fullcourtdefense-cli 1.35.8 → 1.35.10

package/dist/actionIdentity.js

@@ -2,10 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identityPart = identityPart;
 exports.captureActionIdentity = captureActionIdentity;
+const callerEnv_1 = require("./callerEnv");
 function identityPart(value) {
     return typeof value === 'string' && /^[A-Za-z0-9_.:@/-]{1,200}$/.test(value) ? value : undefined;
 }
-function captureActionIdentity(payload = {}, env = process.env) {
+function captureActionIdentity(payload = {}, env = (0, callerEnv_1.callerEnv)()) {
     return {
         sessionId: identityPart(payload.conversation_id || payload.conversationId || payload.session_id || payload.sessionId
             || env.FCD_SESSION_ID || env.CLAUDE_CODE_SESSION_ID || env.CODEX_THREAD_ID),

package/dist/actionPolicyEngine.d.ts

@@ -212,6 +212,7 @@ export declare function effectiveApprovalScope(approval: ActionPolicyApproval |
  */
 export declare function deriveToolOperations(toolName: string, declaredActions?: string[]): string[];
 export declare function toolCapabilities(value: string): Set<string>;
+export declare function canonicalAgentClient(value: string): string;
 /**
  * "Contains a secret" means a secret VALUE is present — never that the text
  * talks about secrets. Source code, docs, grep patterns and commit messages in

package/dist/actionPolicyEngine.js

@@ -27,6 +27,7 @@ __export(actionPolicyEngine_exports, {
   MACHINE_KINDS: () => MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL: () => WORKSTATION_ASK_APPROVAL,
   approvalExceptionError: () => approvalExceptionError,
+  canonicalAgentClient: () => canonicalAgentClient,
   deriveToolOperations: () => deriveToolOperations,
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
@@ -6043,16 +6044,93 @@ function provenJavaScriptReadUrls(code) {
     return [];
   }
 }
+var PY_READ_IMPORTS = /* @__PURE__ */ new Set(["urllib", "urllib.request", "urllib.parse", "urllib.error", "json", "re", "sys", "time", "datetime", "pprint", "textwrap", "collections", "itertools", "functools", "math", "string", "requests"]);
+var PY_INPUT_OR_EFFECT_RE = /__|"""|#|\b(?:open|input|stdin|argv|orig_argv|environ|getenv|getproxies\w*|proxy_bypass\w*|netrc|get_netrc_auth|get_environ_proxies|modules|exec|eval|compile|execfile|breakpoint\w*|help|codecs|importlib|getattr|setattr|delattr|globals|locals|vars|subprocess|system|popen|socket|pickle|marshal|ctypes|os|io|shutil|pathlib|glob|platform|getpass|builtins|_getframe|gi_frame|cr_frame|ag_frame|tb_frame|f_builtins|f_globals|f_locals|format|format_map|Formatter|Template|chr|post|put|patch|delete|urlretrieve|build_opener|install_opener|add_header|add_unredirected_header|add_data|Session|session|lambda|partial)\b|(?<!urllib\.)\brequest\b|\.(?:data|method|full_url|selector|host)\s*=|\b(?:urlopen|Request|get)\s*=(?!=)|\bsys\s*\.\s*(?!(?:exit|stdout|stderr)\b)\w|\.\s*sys\b|[)\]]\s*\(|"\s*\+|\+\s*"|%\s*[(\w]/;
+function maskPythonStrings(code) {
+  return code.replace(/(?<!\w)([rRfF]{0,2})"((?:[^"\\\n]|\\.)*)"/g, (_m, prefix, body) => /f/i.test(prefix) ? `"${(body.match(/\{[^{}]*\}/g) || []).join(" ")}"` : '""');
+}
+var PY_REQUEST_CALL_RE = /\b(?:urllib\.request\.)?(?:urlopen|Request)\b|\brequests\.(?:get|head)\b/g;
+function pythonCallArguments(code, open) {
+  const args = [];
+  let depth = 0;
+  let quote = "";
+  let current2 = "";
+  for (let i2 = open + 1; i2 < code.length; i2++) {
+    const ch = code[i2];
+    if (quote) {
+      current2 += ch;
+      if (ch === "\\") {
+        current2 += code[++i2] ?? "";
+        continue;
+      }
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current2 += ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) {
+        if (ch !== ")") return void 0;
+        args.push(current2.trim());
+        return args.filter(Boolean);
+      }
+      depth--;
+    }
+    if (ch === "," && depth === 0) {
+      args.push(current2.trim());
+      current2 = "";
+      continue;
+    }
+    current2 += ch;
+  }
+  return void 0;
+}
+function provenPythonReadUrls(code) {
+  if (code.length > 16384) return [];
+  const words = maskPythonStrings(code);
+  if (PY_INPUT_OR_EFFECT_RE.test(words)) return [];
+  for (const statement of words.matchAll(/(?:^|[\n;])[ \t]*(?:from[ \t]+([\w.]+)[ \t]+import\b([^\n;]*)|import[ \t]+([^\n;]+))/g)) {
+    if (/\bas\b/.test(statement[2] ?? statement[3] ?? "")) return [];
+    const modules = statement[1] !== void 0 ? [statement[1]] : statement[3].split(",").map((name) => name.trim());
