fullcourtdefense-cli 1.36.2 → 1.36.4

package/dist/actionPolicyEngine.d.ts

@@ -309,6 +309,25 @@ export declare function inferToolContext(toolName: string, args: Record<string,
     operation: string;
     context: Record<string, string>;
 };
+/**
+ * What kind of site a destination host is, for the few kinds that change how an
+ * upload should be read. A curated list, not a reputation feed: a host is in it
+ * only when its PURPOSE is the category (a paste site exists to publish text; a
+ * request catcher exists to capture whatever is sent to it). Deliberately absent:
+ * general cloud storage, code hosting and gists, which are everyday developer
+ * destinations and would turn the category into noise.
+ */
+export type DestinationCategory = 'paste' | 'file_drop' | 'request_capture' | 'tunnel' | 'messaging' | 'news';
+export declare const DESTINATION_CATEGORY_HOSTS: Readonly<Record<DestinationCategory, readonly string[]>>;
+/** Categories whose purpose is to receive data from strangers: a first upload there is high risk. */
+export declare const HIGH_RISK_DESTINATION_CATEGORIES: ReadonlySet<DestinationCategory>;
+/** The listed host itself or any subdomain of it (`www.pastebin.com`, `x.m.pipedream.net`); never a look-alike (`notpastebin.com`). */
+export declare function destinationCategory(host: string | undefined | null): DestinationCategory | undefined;
+/** A host's category and whether that category exists to receive data from anyone — the shape the anomaly scorer takes. */
+export declare function classifyDestinationHost(host: string): {
+    category: DestinationCategory;
+    dataDrop: boolean;
+} | undefined;
 /** Exported for reproducible detector artifacts; policy decisions are not packaged. */
 export declare function inferBundledToolContext(toolName: string, args: Record<string, any>): {
     operation: string;

package/dist/actionPolicyEngine.js

@@ -24,14 +24,18 @@ __export(actionPolicyEngine_exports, {
   ACTION_POLICY_GRANT_MAX_USES: () => ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS: () => CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL: () => DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS: () => DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE: () => GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE: () => GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE: () => GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES: () => HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS: () => MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL: () => WORKSTATION_ASK_APPROVAL,
   approvalExceptionError: () => approvalExceptionError,
   canonicalAgentClient: () => canonicalAgentClient,
+  classifyDestinationHost: () => classifyDestinationHost,
   deriveToolOperations: () => deriveToolOperations,
+  destinationCategory: () => destinationCategory,
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
@@ -6888,6 +6892,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "destination.host",
   "destination.type",
   "destination.repository",
+  "destination.category",
   "destinationHost",
   "host",
   "hostname",
@@ -7461,8 +7466,17 @@ var GIT_NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "receive-pack",
   "lfs"
 ]);
+var POWERSHELL_LINE_RE = /\$env:|-ErrorAction\b|\bWrite-(?:Output|Host)\b|\b(?:Get|Set|New|Remove|Start|Stop|Invoke|Select|Where|ForEach|Test|Add|Format|Out|ConvertTo|ConvertFrom|Import|Export|Measure|Sort|Group|Restart|Register|Unregister|Enable|Disable|Copy|Move|Rename|Resolve|Split|Join|Read|Wait|Clear)-[A-Z][A-Za-z]+\b|@\{|@'|@"|\[(?:System\.|Security\.|IO\.|math\])|\$_\.|\$\w+\s*=\s*(?:Get|New|Read)-|\|\s*%\s|\|\s*\?\s/;
