fullcourtdefense-cli 1.36.0 → 1.36.2

package/dist/commandNarrative.d.ts

@@ -31,6 +31,14 @@ export interface CommandStep {
 }
 /** Quote-aware split on `;`, `&&`, `||`, newlines. Pipes stay inside a step. */
 export declare function splitCommandSteps(command: string): string[];
+/**
+ * A code fragment for a step line that never ends mid-expression: cut at `max`,
+ * and when the cut (or the fragment itself) leaves a quote or bracket open,
+ * end with `…` and close them — `q @{` -> `q @{…}`, `@($m |` -> `@($m |…)`.
+ */
+export declare function shortCode(value: string, max?: number): string;
+/** Every host a token read on this line is sent to, as the step list names it. Empty when none is readable. */
+export declare function tokenDestinations(command: string): string[];
 /** One plain-words line per step, in order. */
 export declare function describeShellCommand(command: string): CommandStep[];
 /** The step lines as the explanation prints them (`- …`). */

package/dist/commandNarrative.js

@@ -16,6 +16,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.splitCommandSteps = splitCommandSteps;
+exports.shortCode = shortCode;
+exports.tokenDestinations = tokenDestinations;
 exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
 const MAX_STEPS = 14;
@@ -68,13 +70,51 @@ function splitCommandSteps(command) {
 }
 /** Tokens with quotes stripped; `--flag=value` kept whole. */
 function tokens(segment) {
-    const out = segment.match(/"(?:[^"\\]|\\.)*"|'[^']*'|[^\s]+/g) || [];
+    // `$( … )` stays one token: `--project $(cat p.txt)` must not read as `$(cat`.
+    const out = segment.match(/(?:\$\([^)]*\)|"(?:[^"\\]|\\.)*"|'[^']*'|[^\s"'$]|\$(?!\()|["'$])+/g) || [];
     return out.map(token => token.replace(/^["']|["']$/g, ''));
 }
 function shortValue(value, max = 80) {
     const text = value.replace(/\s+/g, ' ').trim();
     return text.length > max ? `${text.slice(0, max - 1)}…` : text;
 }
+const CLOSER = { '(': ')', '{': '}', '[': ']' };
+/**
+ * A code fragment for a step line that never ends mid-expression: cut at `max`,
+ * and when the cut (or the fragment itself) leaves a quote or bracket open,
+ * end with `…` and close them — `q @{` -> `q @{…}`, `@($m |` -> `@($m |…)`.
+ */
+function shortCode(value, max = 60) {
+    const text = value.replace(/\s+/g, ' ').trim();
+    const cut = text.length > max ? text.slice(0, max - 1).trimEnd() : text;
+    const open = [];
+    let quote = '';
+    for (const ch of cut) {
+        if (quote) {
+            if (ch === quote)
+                quote = '';
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (CLOSER[ch])
+            open.push(CLOSER[ch]);
+        else if (open.length && ch === open[open.length - 1])
+            open.pop();
+    }
+    if (cut === text && !quote && !open.length)
+        return text;
+    return `${cut}…${quote}${open.reverse().join('')}`;
+}
+/** Names of functions the script defines itself (`function Q($b) { … }`), lower-cased -> as written. */
+function localFunctions(command) {
+    const names = new Map();
+    for (const m of command.matchAll(/(?:^|[\s;{])function\s+([A-Za-z_][\w-]*)/gi))
+        names.set(m[1].toLowerCase(), m[1]);
+    return names;
+}
 function bucketOf(uri) {
     const m = /^(?:gs|s3|az):\/\/([^/\s]+)/i.exec(uri);
     return m ? m[1] : uri;
@@ -94,6 +134,18 @@ function flagValue(toks, name) {
     }
     return undefined;
 }
+/** Global options that take a separate value, per CLI: their value is never the subcommand. */
+const KUBE_VALUED_FLAGS = /^(?:--context|-n|--namespace|--kubeconfig|--cluster|--user|-s|--server|--as|--as-group|--token|--request-timeout|--certificate-authority)$/;
+const HELM_VALUED_FLAGS = /^(?:--kube-context|-n|--namespace|--kubeconfig|--kube-apiserver|--kube-token|--kube-as-user|--registry-config|--repository-config|--repository-cache)$/;
+const AWS_VALUED_FLAGS = /^(?:--profile|--region|--output|--endpoint-url|--query|--color|--ca-bundle|--cli-read-timeout|--cli-connect-timeout)$/;
+const AZ_VALUED_FLAGS = /^(?:--subscription|-o|--output|--query)$/;
+/** The words after the program with its global options skipped: `kubectl --context prod apply -f x` -> `apply -f x`. */
+function afterGlobalFlags(toks, valued) {
+    let i = 1;
+    while (i < toks.length && toks[i].startsWith('-'))
+        i += !toks[i].includes('=') && valued.test(toks[i]) ? 2 : 1;
+    return toks.slice(i);
+}
 function operandsAfter(toks, from) {
     const out = [];
     for (let i = from; i < toks.length; i++) {
@@ -184,6 +236,11 @@ function describeGcloud(toks, captured) {
         const token = toks[i];
         if (token.startsWith('-'))
             continue;
+        // The first word names the service (`gcloud run …`), never the verb.