+    if (!modules.every((name) => PY_READ_IMPORTS.has(name))) return [];
+  }
+  const requestVariables = new Set([...words.matchAll(/\b([A-Za-z_]\w*)\s*=\s*(?:urllib\.request\.)?Request\s*\(/g)].map((m) => m[1]));
+  const urls = [];
+  for (const call of code.matchAll(PY_REQUEST_CALL_RE)) {
+    const after = (call.index ?? 0) + call[0].length;
+    const open = code.slice(after).search(/\S/) + after;
+    if (code[open] !== "(") return [];
+    const args = pythonCallArguments(code, open);
+    if (!args || args.length === 0) return [];
+    const [target, ...options] = args;
+    if (!options.every((option) => /^timeout\s*=\s*\d+(?:\.\d+)?$/.test(option) || /^context\s*=\s*[A-Za-z_]\w*$/.test(option) || /^headers\s*=\s*\{\s*(?:"[^"\\{}]*"\s*:\s*"[^"\\{}]*"\s*,?\s*)*\}$/.test(option))) return [];
+    if (/urlopen$/.test(call[0]) && requestVariables.has(target)) continue;
+    const literal2 = /^[fr]?"(https?:\/\/([A-Za-z0-9.-]+)(?::\d+)?)([/?][^"\\]*)?"$/.exec(target);
+    if (!literal2) return [];
+    if (/^[\d.]+$/.test(literal2[2]) || isInternalHost(literal2[2])) return [];
+    urls.push(literal2[1] + (literal2[3] || "/").replace(/\{[\s\S]*$/, ""));
+  }
+  return urls;
+}
 function provenInlineJavaScriptReadUrls(command) {
   const urls = [];
   for (const segment of splitShellSegments(command)) {
     const here = segment.match(/^\s*@'\r?\n([\s\S]*?)\r?\n'@\s*\|\s*node(?:\.exe)?(?:\s+-)?\s*$/i);
     const inline = segment.match(/^\s*node(?:\.exe)?\s+(?:-e|--eval)\s+'([^']*)'\s*$/i);
+    const python = segment.match(/^\s*python3?\s+-c\s+'([^']*)'\s*$/);
     const code = here?.[1] ?? inline?.[1];
     if (code !== void 0) {
       const proven = provenJavaScriptReadUrls(code);
       if (!proven.length) return [];
       urls.push(...proven);
+    } else if (python) {
+      const proven = provenPythonReadUrls(python[1]);
+      if (!proven.length) return [];
+      urls.push(...proven);
     } else {
       const lead = shellSegmentLead(segment);
       if (!(SHELL_READ_PROGRAMS.has(lead) || ["git", "gh", "cd", "set-location"].includes(lead)) || classifyShellCommandOperation(segment) !== "read" || /https?:\/\//i.test(segment)) return [];
@@ -6485,14 +6563,21 @@ function toolCapabilities(value) {
   addCapabilityIfAny(capabilities, words, "mcp", ["mcp", "tool", "server"]);
   return capabilities;
 }
-function toolNameIdentityMatches(actual, expected) {
-  const actualLower = actual.toLowerCase();
-  const expectedLower = expected.toLowerCase();
-  if (actualLower === expectedLower) return true;
-  if (actualLower.includes(expectedLower) || expectedLower.includes(actualLower)) return true;
-  const actualWords = normalizedWords(actual);
-  const expectedWords = normalizedWords(expected);
-  return [...expectedWords].some((word) => word.length >= 4 && actualWords.has(word));
+function canonicalToolIdentity(value) {
+  const lower = value.trim().toLowerCase();
+  const mcp = /^mcp__(.+?)__(.+)$/.exec(lower);
+  if (mcp) return { server: mcp[1], tool: mcp[2] };
+  const slash = lower.lastIndexOf("/");
+  if (slash > 0 && slash < lower.length - 1) return { server: lower.slice(0, slash).replace(/^@/, ""), tool: lower.slice(slash + 1) };
+  const qualified = /^.+(?:__|\.)(.+)$/.exec(lower);
+  return { tool: qualified ? qualified[1] : lower };
+}
+function toolNameIdentityMatches(actual, expected, actualServer) {
+  const call = canonicalToolIdentity(actual);
+  const rule = canonicalToolIdentity(expected);
+  if (call.tool !== rule.tool) return false;
+  const server = call.server || actualServer?.trim().toLowerCase();
+  return !rule.server || !server || server === rule.server;
 }
 var IDENTITY_CONSTRAINT_FIELDS = /* @__PURE__ */ new Set(["developerName", "machineName"]);
 function normalizeHostPart(value) {
@@ -6509,6 +6594,11 @@ var PATH_CONSTRAINT_FIELDS = /* @__PURE__ */ new Set(["path"]);
 function normalizePathValue(value) {
   return value.replace(/\\/g, "/");
 }
+var AGENT_CLIENT_ALIASES = { gemini: "gemini-cli", "vs-code": "vscode" };
+function canonicalAgentClient(value) {
+  const id = value.trim().toLowerCase().replace(/[\s_]+/g, "-");
+  return AGENT_CLIENT_ALIASES[id] || id;
+}
 function evaluateConstraint(constraint, context) {
   let actual = context[constraint.field] || "";
   let expected = constraint.value;
@@ -6516,6 +6606,10 @@ function evaluateConstraint(constraint, context) {
     actual = normalizePathValue(actual);
     expected = normalizePathValue(expected);
   }
+  if (constraint.field === "agentClient") {
