\b(?:try|catch|finally|if|then|else|elseif|elif|fi|do|done|esac|end|exit|return|break|continue)\b)*$/i;
+var shellAstProvider;
+var shellAstMode = "shadow";
+var lastShellAstOperationComparison;
+function setShellAstProvider(provider) {
+  shellAstProvider = provider;
+}
+function setShellAstMode(mode) {
+  shellAstMode = mode;
+}
+function getShellAstMode() {
+  return shellAstMode;
+}
+function takeShellAstOperationComparison() {
+  const value = lastShellAstOperationComparison;
+  lastShellAstOperationComparison = void 0;
+  return value;
+}
+function shellAstFactsFullyComplete(facts) {
+  if (!facts || !facts.complete) return false;
+  for (const command of facts.commands) if (command.wrapper?.inner && !shellAstFactsFullyComplete(command.wrapper.inner)) return false;
+  return true;
+}
+var AST_TRANSPARENT_WRAPPERS = /* @__PURE__ */ new Set(["sudo", "doas", "pkexec", "run0", "gosu", "runuser", "env", "nice", "nohup", "ionice", "chrt", "stdbuf", "timeout", "command", "builtin", "time", "exec"]);
+function astRemovalOperation(command, inContainer) {
+  let argv = command.argv;
+  let literal2 = command.literal;
+  let name = command.name;
+  for (let guard = 0; guard < 4 && AST_TRANSPARENT_WRAPPERS.has(name); guard++) {
+    let i2 = 1;
+    while (i2 < argv.length && (argv[i2].startsWith("-") && argv[i2] !== "-" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[i2]))) {
+      if (/^-(?:u|g|h|C|p|r|t|U|D)$/.test(argv[i2])) i2++;
+      i2++;
+    }
+    if (i2 >= argv.length || !literal2[i2]) return void 0;
+    argv = argv.slice(i2);
+    literal2 = literal2.slice(i2);
+    name = argv[0].replace(/^.*\//, "").replace(/\.exe$/i, "").toLowerCase();
+  }
+  if (name !== "rm") return void 0;
+  let recursive = false;
+  let force = false;
+  const targets = [];
+  let flagsDone = false;
+  for (let i2 = 1; i2 < argv.length; i2++) {
+    const word = argv[i2];
+    if (!flagsDone && word === "--") {
+      flagsDone = true;
+      continue;
+    }
+    if (!flagsDone && /^--/.test(word)) {
+      if (/^--recursive$/i.test(word)) recursive = true;
+      if (/^--force$/i.test(word)) force = true;
+      continue;
+    }
+    if (!flagsDone && /^-[A-Za-z]+$/.test(word)) {
+      if (/[rR]/.test(word)) recursive = true;
+      if (/f/.test(word)) force = true;
+      continue;
+    }
+    targets.push(word);
+  }
+  if (!recursive || !force) return void 0;
+  if (targets.length === 0) return "write";
+  const scoped = targets.every((raw) => {
+    const t = raw.trim().replace(/\\/g, "/");
+    if (/^(?:\*|\.\/+\*)$/.test(t)) return inContainer || command.cwdScope === "scoped";
+    if (!t || t === "." || t === "..") return false;
+    if (/^[\/]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t) || /^\$\{?HOME\}?\//.test(t)) return isNestedScratchOrWorkPath(t);
+    if (/\$|%|`/.test(t)) return false;
+    if (/(^|\/)\.\.(\/|$)/.test(t)) return false;
+    return true;
+  });
+  return scoped ? "write" : "DELETE";
+}
+function classifyShellFromAst(facts, depth, inContainer = false) {
+  const ops = [];
+  let pipeline = 0;
+  let pipelineText = [];
+  let pipelineScoped = false;
+  let pipelineFloor = "read";
+  const flush = () => {
+    if (pipelineText.length) ops.push(worstShellOp([classifyShellSegment(pipelineText.join(" | "), depth, pipelineScoped)], pipelineFloor));
+    pipelineText = [];
+    pipeline = 0;
+    pipelineFloor = "read";
+  };
+  const floorFor = (command) => command.depth && (command.depth.loop > 0 || command.depth.function > 0) ? "SHELL" : "read";
+  for (const command of facts.commands) {
+    if (command.wrapper?.inner) {
+      const inner = classifyShellFromAst(command.wrapper.inner, depth + 1, inContainer || command.wrapper.kind === "container");
+      const rank = SHELL_OP_RANK[inner] || 0;
+      ops.push(command.wrapper.kind === "container" && rank > 1 && rank < 4 ? "SHELL" : inner);
+    }
+    const removal = astRemovalOperation(command, inContainer);
+    if (removal) {
+      flush();
+      ops.push(worstShellOp([removal], floorFor(command)));
+      continue;
+    }
+    if (command.pipeline && command.pipeline === pipeline) {
+      pipelineText.push(command.text);
+      continue;
+    }
+    flush();
+    if (command.pipeline) {
+      pipeline = command.pipeline;
+      pipelineText = [command.text];
+      pipelineScoped = command.cwdScope === "scoped";
+      pipelineFloor = floorFor(command);
+      continue;
+    }
+    ops.push(worstShellOp([classifyShellSegment(command.text, depth, command.cwdScope === "scoped")], floorFor(command)));