+        if (!groups.length && GCLOUD_SERVICE_NAMES[token]) {
+            groups.push(token);
+            continue;
+        }
         if (GCLOUD_READ.test(token) || GCLOUD_WRITE.test(token) || token === 'delete' || /^(?:export|import|cp|rsync|mv|cat|rm|login|print-access-token|print-identity-token|run|exec|ssh|scp)$/.test(token)) {
             verb = token;
             i++;
@@ -257,7 +314,8 @@ function describeHttp(program, segment, toks) {
     const host = hostOf(segment);
     const method = (/(?:\s-X|\s--request|\s-Method)[\s=]+["']?([A-Za-z]+)/i.exec(segment)?.[1] || '').toUpperCase();
     const body = /\s(?:-d|--data(?:-raw|-binary|-urlencode)?|-F|--form|-T|--upload-file|--json|-Body|-InFile)\b/i.test(segment);
-    const target = host ? ` ${host}` : toks[1] ? ` ${shortValue(toks[1], 60)}` : '';
+    const operand = flagValue(toks, '-Uri') || flagValue(toks, '--url') || toks.slice(1).find((t, k) => !t.startsWith('-') && !(toks[k] || '').startsWith('-'));
+    const target = host ? ` ${host}` : operand ? ` ${shortCode(operand, 60)}` : '';
     if (method && method !== 'GET' || body)
         return `Sends ${method && method !== 'GET' ? `a ${method} request` : 'data'} to${target}`;
     return `Fetches${target} over HTTP`;
@@ -346,7 +404,7 @@ function peelGroups(text) {
     }
     return value;
 }
-function describeOne(segmentIn, captured) {
+function describeOne(segmentIn, captured, fns = new Map()) {
     const segment = segmentIn.trim();
     const [head, ...pipe] = splitPipe(segment);
     const tail = describePipeTail(pipe);
@@ -358,7 +416,7 @@ function describeOne(segmentIn, captured) {
     // `if (…) { body }` / `else { body }`: the body is what runs; say so conditionally.
     const block = /^(if|elseif|else|try|catch|finally|foreach|while|for)\b[^{]*\{(.*)\}\s*$/is.exec(head);
     if (block) {
-        const bodySteps = splitCommandSteps(block[2]).map(part => describeOne(part).text);
+        const bodySteps = splitCommandSteps(block[2]).map(part => describeOne(part, undefined, fns).text);
         const lead = /^(?:if|elseif)$/i.test(block[1]) ? 'If the condition holds' : /^else$/i.test(block[1]) ? 'Otherwise' : /^(?:try)$/i.test(block[1]) ? 'Tries' : /^(?:catch)$/i.test(block[1]) ? 'On error' : /^finally$/i.test(block[1]) ? 'Finally' : 'For each item';
         return { segment, text: shortValue(`${lead}: ${bodySteps.join(' · ') || 'nothing'}${tail}`, MAX_LINE), known: true };
     }
@@ -370,21 +428,31 @@ function describeOne(segmentIn, captured) {
         if (/^\$ErrorActionPreference$|^\$ProgressPreference$|^\$VerbosePreference$|^\$WarningPreference$|^\$InformationPreference$/i.test(`$${name}`))
             return step('Sets a PowerShell error/output preference');
         // A quoted string (interpolating or not), a number, a boolean, a literal array / hashtable.