+    actual = canonicalAgentClient(actual);
+    expected = canonicalAgentClient(expected);
+  }
   if (COMMAND_LINE_FIELDS.has(constraint.field) && /^(?:not_)?(?:matches|contains)$/.test(constraint.operator)) {
     actual = shellCommandWords(actual);
   }
@@ -6542,9 +6636,9 @@ function evaluateConstraint(constraint, context) {
   if (constraint.field === "toolName") {
     switch (constraint.operator) {
       case "equals":
-        return toolNameIdentityMatches(actual, expected);
+        return toolNameIdentityMatches(actual, expected, context.mcpServer);
       case "not_equals":
-        return actual.toLowerCase() !== expected.toLowerCase();
+        return !toolNameIdentityMatches(actual, expected, context.mcpServer);
       case "contains":
         return actual.toLowerCase().includes(expected.toLowerCase());
       case "not_contains":
@@ -6948,7 +7042,7 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
   if (/^sha(?:1|256|384|512)-/i.test(token)) return false;
   if (/^data:/i.test(token) || /^[A-Za-z0-9+/]{200,}={0,2}$/.test(token)) return false;
   if (/^(?:https?|s3|gs|file):\/\//i.test(token) || /[\\/]{1}[\w.-]+[\\/]/.test(token)) return false;
-  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/[A-Za-z_][\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
+  if (allowWordSlug && /^[A-Za-z_][\w.-]*\/\w[\w.-]*\.[A-Za-z][A-Za-z0-9]{0,9}$/.test(token)) return false;
   if (allowWordSlug && /[/.]/.test(token) && token.split(/[/.]/).length >= 2 && token.split(/[/.]/).every((part) => /^[A-Za-z][a-z]*(?:[A-Z][a-z0-9]*)*$/.test(part))) return false;
   if (/^[a-z]+(?:[A-Z][a-z0-9]+)+$/.test(token) || /^[a-z]+(?:_[a-z0-9]+)+$/.test(token)) return false;
   if (allowWordSlug && /^[A-Z][a-z]+-(?:[A-Z][a-z]+){2,}$/.test(token)) return false;
@@ -6964,6 +7058,12 @@ function isHighEntropySecretToken(token, allowWordSlug = false) {
 var SECRET_NAME = String.raw`(?:api[_-]?key|apikey|access[_-]?token|auth[_-]?token|refresh[_-]?token|bearer[_-]?token|client[_-]?secret|secret[_-]?key|secret|password|passwd|pwd|credentials?|private[_-]?key|token)`;
 var SECRET_ASSIGNMENT_RE = new RegExp(String.raw`(?:^|[^\w])[\w.-]*?${SECRET_NAME}[\\"']*\s*(?:=>|[:=])\s*[\\"']*([^\s\\"',;&|)}\]<>]{8,})`, "gi");
 var SECRET_FLAG_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)[\\"']*([^\s\\"',;&|)}\]<>-][^\s\\"',;&|)}\]<>]{7,})/gi;
+var SECRET_FLAG_QUOTED_RE = /(?:^|[\s"'`;(\[{,])--?(?:password|passwd|pwd|token|api-?key|secret|client-secret|access-token)(?:=|\s+)\\?(["'])([^\s"'\\-][^\s"'\\]{7,})\\?\1/gi;
+function isWordPhraseWithCounters(value) {
+  const parts = value.split(/[-_.]/);
+  const words = parts.filter((part) => /^(?:[a-z]+|[A-Z]+|[A-Z][a-z]+)$/.test(part));
+  return parts.length >= 3 && words.length >= 2 && words.some((word) => word.length >= 3) && parts.every((part) => words.includes(part) || /^\d{1,6}(?:[a-z]+)?$/.test(part));
+}
 var SECRET_PLACEHOLDER_RE = /^(?:<.*>|\$\{?[A-Za-z_][\w.]*\}?|%[A-Za-z_]+%|\{\{.*\}\}|\[.*\]|\*{3,}|x{4,}|X{4,}|\.{3,}|-{3,}|_{3,}|(?:your|my|our|the|a|an)(?:[-_.][\w.-]*)?|(?:some|example|sample|dummy|fake|test|mock|placeholder|redacted|masked|hidden|changeme|change_me|replace_?me|todo|tbd|fixme|none|null|nil|undefined|true|false|required|optional|omitted|removed|unset|empty|secret|password|token|xxx+|abc+|123+)[\w.-]*)$/i;
 var SECRET_CODE_EXPR_RE = /^(?:[A-Za-z_$][\w$]*(?:[.\[][^\s=]*)+|[A-Za-z_$][\w$]*\(.*\)?|process\.env\.\w+|os\.environ.*|env(?:iron)?\.\w+|new\s+\w+.*|await\s+.*|require\(.*)$/;
 function looksLikeSecretValue(raw) {
@@ -6984,6 +7084,7 @@ function looksLikeSecretValue(raw) {
   if (REPEATED_CHUNK_RE.test(value)) return false;
   if (PLACEHOLDER_WORD_RE.test(value)) return false;
   if (/^[a-z]+(?:[-_.][a-z]+)+$/i.test(value)) return false;
+  if (isWordPhraseWithCounters(value)) return false;
   if (/^(?:change|replace|your|my|our|example|sample|dummy|fake|test|mock|placeholder|not[-_]?real|do[-_]?not[-_]?use|insert|enter|put|paste)[-_]/i.test(value)) return false;
   let classes = 0;
   if (/[a-z]/.test(value)) classes++;
@@ -7022,6 +7123,10 @@ function detectSecretKind(raw) {
       if (looksLikeSecretValue(m[1])) return "assignment";
     }
   }
+  SECRET_FLAG_QUOTED_RE.lastIndex = 0;
+  for (let m = SECRET_FLAG_QUOTED_RE.exec(value); m !== null; m = SECRET_FLAG_QUOTED_RE.exec(value)) {
+    if (looksLikeSecretValue(m[2])) return "assignment";
+  }
   for (const re of [GENERIC_VALUE_RE, AUTH_HEADER_RE]) {
     re.lastIndex = 0;
     let m;