+  }
+  flush();
+  return worstShellOp(ops, "read");
+}
 function classifyShellCommandOperation(command, depth = 0) {
   if (provenPowerShellReadSequence(command)) return "read";
   if (shellUrlActionText(command) !== command) return "write";
   const segments = splitShellSegments(command);
   if (segments.length === 0) return "SHELL";
-  return worstShellOp(segments.map((segment) => classifyShellSegment(segment, depth)), "read");
+  let cwdScoped = false;
+  const ops = segments.map((segment) => {
+    const op = classifyShellSegment(segment, depth, cwdScoped);
+    const cd = cdScopeOfSegment(segment);
+    if (cd) cwdScoped = cd === "scoped";
+    return op;
+  });
+  return worstShellOp(ops, "read");
+}
+function reconcileShellOperation(command, regexOp) {
+  if (shellAstMode === "off" || !shellAstProvider) return regexOp;
+  let facts;
+  try {
+    facts = shellAstProvider(command);
+  } catch {
+    facts = void 0;
+  }
+  const complete = shellAstFactsFullyComplete(facts);
+  let astOp;
+  if (complete && facts) {
+    astOp = provenPowerShellReadSequence(command) ? "read" : shellUrlActionText(command) !== command ? "write" : classifyShellFromAst(facts, 0);
+  }
+  lastShellAstOperationComparison = { mode: shellAstMode, complete, regex: regexOp, ast: astOp, agree: !complete || astOp === regexOp };
+  return shellAstMode === "primary" && complete && astOp ? astOp : regexOp;
+}
+function classifyShellCommandForTool(command) {
+  return reconcileShellOperation(command, classifyShellCommandOperation(command));
+}
+function shellCommandTextOf(toolName, args) {
+  if (!CODE_EXEC_TOOL_NAME_RE.test(toolName.toLowerCase().replace(/[_\-.]/g, " "))) return void 0;
+  const text = String(args.command || args.cmd || args.code || args.script || args.input || "");
+  return text || void 0;
 }
 function isPowerShellReadFormatter(segment) {
   if (/^(?:Select-Object\s+[\w., *-]+|Format-Table(?:\s+[\w., *-]+)?|Format-List(?:\s+[\w., *-]+)?|Out-Null|ConvertFrom-Json)$/i.test(segment)) return true;
@@ -8047,10 +8346,35 @@ function isGcloudStorageCatRead(command) {
   }
   return objects > 0;
 }
+function provenGitCloneOperands(tokens) {
+  if (tokens.shift() !== "clone") return false;
+  let urls = 0;
+  let directories = 0;
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const token = tokens[i2];
+    if (/^(?:-q|--quiet|--single-branch|--no-single-branch|--no-tags|--no-checkout|-n|--bare|--mirror)$/.test(token)) continue;
+    if (/^(?:--depth|--branch|-b|--origin|-o)$/.test(token) && /^[\w.\/-]+$/.test(tokens[i2 + 1] || "")) {
+      i2++;
+      continue;
+    }
+    if (/^--(?:depth|branch|origin|filter)=[\w.:\/-]+$/.test(token)) continue;
+    if (urls === 0 && /^https?:\/\/[\w.:\/-]+$/i.test(token)) {
+      urls++;
+      continue;
+    }
+    if (urls === 1 && directories === 0 && /^[\w.~\/-]+$/.test(token) && !token.startsWith("-")) {
+      directories++;
+      continue;
+    }
+    return false;
+  }
+  return urls === 1;
+}
 function provenCompoundDownload(command, detectedUrl) {
   if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
   if (!segments.length || !command.includes(detectedUrl)) return false;
+  if (segments.some((segment) => /^git(?:\.exe)?\s+clone\b/i.test(segment)) && splitShellSegments(command).some((segment) => !segments.includes(segment) && classifyShellSegment(segment) !== "read" && !(["rm", "rmdir", "mkdir", "cd", "pushd", "popd"].includes(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write"))) return false;
   return segments.every((segment) => {
     const statusRead = /^\(((?:Invoke-WebRequest|iwr)\s+[^\r\n]+)\)\.(?:StatusCode|StatusDescription|RawContentLength)$/i.exec(segment);
     if (statusRead) segment = statusRead[1];
@@ -8064,6 +8388,7 @@ function provenCompoundDownload(command, detectedUrl) {
     if (pieces.join("").replace(/\s/g, "") !== raw.replace(/\s/g, "")) return false;
     const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
     const program = tokens.shift() || "";
+    if (/^git(?:\.exe)?$/i.test(program)) return provenGitCloneOperands(tokens);
     if (!/^(?:curl(?:\.exe)?|wget(?:\.exe)?|Invoke-RestMethod|Invoke-WebRequest|irm|iwr)$/i.test(program)) return false;
     const isCurl = /^curl(?:\.exe)?$/i.test(program);
     let urls = 0;
@@ -8215,6 +8540,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   if (policies.length === 0) {
     return { allowed: true, verdict: "allow" };
   }
+  if (!context.toolName && toolName) context = { ...context, toolName };