-        const literal = /^(?:"(?:[^"\\`]|\\.|`.)*"|'[^']*'|\d+|\$true|\$false|@\([^)]*\)|@\{[^}]*\})$/s.test(rhs);
+        // `@( … )` holding a pipe or a statement runs it; only a plain list is a literal.
+        const literal = /^(?:"(?:[^"\\`]|\\.|`.)*"|'[^']*'|\d+|\$true|\$false|@\([^)|;]*\)|@\{[^}]*\})$/s.test(rhs);
         if (literal) {
             const bare = rhs.replace(/^["']|["']$/g, '');
             const storage = /(?:gs|s3|az):\/\/([^/\s"'$]+)/i.exec(bare);
             if (storage)
                 return step(`Sets variable ${name} to a location in storage bucket ${storage[1]}`);
+            const url = /^https?:\/\/([^/\s"'`$]+)/i.exec(bare);
+            if (url)
+                return step(`Sets variable ${name} to a URL on ${url[1].toLowerCase()}`);
             const interpolates = /\$\w+|\$\{|\$\(/.test(bare);
             if (interpolates && /(?:\$(?:env:)?(?:TEMP|TMP|LOCALAPPDATA|HOME|PWD|PSScriptRoot|USERPROFILE)\b|%TEMP%|%TMP%|%LOCALAPPDATA%|%USERPROFILE%)/i.test(bare)) {
                 return step(`Sets variable ${name} to a path`);
             }
             return step(`Sets variable ${name}${interpolates ? ' from other values' : ` to ${shortValue(bare, 60)}`}`);
         }
+        // `$x = $y.Trim()` / `$x = $y.Count`: a value computed from another variable, not a command.
+        if (/^\$[\w:]+(?:\.[\w]+(?:\([^()]*\))?|\[[^\]]*\])+$/.test(rhs))
+            return step(`Sets variable ${name} from ${shortCode(rhs, 50)}`);
         const substituted = /^\$\((.*)\)$/s.exec(rhs) || /^`(.*)`$/s.exec(rhs);
-        const inner = substituted ? substituted[1].trim() : rhs.startsWith('(') ? peelGroups(rhs) : rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '');
-        const innerStep = describeOne(inner, name);
+        // `@( … )` is an array of what the group outputs: the command is inside, like `( … )`.
+        // A stray closing `)` (+ `.Trim()`) left by the caller's split is dropped; a balanced `.Trim()` is kept.
+        const strayClose = (rhs.match(/\)/g) || []).length > (rhs.match(/\(/g) || []).length;
+        const inner = substituted ? substituted[1].trim() : /^@?\(/.test(rhs) ? peelGroups(rhs.replace(/^@/, '')) : strayClose ? rhs.replace(/\)\s*(?:\.\w+\(\))*$/, '') : rhs;
+        const innerStep = describeOne(inner, name, fns);
         const printer = TOKEN_PRINTERS.find(p => p.re.test(inner));
         if (printer) {
             return { segment, text: shortValue(`${innerStep.text}${tail}`, MAX_LINE), known: innerStep.known, captures: { variable: name, ...(printer.issuer ? { issuer: printer.issuer } : {}) } };
@@ -404,6 +472,16 @@ function describeOne(segmentIn, captured) {
     const programToken = toks[p] || '';
     const program = programToken.replace(/^.*[\\/]/, '').replace(/\.(?:exe|cmd|bat)$/i, '').toLowerCase();
     const rest = toks.slice(p);
+    // `function Q($b) { … }` runs nothing until called; say what a call does.
+    const defined = /^function\s+([A-Za-z_][\w-]*)[^{]*\{(.*)\}\s*$/is.exec(head);
+    if (defined) {
+        const body = splitCommandSteps(defined[2]).map(part => describeOne(part, undefined, fns).text).filter(text => text !== 'Script structure (no action by itself)');
+        return { segment, text: shortValue(`Defines function ${defined[1]}${body.length ? ` (when called: ${body.join(' · ')})` : ''}`, MAX_LINE), known: true };
+    }
+    // A call to a function the script defines itself: by its name, never the raw fragment.