+var POWERSHELL_ONLY_SYNTAX_RE = /(?:^|[\s;{(|])\$[A-Za-z_][\w:]*\s*[+-]?=(?!=)|`"|(?:^|[\s;{])(?:if|elseif|foreach|while|switch)\s*\((?!\()|\}\s*(?:else|elseif|catch|finally)\b|\|\s*(?:where|foreach|%|\?)\s*\{/i;
+var POWERSHELL_ESCAPES_ONLY_RE = /^(?:[^`]|`[$"'`0abefnrtuv])*$/;
+function backtickMayExecute(segment) {
+  if (!segment.includes("`")) return false;
+  const code = maskQuotedSpans(segment);
+  const powershell = POWERSHELL_LINE_RE.test(code) || POWERSHELL_ONLY_SYNTAX_RE.test(code);
+  return !(powershell && POWERSHELL_ESCAPES_ONLY_RE.test(segment));
+}
 function segmentMayReachNetwork(segment) {
-  if (/\$\(|`/.test(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
+  if (segment.includes("$(") || backtickMayExecute(segment) || PS_VALUE_EXECUTOR_RE.test(segment)) return true;
   return splitShellSegments(segment, true).some((stage) => {
     if (/^\s*(?:\$[\w:]+|[A-Za-z_]\w*)\s*=/.test(stage)) return true;
     const masked = maskQuotedSpans(stage);
@@ -8758,8 +8772,145 @@ function inferToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
+var DESTINATION_CATEGORY_HOSTS = {
+  paste: [
+    "pastebin.com",
+    "paste.ee",
+    "hastebin.com",
+    "rentry.co",
+    "rentry.org",
+    "dpaste.org",
+    "dpaste.com",
+    "paste.rs",
+    "termbin.com",
+    "controlc.com",
+    "justpaste.it",
+    "privatebin.net",
+    "ix.io",
+    "sprunge.us",
+    "pastes.io",
+    "paste.mozilla.org"
+  ],
+  file_drop: [
+    "transfer.sh",
+    "file.io",
+    "0x0.st",
+    "temp.sh",
+    "bashupload.com",
+    "gofile.io",
+    "catbox.moe",
+    "uguu.se",
+    "tmpfiles.org",
+    "filebin.net",
+    "wetransfer.com",
+    "we.tl",
+    "sendspace.com",
+    "mediafire.com",
+    "mega.nz",
+    "anonfiles.com",
+    "oshi.at",
+    "pixeldrain.com",
+    "ufile.io",
+    "keep.sh",
+    "filetransfer.io"
+  ],
+  request_capture: [
+    "webhook.site",
+    "pipedream.net",
+    "beeceptor.com",
+    "hookbin.com",
+    "requestcatcher.com",
+    "interact.sh",
+    "oast.fun",
+    "oast.pro",
+    "oast.live",
+    "oast.site",
+    "oast.online",
+    "oast.me",
+    "oastify.com",
+    "burpcollaborator.net",
+    "dnslog.cn",
+    "ceye.io"
+  ],
+  tunnel: [
+    "ngrok.io",
+    "ngrok.app",
+    "ngrok.dev",
+    "ngrok-free.app",
+    "ngrok-free.dev",
+    "trycloudflare.com",
+    "loca.lt",
+    "localtunnel.me",
+    "serveo.net",
+    "localhost.run",
+    "lhr.life",
+    "pinggy.io",
+    "pinggy.link",
+    "bore.pub"
+  ],
+  messaging: ["discord.com", "discordapp.com", "api.telegram.org", "hooks.slack.com"],
+  news: [
+    "ynet.co.il",
+    "ynetnews.com",
+    "walla.co.il",
+    "mako.co.il",
+    "n12.co.il",
+    "haaretz.co.il",
+    "haaretz.com",
+    "themarker.com",
+    "maariv.co.il",
+    "globes.co.il",
+    "calcalist.co.il",
+    "israelhayom.co.il",
+    "kan.org.il",
+    "timesofisrael.com",
+    "jpost.com",
+    "i24news.tv",
+    "bbc.com",
+    "bbc.co.uk",
+    "cnn.com",
+    "nytimes.com",
+    "reuters.com",
+    "apnews.com",
+    "theguardian.com",
+    "washingtonpost.com",
+    "wsj.com",
+    "bloomberg.com",
+    "ft.com",
+    "foxnews.com",
+    "nbcnews.com",
+    "cbsnews.com",
+    "npr.org",
+    "aljazeera.com"
+  ]
+};
+var HIGH_RISK_DESTINATION_CATEGORIES = /* @__PURE__ */ new Set(["paste", "file_drop", "request_capture", "tunnel"]);
+var DESTINATION_CATEGORY_BY_HOST = new Map(