@@ -7171,6 +7276,8 @@ function withoutUnattributedJavaScriptUrls(segment) {
 function extractUrl(args, _argsText) {
   const direct = args.url || args.uri || args.endpoint || args.webhookUrl || args.callbackUrl || args.href || args.link;
   if (typeof direct === "string" && direct.trim()) return direct.trim();
+  const listed = Array.isArray(args.urls) ? args.urls.find((url) => typeof url === "string" && url.trim()) : void 0;
+  if (listed) return listed.trim();
   for (const field of URL_ACTION_FIELDS) {
     const raw = args[field];
     if (typeof raw !== "string") continue;
@@ -7740,6 +7847,16 @@ function cdScopeOfSegment(segment) {
   if (/^(?:\$\{?[a-z_][a-z0-9_]*\}?|%[a-z_][a-z0-9_]*%|\$env:[a-z_][a-z0-9_]*)\/?$/.test(lower)) return "unscoped";
   return lower.split("/").some((part) => part && part !== "." && part !== "..") ? "scoped" : "unscoped";
 }
+function isNestedScratchOrWorkPath(target) {
+  const t = target.replace(/\\/g, "/").replace(/\/+$/, "");
+  const named = (parts2) => parts2.every((part) => part && !part.startsWith(".") && !/[*?[\]{}$%`]/.test(part));
+  const tmp = /^(?:\/private)?\/(?:tmp|var\/tmp)\/(.+)$/.exec(t);
+  if (tmp) return named(tmp[1].split("/"));
+  const home = /^(?:~|\$\{?HOME\}?|\/home\/[^/.$*?]+|\/Users\/[^/.$*?]+|[A-Za-z]:\/Users\/[^/.$*?]+)\/(.+)$/i.exec(t);
+  if (!home) return false;
+  const parts = home[1].split("/");
+  return parts.length >= 2 && named(parts) && !/^(?:Library|AppData)$/i.test(parts[0]);
+}
 function isWorkspaceScopedRemoval(command, cwdScoped = false) {
   const segments = splitShellSegments(command, true);
   const removal = segments.find((seg) => /\b(rm|del|remove-item|rmdir)\b/i.test(seg)) || command;
@@ -7750,7 +7867,7 @@ function isWorkspaceScopedRemoval(command, cwdScoped = false) {
     const t = raw.replace(/^["']|["']$/g, "");
     if (t === "*" || /^\.\/?\*$/.test(t) || /^\.\\\*$/.test(t)) return cwdScoped;
     if (!t || t === "." || t === "..") return false;
-    if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t)) return false;
+    if (/^[\/\\]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t) || /^\$\{?HOME\}?[\/\\]/.test(t)) return isNestedScratchOrWorkPath(t);
     if (/\$|%|\$\{|\$\(|`/.test(t)) return false;
     if (/(^|[\/\\])\.\.([\/\\]|$)/.test(t)) return false;
     if (/^\*\*?$|^[\/\\]?\*$/.test(t)) return false;
@@ -7909,10 +8026,28 @@ function classifyShellSegment(segment, depth = 0, cwdScoped = false) {
   }
   return classifyShellWords(maskQuotedSpans(raw), raw, lead, cwdScoped);
 }
+var STDIN_DATA_MODULES = /* @__PURE__ */ new Set(["json.tool", "base64"]);
+var CODE_RUNS_OR_SENDS_INPUT_RE = /\b(?:exec|eval|compile|execfile|runpy|runsource|importlib|import_module|getattr|setattr|delattr|globals|locals|vars|builtins|modules|_getframe|gi_frame|f_builtins|f_globals|f_locals|Function|constructor|binding|vm|pickle|cPickle|marshal|shelve|dill|yaml|jsonpickle|require|import\s*\(|open|write|writeFile\w*|os|shutil|pathlib|fs|socket|urllib|requests|httpx|http|https|fetch|net|system|spawn|popen|Popen|subprocess|Open3|qx|readpipe|do|send|breakpoint\w*|set_trace|pdb|pty|code|interact|timeit|cProfile|profile|doctest)\b|__|(?:instance|class|module)_eval\b|[)\]]\s*\(|["']\s*\+|\+\s*["']|chr\s*\(|%x[\[{(]|`/;
+var PERL_CODE_REGEX_RE = /(?:^|[^\w$@%&])s\s*[^\w\s]|\(\?\??\{/;
+function interpreterStageReadsStdinAsData(stage) {
+  const pieces = stage.trim().match(/"(?:[^"\\]|\\.)*"|'[^']*'|[^\s"']+/g) || [];
+  if (pieces.join("").replace(/\s/g, "") !== stage.replace(/\s/g, "")) return false;
+  const lead = pieces.shift() || "";
+  if (!/^(?:python3?|perl)$/.test(lead)) return false;
+  if (lead.startsWith("python") && pieces.length === 2 && pieces[0] === "-m") return STDIN_DATA_MODULES.has(pieces[1]);
+  const flag = lead.startsWith("python") ? /^-c$/ : /^-[lnapF]*e$/;
+  if (pieces.length !== 2 || !flag.test(pieces[0])) return false;
+  const program = pieces[1];
+  if (!/^'[^']*'$/.test(program) && !/^"[^"$`\\]*"$/.test(program)) return false;
+  const code = program.slice(1, -1);
+  if (lead === "perl" && PERL_CODE_REGEX_RE.test(code)) return false;
+  return !CODE_RUNS_OR_SENDS_INPUT_RE.test(code) && !codeSpawnsProcess(code, lead);
+}
 function classifyShellWords(masked, raw, lead, cwdScoped = false) {
   const value = masked.trim().toLowerCase();
   if (!value) return "read";
-  const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:pwsh|powershell|python3?|node|perl|ruby)\b/.test(value);