+    const local = fns.get(program);
+    if (local)
+        return step(`Calls function ${local}`);
     // Control-flow / block structure
     if (/^(?:if|elseif|else|try|catch|finally|foreach|for|while|switch|function|param|do|done|fi|then|\}|\{|\)|\()$/i.test(program) || /^[{}()]+$/.test(head))
         return step('Script structure (no action by itself)');
@@ -445,32 +523,77 @@ function describeOne(segmentIn, captured) {
             return step(`Runs \`gsutil ${rest[1] || ''}\``, false);
         }
         case 'aws': {
-            if (rest[1] === 's3' && /^(?:cp|sync|mv)$/.test(rest[2] || '')) {
-                const t = describeTransfer('aws', rest);
+            const w = afterGlobalFlags(rest, AWS_VALUED_FLAGS);
+            if (w[0] === 's3' && /^(?:cp|sync|mv)$/.test(w[1] || '')) {
+                const t = describeTransfer('aws', [program, ...w]);
                 if (t)
                     return step(t);
             }
-            if (rest[1] === 's3' && rest[2] === 'ls')
+            if (w[0] === 's3' && w[1] === 'ls')
                 return step('Lists S3 buckets or objects');
-            if (/^(?:describe|list|get)-/.test(rest[2] || ''))
-                return step(`Reads ${rest[1]} ${(rest[2] || '').replace(/^(?:describe|list|get)-/, '').replace(/-/g, ' ')}`);
-            if (/^(?:delete|terminate)-/.test(rest[2] || ''))
-                return step(`Deletes ${rest[1]} ${(rest[2] || '').replace(/^(?:delete|terminate)-/, '').replace(/-/g, ' ')}`);
-            if (/^(?:create|update|put|register)-/.test(rest[2] || ''))
-                return step(`Changes ${rest[1]} ${(rest[2] || '').replace(/-/g, ' ')}`);
-            return step(`Runs \`aws ${[rest[1], rest[2]].filter(Boolean).join(' ')}\``, false);
-        }
-        case 'kubectl': {
-            const verb = rest[1] || '';
+            if (w[0] === 's3' && /^(?:rm|rb)$/.test(w[1] || '')) {
+                const uri = w.slice(2).find(isStorageUri);
+                return step(`Deletes ${w[1] === 'rb' ? 'storage bucket' : 'objects in storage bucket'} ${uri ? bucketOf(uri) : 'unknown'}`);
+            }
+            if (/^(?:describe|list|get)-/.test(w[1] || ''))
+                return step(`Reads ${w[0]} ${(w[1] || '').replace(/^(?:describe|list|get)-/, '').replace(/-/g, ' ')}`);
+            if (/^(?:delete|terminate)-/.test(w[1] || ''))
+                return step(`Deletes ${w[0]} ${(w[1] || '').replace(/^(?:delete|terminate)-/, '').replace(/-/g, ' ')}`);
+            if (/^(?:create|update|put|register)-/.test(w[1] || ''))
+                return step(`Changes ${w[0]} ${(w[1] || '').replace(/-/g, ' ')}`);
+            return step(`Runs \`aws ${[w[0], w[1]].filter(Boolean).join(' ')}\``, false);
+        }
+        case 'kubectl':
+        case 'oc': {
+            const w = afterGlobalFlags(rest, KUBE_VALUED_FLAGS);
+            const verb = w[0] || '';
+            const ns = flagValue(rest, '-n') || flagValue(rest, '--namespace');
+            const inNs = ns ? ` in namespace ${ns}` : '';
             if (/^(?:get|describe|logs|top|explain|api-resources|version)$/.test(verb))
-                return step(`Reads Kubernetes ${rest[2] || verb}${flagValue(rest, '-n') || flagValue(rest, '--namespace') ? ` in namespace ${flagValue(rest, '-n') || flagValue(rest, '--namespace')}` : ''}`);
+                return step(`Reads Kubernetes ${w[1] && !w[1].startsWith('-') ? w[1] : verb}${inNs}`);
             if (verb === 'delete')
-                return step(`Deletes Kubernetes ${rest.slice(2).filter(t => !t.startsWith('-')).join(' ')}`);