+  Object.entries(DESTINATION_CATEGORY_HOSTS).flatMap(([category, hosts]) => hosts.map((host) => [host, category]))
+);
+function destinationCategory(host) {
+  let candidate = String(host || "").trim().toLowerCase().replace(/\.$/, "");
+  while (candidate) {
+    const category = DESTINATION_CATEGORY_BY_HOST.get(candidate);
+    if (category) return category;
+    const dot = candidate.indexOf(".");
+    if (dot < 0) return void 0;
+    candidate = candidate.slice(dot + 1);
+  }
+  return void 0;
+}
+function classifyDestinationHost(host) {
+  const category = destinationCategory(host);
+  return category ? { category, dataDrop: HIGH_RISK_DESTINATION_CATEGORIES.has(category) } : void 0;
+}
+function applyDestinationCategoryFact(context) {
+  delete context["destination.category"];
+  const category = destinationCategory(context["destination.domain"]);
+  if (category) context["destination.category"] = category;
+}
 function applyRemoteControlFact(toolName, args, context) {
   delete context["toolArgs.remoteControl"];
   const shellText = remoteControlProvider ? shellCommandTextOf(toolName, args) : void 0;
@@ -8911,6 +9062,7 @@ function inferBundledToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
 var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
@@ -9012,14 +9164,18 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL,
   approvalExceptionError,
   canonicalAgentClient,
+  classifyDestinationHost,
   deriveToolOperations,
+  destinationCategory,
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,

package/dist/askHeader.d.ts

@@ -67,6 +67,12 @@ export interface AskHeader {
 }
 /** The client id as the console labels it; undefined for a missing or placeholder id. */
 export declare function agentClientLabel(raw?: string): string | undefined;
+/**
+ * The guard's credential-command patterns (`deterministicGuard` CREDENTIAL_COMMAND_RULES), for
+ * naming a secret the line sends somewhere when ANOTHER rule asked. Copied because this module stays
+ * pure (the guard reads files); test-ask-dialog.js fails when the two differ.
+ */
+export declare const LINE_CREDENTIAL_PATTERNS: Readonly<Record<string, string>>;
 /** Name tokens of a project id → environment. Deterministic, and only a hint: the dialog says "(by name)". */
 export declare function environmentTag(projectId: string): EnvironmentTag | undefined;
 interface ProjectRead {

package/dist/askHeader.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.LINE_CREDENTIAL_PATTERNS = void 0;
 exports.agentClientLabel = agentClientLabel;
 exports.environmentTag = environmentTag;
 exports.projectsInCommand = projectsInCommand;
@@ -17,6 +18,7 @@ exports.buildAskHeader = buildAskHeader;
  * browser extension bundles `approvalPrompt.ts` (and so this module) for the browser.
  */
 const commandNarrative_1 = require("./commandNarrative");
+const shellQuoteMask_1 = require("./shellQuoteMask");
 const MAX_COMMAND = 90;
 /** The console's client names (`frontend/src/lib/activityClient.ts`): the dialog and the console name the same agent. */
 const CLIENT_LABELS = {
@@ -186,6 +188,24 @@ const TOKEN_PRINTER_ACTIONS = [
     { re: /\bgcloud(?:\.cmd|\.exe)?\s+(?:[\w-]+\s+)*?auth\s+print-identity-token\b/i, action: 'Reads a cloud identity token' },
     { re: /\bgh(?:\.exe)?\s+auth\s+token\b/i, action: 'Reads the GitHub token' },
 ];
+/**
+ * The guard's credential-command patterns (`deterministicGuard` CREDENTIAL_COMMAND_RULES), for
+ * naming a secret the line sends somewhere when ANOTHER rule asked. Copied because this module stays
+ * pure (the guard reads files); test-ask-dialog.js fails when the two differ.