+  const interpreterStages = splitShellSegments(raw, true).slice(1).filter((stage) => /^(?:sudo\s+)?(?:python3?|node|perl|ruby)\b/i.test(stage));
+  const pipesIntoInterpreter = /\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b|\|\s*(?:sudo\s+)?(?:pwsh|powershell)\b/.test(value) || /\|\s*(?:sudo\s+)?(?:python3?|node|perl|ruby)\b/.test(value) && !(interpreterStages.length > 0 && interpreterStages.every(interpreterStageReadsStdinAsData));
   const segment = raw;
   if (/\b(curl|wget|invoke-restmethod|invoke-webrequest|iwr|irm)\b/.test(value)) {
     const explicitMethod = /(?:\s-x|\s--request|\s-method)[\s=]+["']?(post|put|patch|delete)\b/i.test(segment);
@@ -8086,7 +8221,7 @@ function astRemovalOperation(command, inContainer) {
     const t = raw.trim().replace(/\\/g, "/");
     if (/^(?:\*|\.\/+\*)$/.test(t)) return inContainer || command.cwdScope === "scoped";
     if (!t || t === "." || t === "..") return false;
-    if (/^[\/]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t)) return false;
+    if (/^[\/]/.test(t) || /^[A-Za-z]:/.test(t) || /^~/.test(t) || /^\$\{?HOME\}?\//.test(t)) return isNestedScratchOrWorkPath(t);
     if (/\$|%|`/.test(t)) return false;
     if (/(^|\/)\.\.(\/|$)/.test(t)) return false;
     return true;
@@ -8211,10 +8346,35 @@ function isGcloudStorageCatRead(command) {
   }
   return objects > 0;
 }
+function provenGitCloneOperands(tokens) {
+  if (tokens.shift() !== "clone") return false;
+  let urls = 0;
+  let directories = 0;
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const token = tokens[i2];
+    if (/^(?:-q|--quiet|--single-branch|--no-single-branch|--no-tags|--no-checkout|-n|--bare|--mirror)$/.test(token)) continue;
+    if (/^(?:--depth|--branch|-b|--origin|-o)$/.test(token) && /^[\w.\/-]+$/.test(tokens[i2 + 1] || "")) {
+      i2++;
+      continue;
+    }
+    if (/^--(?:depth|branch|origin|filter)=[\w.:\/-]+$/.test(token)) continue;
+    if (urls === 0 && /^https?:\/\/[\w.:\/-]+$/i.test(token)) {
+      urls++;
+      continue;
+    }
+    if (urls === 1 && directories === 0 && /^[\w.~\/-]+$/.test(token) && !token.startsWith("-")) {
+      directories++;
+      continue;
+    }
+    return false;
+  }
+  return urls === 1;
+}
 function provenCompoundDownload(command, detectedUrl) {
   if (command.includes(detectedUrl) && provenPowerShellReadSequence(command)) return true;
   const segments = splitShellSegments(command).filter((segment) => /\b(?:https?|s3|gs|ftp|sftp|smb):\/\//i.test(segment));
   if (!segments.length || !command.includes(detectedUrl)) return false;
+  if (segments.some((segment) => /^git(?:\.exe)?\s+clone\b/i.test(segment)) && splitShellSegments(command).some((segment) => !segments.includes(segment) && classifyShellSegment(segment) !== "read" && !(["rm", "rmdir", "mkdir", "cd", "pushd", "popd"].includes(shellSegmentLead(segment)) && classifyShellSegment(segment) === "write"))) return false;
   return segments.every((segment) => {
     const statusRead = /^\(((?:Invoke-WebRequest|iwr)\s+[^\r\n]+)\)\.(?:StatusCode|StatusDescription|RawContentLength)$/i.exec(segment);
     if (statusRead) segment = statusRead[1];
@@ -8228,6 +8388,7 @@ function provenCompoundDownload(command, detectedUrl) {
     if (pieces.join("").replace(/\s/g, "") !== raw.replace(/\s/g, "")) return false;
     const tokens = pieces.map((piece) => piece.replace(/^["']|["']$/g, ""));
     const program = tokens.shift() || "";
+    if (/^git(?:\.exe)?$/i.test(program)) return provenGitCloneOperands(tokens);
     if (!/^(?:curl(?:\.exe)?|wget(?:\.exe)?|Invoke-RestMethod|Invoke-WebRequest|irm|iwr)$/i.test(program)) return false;
     const isCurl = /^curl(?:\.exe)?$/i.test(program);
     let urls = 0;
@@ -8379,6 +8540,7 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   if (policies.length === 0) {
     return { allowed: true, verdict: "allow" };
   }
+  if (!context.toolName && toolName) context = { ...context, toolName };
   const verdictPriority = {
     block: 3,
     require_approval: 2,
@@ -8557,8 +8719,33 @@ function inferToolContext(toolName, args) {
     context["destination.type"] = context["request.destination.type"];
     context["destination.domain"] = context["request.destination.domain"];
   }
+  applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
+var WEB_READ_TOOL_NAMES = /* @__PURE__ */ new Set(["webfetch", "fetchwebpage", "webextract"]);
+function applyWebReadFacts(toolName, args, context) {
+  if (!WEB_READ_TOOL_NAMES.has(toolName.toLowerCase().replace(/[_\-.\s]/g, ""))) return;
+  context["action.kind"] = "http";