-            if (/^(?:apply|create|patch|scale|rollout|set|label|annotate|edit|replace)$/.test(verb))
-                return step(`Changes Kubernetes resources (${verb})`);
+                return step(`Deletes Kubernetes ${operandsAfter(w, 1).join(' ') || 'resources'}${inNs}`);
+            if (/^(?:apply|create|patch|scale|rollout|set|label|annotate|edit|replace)$/.test(verb)) {
+                const file = flagValue(w, '-f') || flagValue(w, '--filename');
+                return step(`Changes Kubernetes resources (${verb}${file ? ` ${shortValue(file, 40)}` : ''})${inNs}`);
+            }
             if (verb === 'exec')
                 return step('Runs a command inside a Kubernetes pod', false);
-            return step(`Runs \`kubectl ${verb}\``, false);
+            return step(`Runs \`${program} ${verb}\``, false);
+        }
+        case 'helm': {
+            const w = afterGlobalFlags(rest, HELM_VALUED_FLAGS);
+            const verb = w[0] || '';
+            const release = operandsAfter(w, 1)[0];
+            const ns = flagValue(rest, '-n') || flagValue(rest, '--namespace');
+            const where = `${release ? ` ${shortValue(release, 40)}` : ''}${ns ? ` in namespace ${ns}` : ''}`;
+            if (/^(?:upgrade|install|rollback)$/.test(verb))
+                return step(`${verb === 'rollback' ? 'Rolls back' : 'Deploys'} Helm release${where}`);
+            if (/^(?:uninstall|delete|del|un)$/.test(verb))
+                return step(`Deletes Helm release${where}`);
+            if (/^(?:list|ls|status|get|history|show|template|lint|search)$/.test(verb))
+                return step(`Reads Helm ${verb}${where}`);
+            return step(`Runs \`helm ${verb}\``, false);
+        }
+        case 'az': {
+            const w = afterGlobalFlags(rest, AZ_VALUED_FLAGS);
+            const path = [];
+            for (const word of w) {
+                if (word.startsWith('-'))
+                    break;
+                path.push(word);
+            }
+            const verb = path[path.length - 1] || '';
+            const resource = path.slice(0, -1).join(' ') || 'resource';
+            const name = flagValue(w, '--name') || flagValue(w, '-n') || flagValue(w, '--resource-group') || flagValue(w, '-g');
+            const named = `az ${resource}${name ? ` ${shortValue(name, 40)}` : ''}`;
+            if (/^(?:delete|purge|remove)$/.test(verb))
+                return step(`Deletes ${named}`);
+            if (/^(?:list|show|get|get-access-token)$/.test(verb))
+                return step(verb === 'get-access-token' ? 'Reads an Azure access token' : `Reads ${named}`);
+            if (/^(?:create|update|set|restart|start|stop|deploy|up)$/.test(verb))
+                return step(`${verb === 'create' ? 'Creates' : 'Changes'} ${named}`);
+            return step(`Runs \`az ${path.join(' ')}\``, false);
         }
         case 'git': {
             const sub = rest.find((t, idx) => idx > 0 && !t.startsWith('-') && !/^(?:-c|-C)$/.test(rest[idx - 1] || '')) || '';
@@ -599,8 +722,10 @@ function describeOne(segmentIn, captured) {
                 return step(`Runs \`docker ${sub}${rest[2] && !rest[2].startsWith('-') ? ` ${rest[2]}` : ''}\``, sub !== 'exec' && sub !== 'run');
             return step(`Runs \`docker ${sub}\``, false);
         }
-        case 'terraform': {
-            const sub = rest[1] || '';
+        case 'terraform':
+        case 'tofu': {
+            // Global options (`-chdir=envs/prod`) come before the subcommand.