+ */
+exports.LINE_CREDENTIAL_PATTERNS = {
+    gh_auth_token_cmd: String.raw `\bgh\s+auth\s+token\b|\bgh\s+auth\s+status\b(?=[^\n;|&]*(?:--show-token|\s-t\b))`,
+    git_credential_fill: String.raw `\bgit\s+credential(?:-manager|-store|-cache)?\s+(?:fill|get)\b`,
+    macos_keychain_dump: String.raw `\bsecurity\s+(?:find-generic-password|find-internet-password)\b[^\n;|&]*\s-w\b|\bsecurity\s+dump-keychain\b`,
+    kubectl_config_raw: String.raw `\bkubectl\s+config\s+view\b[^\n;|&]*--raw\b`,
+    aws_export_credentials: String.raw `\baws\s+configure\s+export-credentials\b|\baws\s+configure\s+get\b[^\n;|&]*secret`,
+    gcloud_access_token_cmd: String.raw `\bgcloud\s+auth\b[^\n;|&]*\bprint-access-token\b`,
+    gcloud_secret_access_cmd: String.raw `\bgcloud\s+secrets\s+versions\s+access\b`,
+    az_access_token_cmd: String.raw `\baz\s+account\s+get-access-token\b`,
+    aws_secret_fetch_cmd: String.raw `\baws\s+secretsmanager\s+get-secret-value\b|\baws\s+ssm\s+get-parameter\b[^\n;|&]*--with-decryption\b`,
+    vault_read_cmd: String.raw `\bvault\s+(?:kv\s+get|read)\b`,
+};
+const LINE_CREDENTIAL = Object.entries(exports.LINE_CREDENTIAL_PATTERNS).map(([item, pattern]) => ({ item, re: new RegExp(pattern, 'i') }));
 const HOW_RANK = ['delete', 'permissions', 'protected', 'change', 'read'];
 /** Name tokens of a project id → environment. Deterministic, and only a hint: the dialog says "(by name)". */
 function environmentTag(projectId) {
@@ -272,22 +292,31 @@ function oneLine(text, max = MAX_COMMAND) {
         tail = tail.slice(tailSpace + 1);
     return `${head.trimEnd()} … ${tail.trimStart()}`;
 }
+/**
+ * The line as the shell reads it (`maskShell`, dialect from the line): quoted
+ * text keeps its length but loses spaces, quotes and `$`, so no flag, URL or
+ * program starts inside a commit message or issue body. Facts come from here.
+ */
+function codeOf(command) {
+    return (0, shellQuoteMask_1.maskShell)(command, (0, shellQuoteMask_1.shellDialectOf)(command)).code;
+}
 /** Literal project ids named on the command: `--project x` / `--project=x` and Google API `projects/<id>` paths. */
 function projectsInCommand(command) {
+    const code = codeOf(command);
     const ids = [];
     let computed = false;
     const add = (raw) => {
         const value = raw.replace(/^["']|["']$/g, '');
-        if (/[$`(){}%<>]/.test(value) || !PROJECT_ID_RE.test(value.toLowerCase())) {
+        if (/[$`(){}%<>_]/.test(value) || !PROJECT_ID_RE.test(value.toLowerCase())) {
             computed = true;
             return;
         }
         if (!ids.includes(value.toLowerCase()))
             ids.push(value.toLowerCase());
     };
-    for (const m of command.matchAll(/(?:^|\s)--project(?:=|\s+)("[^"]*"|'[^']*'|[^\s;|&]+)/g))
+    for (const m of code.matchAll(/(?:^|\s)--project(?:=|\s+)("[^"]*"|'[^']*'|[^\s;|&]+)/g))
         add(m[1]);
-    for (const m of command.matchAll(/https?:\/\/[a-z0-9.-]*googleapis\.com\/[^\s"'`]*?\bprojects\/([^/\s"'`?#]+)/gi))
+    for (const m of code.matchAll(/(?:^|[\s=(,"'])https?:\/\/[a-z0-9.-]*googleapis\.com\/[^\s"'`]*?\bprojects\/([^/\s"'`?#]+)/gi))
         add(m[1]);
     return { ids, computed };
 }
@@ -441,15 +470,22 @@ function buildAskHeader(input) {
     const command = (input.command || '').trim();
     const shell = subject.event ? subject.event === 'shell' : /command$/.test(input.kind || '') || (!input.tool && Boolean(command));
     const noun = nounOf(input.kind, subject.event);
-    const item = ruleItem(subject, input.ruleDetail, input.policy);
+    const askedItem = ruleItem(subject, input.ruleDetail, input.policy);
+    const code = shell ? codeOf(command) : command;
+    const printer = shell ? TOKEN_PRINTER_ACTIONS.find(p => p.re.test(code)) : undefined;
+    // Another rule asked (egress, a cloud policy), but the line reads a credential and sends it to a host:
+    // that is the fact the developer must see (the credential rule itself may only warn, #1837).