   const verdictPriority = {
     block: 3,
     require_approval: 2,
@@ -8378,6 +8704,8 @@ function inferToolContext(toolName, args) {
   }
   const updated = (0, import_detectorRuntime.updatedDetectorFacts)(toolName, detectorArgs);
   if (!updated) return inferBundledToolContext(toolName, args);
+  const shellText = shellCommandTextOf(toolName, args);
+  const operation = shellText && updated.operation !== toolName ? reconcileShellOperation(shellText, updated.operation) : updated.operation;
   const context = { ...updated.context };
   for (const key of RESERVED_INPUT_FACTS) delete context[key];
   const argsText = stringifyArgs(args);
@@ -8391,7 +8719,32 @@ function inferToolContext(toolName, args) {
     context["destination.type"] = context["request.destination.type"];
     context["destination.domain"] = context["request.destination.domain"];
   }
-  return { operation: updated.operation, context };
+  applyWebReadFacts(toolName, args, context);
+  return { operation, context };
+}
+var WEB_READ_TOOL_NAMES = /* @__PURE__ */ new Set(["webfetch", "fetchwebpage", "webextract"]);
+function applyWebReadFacts(toolName, args, context) {
+  if (!WEB_READ_TOOL_NAMES.has(toolName.toLowerCase().replace(/[_\-.\s]/g, ""))) return;
+  context["action.kind"] = "http";
+  const url = extractUrl(args, "");
+  if (!url) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    context["url.risk"] = "invalid";
+    return;
+  }
+  const hostType = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
+  context.url = url;
+  context["destination.domain"] = parsed.hostname;
+  context["url.risk"] = hostType;
+  context["source.domain"] = parsed.hostname;
+  context["source.type"] = hostType;
+  if (recordHttpRequestFacts(context, args, url)) context["destination.type"] = hostType;
+  else delete context["destination.type"];
+  if (isLoopbackHost(parsed.hostname)) context["destination.loopback"] = "true";
+  else delete context["destination.loopback"];
 }
 function inferBundledToolContext(toolName, args) {
   const context = {};
@@ -8432,7 +8785,7 @@ function inferBundledToolContext(toolName, args) {
     }
   }
   if (operation === toolName && CODE_EXEC_TOOL_NAME_RE.test(nameWords)) {
-    operation = classifyShellCommandOperation(commandText);
+    operation = classifyShellCommandForTool(commandText);
   }
   const pathArg = args.path || args.filepath || args.file || args.filename || "";
   if (typeof pathArg === "string" && pathArg.length > 0) {
@@ -8502,6 +8855,7 @@ function inferBundledToolContext(toolName, args) {
       context["destination.type"] = isInternalHost(context["destination.domain"]) ? "internal" : "external";
     }
   }
+  applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
 var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
@@ -8606,10 +8960,12 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL,
   approvalExceptionError,
+  canonicalAgentClient,
   deriveToolOperations,
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,
+  getShellAstMode,
   inferBundledToolContext,
   inferToolContext,
   inventoryToolMatchesActionPolicy,
@@ -8619,5 +8975,8 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   resolveApprovalOptions,
   roleExceptionError,
   ruleNeedsContentFact,
+  setShellAstMode,
+  setShellAstProvider,
+  takeShellAstOperationComparison,
   toolCapabilities
 });

package/dist/approvalPrompt.js

@@ -94,7 +94,7 @@ function nativeDialogView(reason, options = {}) {
                 'Allow once lets only this action continue.',
                 'Deny or close keeps it blocked.',
                 options.allowAlways && options.alwaysScopeLabel
-                    ? `Always allow covers ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`
+                    ? `Always allow: ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, while the rule stays as it is written today.`
                     : '',
             ].filter(Boolean);
     const footer = f.policy && !f.fallback
@@ -156,7 +156,7 @@ function nativeApprovalMessage(reason, options = {}) {
     return [
         'Allow this action?',
         '', ...details, '',
-        ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`, ''] : []),
+        ...(options.alwaysScopeLabel ? [`Always allow: ${line(options.alwaysScopeLabel, 200)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, while the rule stays as it is written today.`, ''] : []),
         'Allow once permits only this action. Deny or closing keeps it stopped.',
         where,
     ].join('\n');