+            const sub = rest.slice(1).find(t => !t.startsWith('-')) || '';
             if (/^(?:plan|validate|fmt|show|output|state)$/.test(sub))
                 return step(`Reads Terraform ${sub}`);
             if (sub === 'apply')
@@ -650,10 +775,12 @@ function describeOne(segmentIn, captured) {
         case 'invoke-expression':
         case 'iex': return step('RUNS a string as code', false);
         default:
-            if (/^\$/.test(programToken))
-                return step(pipe.length ? `Uses ${shortValue(programToken, 40)}${tail}` : `Reads variable ${shortValue(programToken, 40)}`, false);
+            if (/^\$/.test(programToken)) {
+                const shaping = pipe.length > 0 && pipe.every(stage => /^(?:where-object|where|\?|foreach-object|%|select-object|select|sort-object|sort|format-table|ft|format-list|fl|out-string|measure-object|group-object)\b/i.test(stage));
+                return step(shaping ? `Filters or formats ${shortCode(programToken, 40)}` : pipe.length ? `Uses ${shortCode(programToken, 40)}` : `Reads variable ${shortCode(programToken, 40)}`, false);
+            }
             {
-                const shown = shortValue([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50);
+                const shown = shortCode([program, rest[1]].filter(t => t && !t.startsWith('-')).join(' '), 50);
                 return step(shown ? `Runs \`${shown}\`` : 'Runs a command this dialog cannot describe', false);
             }
     }
@@ -708,39 +835,84 @@ function resolveStorageVariables(steps) {
         return { ...step, text };
     });
 }
+/** `$base = "https://host/…"`, then `Invoke-RestMethod -Uri $base`: say the host. Only literal URLs resolve. */
+function resolveUrlVariables(steps) {
+    const hosts = new Map();
+    for (const step of steps) {
+        const assign = /^\$?([\w:]+)\s*=\s*["']?https?:\/\/([^/\s"'`$]+)/i.exec(step.segment);
+        if (assign)
+            hosts.set(assign[1].toLowerCase(), assign[2].toLowerCase());
+    }
+    if (!hosts.size)
+        return steps;
+    return steps.map(step => ({
+        ...step,
+        text: step.text.replace(/((?:\bto|^Fetches) )\$([\w:]+)\b/g, (whole, lead, name) => {
+            const host = hosts.get(name.toLowerCase());
+            return host ? `${lead}${host} (via $${name})` : whole;
+        }),
+    }));
+}
 /**
  * A token stored in a variable, then used later on the line: name the host(s)
  * that receive it and whether each is the token's issuer. Hosts are literal
  * URLs in the using step, or a variable assigned a literal URL earlier.
  */
-function noteTokenDestinations(steps) {
+/**
+ * Hosts a token stored in `variable` (step `index`) reaches later on the line:
+ * literal URLs, or variables assigned a literal URL, in any later statement that
+ * uses the token — directly or through a variable built from it
+ * (`$H = @{ Authorization = "Bearer $tok" }`, then `Invoke-RestMethod -Headers $H -Uri $base`,
+ * also inside a function body the script defines).
+ */
+function tokenHosts(steps, index, variable) {
     const urlVars = new Map();
     for (const step of steps) {
         const assign = /^\$?([\w:]+)\s*=\s*["']?https?:\/\/([^/\s"'`$]+)/i.exec(step.segment);
         if (assign)
             urlVars.set(assign[1].toLowerCase(), assign[2].toLowerCase());
     }
+    const carriers = new Set([variable.toLowerCase()]);
+    const uses = (segment) => [...segment.matchAll(/\$\{?([\w:]+)\}?/g)].some(m => carriers.has(m[1].toLowerCase()));
+    const hosts = new Set();
+    for (const later of steps.slice(index + 1)) {
+        if (!uses(later.segment))
+            continue;
+        const alias = /^\$([\w:]+)\s*=/.exec(later.segment);
+        if (alias)
+            carriers.add(alias[1].toLowerCase());
+        for (const m of later.segment.matchAll(/https?:\/\/([^/\s"'`<>]+)/gi))
+            if (!/[$({]/.test(m[1]))
+                hosts.add(m[1].toLowerCase().replace(/:\d+$/, ''));
+        for (const m of later.segment.matchAll(/\$\{?([\w:]+)\}?/g)) {
+            const host = urlVars.get(m[1].toLowerCase());
+            if (host)
+                hosts.add(host);
+        }
+    }
+    return [...hosts].sort();
+}