+  const url = extractUrl(args, "");
+  if (!url) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    context["url.risk"] = "invalid";
+    return;
+  }
+  const hostType = isInternalHost(parsed.hostname) || isSingleLabelWebHost(parsed) ? "internal" : "external";
+  context.url = url;
+  context["destination.domain"] = parsed.hostname;
+  context["url.risk"] = hostType;
+  context["source.domain"] = parsed.hostname;
+  context["source.type"] = hostType;
+  if (recordHttpRequestFacts(context, args, url)) context["destination.type"] = hostType;
+  else delete context["destination.type"];
+  if (isLoopbackHost(parsed.hostname)) context["destination.loopback"] = "true";
+  else delete context["destination.loopback"];
+}
 function inferBundledToolContext(toolName, args) {
   const context = {};
   let operation = toolName;
@@ -8668,6 +8855,7 @@ function inferBundledToolContext(toolName, args) {
       context["destination.type"] = isInternalHost(context["destination.domain"]) ? "internal" : "external";
     }
   }
+  applyWebReadFacts(toolName, args, context);
   return { operation, context };
 }
 var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
@@ -8772,6 +8960,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL,
   approvalExceptionError,
+  canonicalAgentClient,
   deriveToolOperations,
   detectSecretKind,
   effectiveApprovalScope,

package/dist/approvalPrompt.js

@@ -94,7 +94,7 @@ function nativeDialogView(reason, options = {}) {
                 'Allow once lets only this action continue.',
                 'Deny or close keeps it blocked.',
                 options.allowAlways && options.alwaysScopeLabel
-                    ? `Always allow covers ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`
+                    ? `Always allow: ${line(options.alwaysScopeLabel, 180)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, while the rule stays as it is written today.`
                     : '',
             ].filter(Boolean);
     const footer = f.policy && !f.fallback
@@ -156,7 +156,7 @@ function nativeApprovalMessage(reason, options = {}) {
     return [
         'Allow this action?',
         '', ...details, '',
-        ...(options.alwaysScopeLabel ? [`Always allow covers: ${line(options.alwaysScopeLabel, 200)} — for ${options.alwaysLimitsLabel || '30 days'} on this machine, under this rule as it is written today.`, ''] : []),
+        ...(options.alwaysScopeLabel ? [`Always allow: ${line(options.alwaysScopeLabel, 200)} for ${options.alwaysLimitsLabel || '30 days'} on this machine, while the rule stays as it is written today.`, ''] : []),
         'Allow once permits only this action. Deny or closing keeps it stopped.',
         where,
     ].join('\n');

package/dist/askDialog.js

@@ -31,13 +31,14 @@ exports.resolveAskWithDialog = resolveAskWithDialog;
 const devConfirm_1 = require("./devConfirm");
 const telemetry_1 = require("./telemetry");
 const hookIo_1 = require("./hookIo");
+const callerEnv_1 = require("./callerEnv");
 /** Field on the verdict JSON that carries the envelope. Stripped before the IDE sees the verdict. */
 exports.ASK_ENVELOPE_FIELD = 'fcdAsk';
 /** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
 exports.ASK_DIALOG_TIMEOUT_MS = 55_000;
 /** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
 function askChannel() {
-    return (process.env.FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
+    return ((0, callerEnv_1.callerEnv)().FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
 }
 /** Attach the envelope to a decision object (core side). */
 function attachAskEnvelope(decision, envelope) {
@@ -140,9 +141,8 @@ async function resolveAskWithDialog(verdict, options = {}) {
         return { ...clean, resolution: 'ide' };
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
-    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits)
-        && (envelope.scope.event !== 'shell' || (envelope.scope.programs || []).length > 0);
-    const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope) : undefined;
+    const allowAlways = envelope.remember !== 'none' && Boolean(grantHash) && Boolean(grantLimits) && (0, devConfirm_1.grantOffered)(envelope.scope);
+    const scopeLabel = allowAlways ? (0, devConfirm_1.describeGrantScope)(envelope.scope, { policyId: envelope.policyId, policyName: envelope.policyName }) : undefined;
     const limitsLabel = allowAlways && grantLimits ? (0, devConfirm_1.describeGrantLimits)(grantLimits) : undefined;