+/** Every host a token read on this line is sent to, as the step list names it. Empty when none is readable. */
+function tokenDestinations(command) {
+    const steps = splitCommandSteps(command);
+    const fns = localFunctions(command);
+    const described = steps.map(segment => { try {
+        return describeOne(segment, undefined, fns);
+    }
+    catch {
+        return { segment, text: '', known: false };
+    } });
+    return [...new Set(described.flatMap((step, index) => step.captures ? tokenHosts(described, index, step.captures.variable) : []))].sort();
+}
+function noteTokenDestinations(steps) {
     return steps.map((step, index) => {
         if (!step.captures)
             return step;
         const { variable, issuer } = step.captures;
-        const ref = new RegExp(`\\$\\{?${variable.replace(/[^\w:]/g, '')}\\}?(?![\\w])`, 'i');
-        const hosts = new Set();
-        for (const later of steps.slice(index + 1)) {
-            if (!ref.test(later.segment))
-                continue;
-            for (const m of later.segment.matchAll(/https?:\/\/([^/\s"'`<>]+)/gi))
-                if (!/[$({]/.test(m[1]))
-                    hosts.add(m[1].toLowerCase().replace(/:\d+$/, ''));
-            for (const m of later.segment.matchAll(/\$\{?([\w:]+)\}?/g)) {
-                const host = urlVars.get(m[1].toLowerCase());
-                if (host)
-                    hosts.add(host);
-            }
-        }
-        if (!hosts.size)
+        const hosts = tokenHosts(steps, index, variable);
+        if (!hosts.length)
             return step;
-        const described = [...hosts].sort().map(host => {
+        const described = hosts.map(host => {
             if (!issuer)
                 return host;
             const own = issuer.domains.some(d => host === d || host.endsWith(`.${d}`));
@@ -752,15 +924,16 @@ function noteTokenDestinations(steps) {
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
     const steps = splitCommandSteps(command);
+    const fns = localFunctions(command);
     const described = steps.map(segment => {
         try {
-            return describeOne(segment);
+            return describeOne(segment, undefined, fns);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };
         }
     });
-    const out = resolveStorageVariables(noteTokenDestinations(described).slice(0, MAX_STEPS));
+    const out = resolveUrlVariables(resolveStorageVariables(noteTokenDestinations(described).slice(0, MAX_STEPS)));
     if (steps.length > MAX_STEPS)
         out.push({ segment: '', text: `… and ${steps.length - MAX_STEPS} more step${steps.length - MAX_STEPS === 1 ? '' : 's'}`, known: false });
     return out;

package/dist/commands/cmdGuard.js

@@ -160,7 +160,7 @@ function buildGuardJs(nodePath, cliEntry) {
         `// Execution view (aligned with the CLI's stripInertDataSegments): quoted spans containing whitespace are`,
         `// prose (inert) unless in a code position — interpreter -c/-Command flags, remote executors (ssh/wsl/docker`,
         `// exec), $( ) substitution, or real backtick command substitution (>=2 chars; a 1-char pair is a PS escape).`,
-        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|\\|\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
+        `function execView(line){if(/\\b(?:iex|invoke-expression|invoke-command)\\b|\\beval\\b|\\bxargs\\b|\\bbase64\\b[^\\n]*(?:-d\\b|--decode\\b)|frombase64string|-encodedcommand\\b|\\s-enc\\s|(?<!\\|)\\|(?!\\|)\\s*&?\\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\b|\\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\\.exe)?|cmd(?:\\.exe)?|node|python[0-9.]*|perl|ruby)\\s+(?:-c|\\/c|-e|-command|-scriptblock)\\b|\\b(?:ssh|wsl(?:\\.exe)?|chroot)\\b|\\b(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b/i.test(line))return line;const K=/\\$\\(|\`[^\`]{2,}\`/;const C=/(?:(?:^|[;&|(]|\\s)(?:-c|\\/c|-e|-command|-scriptblock|-filter)[= ]\\s*|(?:^|[;&|(]\\s*)(?:\\S*[\\\\\\/])?(?:sudo\\s+|doas\\s+)?(?:ssh|wsl(?:\\.exe)?|chroot|su|screen|tmux)(?:\\s[^;&|"']*)?\\s|(?:\\S*[\\\\\\/])?(?:docker|kubectl|podman|nerdctl)(?:\\.exe)?\\s+(?:exec|run)\\b[^;&|"']*\\s)$/i;let o=line;o=o.replace(/@'[\\s\\S]*?'@/g,' fcd_inert_data ');o=o.replace(/@"[\\s\\S]*?"@/g,m=>m.includes('$(')?m:' fcd_inert_data ');o=o.replace(/<<-?\\s*'(\\w+)'[\\s\\S]*?(?:\\n\\1\\b|$)/g,' fcd_inert_data ');o=o.replace(/<<-?\\s*"?(\\w+)"?[\\s\\S]*?(?:\\n\\1\\b|$)/g,m=>K.test(m)?m:' fcd_inert_data ');const s=o;o=s.replace(/"((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'/g,(w,dq,sq,i)=>{const b=dq!==undefined?dq:(sq||'');if(!/\\s/.test(b))return w;if(C.test(s.slice(Math.max(0,i-80),i)))return w;if(dq!==undefined&&K.test(b))return w;return ' fcd_inert_data ';});return o;}`,
         `// Precedence on one line: block outranks ask, ask outranks warn.`,
         `function matchLine(line,rules){const n=line.replace(/\\s+/g,' ').trim();const x=execView(line);const xn=x.replace(/\\s+/g,' ').trim();let warnHit=null;const asks=[];for(const r of rules){try{const t=r.source==='custom'?line:x;const tn=r.source==='custom'?n:xn;if(r.re.test(tn)||r.re.test(t)){if(r.action==='block')return r;if(r.action==='ask'){asks.push(r);}else if(!warnHit)warnHit=r;}}catch{}}if(asks.length===1)return asks[0];if(asks.length>1){asks.sort((a,b)=>a.id<b.id?-1:a.id>b.id?1:0);return{...asks[0],id:'asks:'+asks.map(r=>encodeURIComponent(r.id)).join('+'),reason:asks.map(r=>r.reason).join('; ')}}return warnHit;}`,
         `// Flush is DETACHED (spawn+unref, matching the posix guard) — a spawnSync here`,

package/dist/commands/daemon.js

@@ -85,6 +85,7 @@ const machineActionVerify_1 = require("../machineActionVerify");
 const perfSnapshot_1 = require("../perfSnapshot");
 const desktopChatGuard_1 = require("./desktopChatGuard");
 const honeypot_1 = require("../honeypot");
+const msiProductCode_1 = require("../msiProductCode");
 const windowsAudit_1 = require("./windowsAudit");
 const hook_1 = require("./hook");
 const verdictIpc_1 = require("../verdictIpc");
@@ -529,6 +530,19 @@ async function runDaemon(args, config) {
     const quiet = args.quiet === 'true';
     log(`Daemon started (pid ${process.pid}, platform ${process.platform}).`);
     log(`Shield: ${creds.shieldId || '(none — protect-only mode, telemetry disabled)'}  API: ${creds.apiUrl}`);
+    if (process.platform === 'win32') {
+        // `reg query /s` over the uninstall hive can take seconds; keep it off the startup path.
+        setTimeout(() => {
+            try {
+                const productCode = (0, msiProductCode_1.findMsiProductCode)();
+                if ((0, msiProductCode_1.recordMsiProductCode)(productCode))
+                    log(`Recorded installed MSI ProductCode ${productCode} for the Local Safety uninstall rule.`);
+            }
+            catch (error) {
+                log(`Could not record the installed MSI ProductCode: ${error?.message || String(error)}`);
+            }
+        }, 20_000).unref();
+    }
     // A machine enrolled with a DPAPI key whose decrypt fails (blocked
     // PowerShell) lands here: shieldId readable, key not. Say so LOUDLY — this
     // state looks identical to "machine off" on the dashboard otherwise.

package/dist/commands/deterministicGuard.d.ts

@@ -72,6 +72,12 @@ export interface LocalSafetyScanOptions {
      * attack fixtures (security tooling, guard regression tests).
      */
     trustedScriptPaths?: string[];
+    /**
+     * ProductCodes (`{GUID}`) of the installed FullCourtDefense MSI, recorded on
+     * this machine by the daemon from the uninstall registry key. The code changes
+     * with every build, so `msiexec /x {GUID}` is ours only when it is listed here.
+     */
+    fcdProductCodes?: string[];
 }
 /**
  * Built-ins that ship OFF until an org switches them on in the console. Shared
@@ -104,8 +110,8 @@ export interface SharedCommandRule {
  * useless against them because the secret never comes from a watched file
  * ("gh auth token" emits the same token that lives in hosts.yml). Obvious,
  * rarely-legitimate-for-agents forms are on by default; cloud token printers
- * that legitimate deploy tooling uses constantly are strict (off by default,
- * see DEFAULT_DISABLED_BUILT_INS). Ids match local-safety-catalog.ts.
+ * that legitimate deploy tooling uses constantly are strict (warn by default,
+ * see DEFAULT_WARN_BUILT_INS). Ids match local-safety-catalog.ts.
  */
 export declare const CREDENTIAL_COMMAND_RULES: readonly SharedCommandRule[];
 export declare const REMOTE_CONTROL_CATALOG_VERSION = "2026-09-26.1";