     const dialog = options.dialog || devConfirm_1.confirmNativeActionDetailed;
     const reason = options.clientLabel ? `IDE: ${options.clientLabel}\n${envelope.reason}` : envelope.reason;
@@ -172,7 +172,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
             toolName: envelope.toolName,
             operation: envelope.operation,
             reason: granted
-                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (${limitsLabel}, this rule)${policyLabel}`
+                ? `developer chose Always allow in the FullCourtDefense dialog — ${scopeLabel} (${limitsLabel})${policyLabel}`
                 : `developer confirmed in the FullCourtDefense dialog${policyLabel}`,
             ruleId: envelope.policyId,
             policyHash: envelope.policyHash,
@@ -182,7 +182,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
         });
         (0, telemetry_1.triggerFlush)(false);
         const agentMsg = granted
-            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} (${limitsLabel}) under this rule.`
+            ? `FullCourtDefense: the developer allowed this ${envelope.event} and chose "Always allow" for ${scopeLabel} (${limitsLabel}).`
             : `FullCourtDefense: the developer allowed this ${envelope.event} once in the FullCourtDefense dialog.`;
         return { ...clean, stdout: JSON.stringify(rewriteDecision(decision, true, '', agentMsg)), exitCode: 0, resolution: outcome };
     }

package/dist/blockExplanation.js

@@ -84,6 +84,8 @@ function scopeWords(scope, developerName) {
         return '🌐 company default — applies to every machine';
     if (scope === 'machine' || scope === 'developer' || scope === 'local')
         return `📍 local rule — only ${developerName || 'this machine'}`;
+    if (scope === 'shield')
+        return '📍 shield rule — only the machines on the shield it was saved on, or the ones it names';
     return `${scope} policy`;
 }
 const FACT_WORDS = [

package/dist/callerEnv.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The environment of the process that ASKED for a verdict (#1466).
+ *
+ * A hook answered by the resident daemon is evaluated inside the daemon's
+ * process, whose own environment belongs to a scheduled task — not to the IDE
+ * session that spawned the hook. Every fact the decision reads from the
+ * environment (is a human present, which CI / ephemeral markers are set, the
+ * session identity, the IDE's hook budget) must be the CALLER's. The thin
+ * client sends a snapshot of exactly these keys; the daemon evaluates the
+ * request with them in place of its own values, per request.
+ *
+ * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
+ */
+export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS"];
+export type CallerEnvSnapshot = Partial<Record<(typeof CALLER_ENV_KEYS)[number], string>>;
+/** The keys above that are set in `env` — what the thin client sends. */
+export declare function snapshotCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
+/** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
+export declare function callerEnv(): NodeJS.ProcessEnv;
+/**
+ * Run `fn` with the caller's snapshot in place of this process's values for
+ * CALLER_ENV_KEYS — a key the caller did not send is UNSET, never inherited
+ * from the daemon. No snapshot (older client) = this process's env, as before.
+ */
+export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+export declare const IDE_HOOK_TIMEOUT_MS = 90000;
+export declare const IDE_TIMEOUT_MARGIN_MS = 15000;
+export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
+/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
+export declare function isCiEnvironment(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
+ * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
+ * developer-scoped approval must go to the org queue or block, never self-resolve.
+ */
+export declare function isHumanPresent(env?: NodeJS.ProcessEnv): boolean;

package/dist/callerEnv.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDE_TIMEOUT_MARGIN_MS = exports.IDE_HOOK_TIMEOUT_MS = exports.CALLER_ENV_KEYS = void 0;
+exports.snapshotCallerEnv = snapshotCallerEnv;
+exports.callerEnv = callerEnv;
+exports.withCallerEnv = withCallerEnv;
+exports.ideHookTimeoutMs = ideHookTimeoutMs;
+exports.ideWaitCutoff = ideWaitCutoff;
+exports.isCiEnvironment = isCiEnvironment;
+exports.isHumanPresent = isHumanPresent;
+const async_hooks_1 = require("async_hooks");
+/**
+ * The environment of the process that ASKED for a verdict (#1466).
+ *
+ * A hook answered by the resident daemon is evaluated inside the daemon's
+ * process, whose own environment belongs to a scheduled task — not to the IDE
+ * session that spawned the hook. Every fact the decision reads from the
+ * environment (is a human present, which CI / ephemeral markers are set, the
+ * session identity, the IDE's hook budget) must be the CALLER's. The thin
+ * client sends a snapshot of exactly these keys; the daemon evaluates the
+ * request with them in place of its own values, per request.
+ *
+ * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
+ */
+exports.CALLER_ENV_KEYS = [
+    // Human presence (isHumanPresent / isCiEnvironment).
+    'FCD_HUMAN_PRESENT', 'FCD_EPHEMERAL', 'FULLCOURTDEFENSE_EPHEMERAL',
+    'CI', 'GITHUB_ACTIONS', 'GITLAB_CI', 'TF_BUILD', 'JENKINS_URL', 'BUILDKITE', 'CIRCLECI',
+    // Whether a dialog can be shown in the caller's session.
+    'DISPLAY', 'WAYLAND_DISPLAY', 'FCD_ASK_CHANNEL',
+    // Action identity (captureActionIdentity).
+    'FCD_SESSION_ID', 'CLAUDE_CODE_SESSION_ID', 'CODEX_THREAD_ID', 'FCD_RUN_ID', 'GITHUB_RUN_ID', 'CI_PIPELINE_ID', 'FCD_WORKLOAD_INSTANCE_ID',
+    // Which client / workspace the verdict is written for.
+    'CLAUDECODE', 'CLAUDE_PROJECT_DIR', 'VSCODE_PID', 'TERM_PROGRAM', 'WORKSPACE_PATH',
+    // Human-wait budget and approve-once switches.
+    'FCD_HOOK_IDE_TIMEOUT_MS', 'FCD_TAINT_APPROVE_ONCE_DISABLED', 'FCD_TAINT_APPROVAL_TIMEOUT_MS',
+];
+/** The keys above that are set in `env` — what the thin client sends. */
+function snapshotCallerEnv(env = process.env) {
+    const snapshot = {};
+    for (const key of exports.CALLER_ENV_KEYS) {
+        const value = env[key];
+        if (typeof value === 'string')
+            snapshot[key] = value;
+    }
+    return snapshot;
+}
+const requestEnv = new async_hooks_1.AsyncLocalStorage();
+/** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
+function callerEnv() {
+    return requestEnv.getStore() ?? process.env;
+}
+/**
+ * Run `fn` with the caller's snapshot in place of this process's values for
+ * CALLER_ENV_KEYS — a key the caller did not send is UNSET, never inherited
+ * from the daemon. No snapshot (older client) = this process's env, as before.
+ */
+function withCallerEnv(snapshot, fn) {
+    if (!snapshot || typeof snapshot !== 'object' || Array.isArray(snapshot))
+        return fn();
+    const env = { ...process.env };
+    for (const key of exports.CALLER_ENV_KEYS) {
+        const value = snapshot[key];
+        if (typeof value === 'string')
+            env[key] = value;
+        else
+            delete env[key];
+    }
+    return requestEnv.run(env, fn);
+}
+/**
+ * How long the IDE lets an approval-capable hook run before it kills the hook
+ * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ */
+exports.IDE_HOOK_TIMEOUT_MS = 90_000;
+exports.IDE_TIMEOUT_MARGIN_MS = 15_000;
+function ideHookTimeoutMs(env = callerEnv()) {
+    const override = Number(env.FCD_HOOK_IDE_TIMEOUT_MS);
+    return override > 0 ? override : exports.IDE_HOOK_TIMEOUT_MS;
+}
+/** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
+function ideWaitCutoff(startedAt, ideTimeoutMs = ideHookTimeoutMs()) {
+    return startedAt + ideTimeoutMs - Math.min(exports.IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4);
+}
+/** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */
+function isCiEnvironment(env = callerEnv()) {
+    return env.GITHUB_ACTIONS === 'true'
+        || env.GITLAB_CI === 'true'
+        || env.TF_BUILD === 'True' // Azure Pipelines
+        || !!env.JENKINS_URL
+        || !!env.BUILDKITE
+        || !!env.CIRCLECI
+        || env.CI === 'true';
+}
+/**
+ * Whether a developer can answer an IDE permission prompt on this machine. False on CI runners
+ * and on ephemeral workloads (`FCD_EPHEMERAL=1`, exported by `fcd workload-protect`) — there a
+ * developer-scoped approval must go to the org queue or block, never self-resolve.
+ */
+function isHumanPresent(env = callerEnv()) {
+    if (env.FCD_EPHEMERAL === '1' || env.FCD_EPHEMERAL === 'true' || env.FULLCOURTDEFENSE_EPHEMERAL === '1')
+        return false;
+    if (env.FCD_HUMAN_PRESENT === '0' || env.FCD_HUMAN_PRESENT === 'false')
+        return false;
+    return !isCiEnvironment(env);
+}