+    const lineItem = shell && !(askedItem && CREDENTIAL_ACTIONS[askedItem]) ? LINE_CREDENTIAL.find(c => c.re.test(code))?.item : undefined;
+    const flows = shell && (lineItem || printer) ? (0, commandNarrative_1.capturedValueDestinations)(command, s => LINE_CREDENTIAL.some(c => c.re.test(codeOf(s)))) : [];
+    const viaFlow = Boolean(lineItem && flows.length);
+    const item = viaFlow ? lineItem : askedItem;
     const credentialAction = item ? CREDENTIAL_ACTIONS[item] : undefined;
     const cloud = cloudEntries(subject.cloud);
     const how = cloud.length ? strongestHow(cloud) : undefined;
     const decisiveEntries = how ? cloud.filter(entry => entry.how === how) : [];
     const decisiveTools = unique(decisiveEntries.map(entry => entry.tool));
-    const printer = shell ? TOKEN_PRINTER_ACTIONS.find(p => p.re.test(command)) : undefined;
     // A token read is about the token, even when the line also reaches a target not read yet (`curl` POST).
-    const credential = Boolean(credentialAction || (printer && (!how || how === '?')));
+    const credential = Boolean(credentialAction || (printer && (!how || how === '?' || flows.length > 0)));
     // Where: a credential line names the project its literal Google API URL / --project acts on;
     // otherwise what the cloud entries name (each unknown part stays "unknown"), else a literal
     // project on the command, else the host the action reaches.
@@ -458,7 +494,7 @@ function buildAskHeader(input) {
     const cloudWheres = unique(cloud.map(entryWhere));
     const names = useCloud ? unique(cloud.flatMap(environmentNames)) : literal.ids;
     const host = subject.destinationDomain || (subject.credentialHosts || [])[0]
-        || (shell ? /https?:\/\/([a-z0-9.-]+\.[a-z]{2,})(?=[/:\s"'`]|$)/i.exec(command)?.[1]?.toLowerCase() : undefined);
+        || (shell ? /(?:^|[\s=(,"'])https?:\/\/([a-z0-9.-]+\.[a-z]{2,})(?=[/:\s"'`]|$)/i.exec(code)?.[1]?.toLowerCase() : undefined);
     const tag = names.length ? strongestTag(names) : undefined;
     const hint = addHint(input.alwaysNotOffered, unique(cloud.map(entry => entry.tool)));
     let where;
@@ -481,7 +517,10 @@ function buildAskHeader(input) {
     if (credential) {
         source = 'credential';
         action = credentialAction || printer.action;
-        why = `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)}.`;
+        const sentTo = (subject.credentialHosts && subject.credentialHosts.length ? subject.credentialHosts : flows).slice(0, 3);
+        why = viaFlow && sentTo.length
+            ? `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)} and sends it to ${sentTo.join(', ')}.`
+            : `This ${noun} ${action.charAt(0).toLowerCase()}${action.slice(1)}.`;
     }
     else if (how) {
         source = 'cloud';
@@ -533,7 +572,7 @@ function buildAskHeader(input) {
         why = input.policy ? `Rule "${oneLine(input.policy, 80)}" asks before this ${noun} runs.` : `A policy asks before this ${noun} runs.`;
     }
     const decisive = !shell ? undefined
-        : source === 'credential' ? matchedSegment(command, s => TOKEN_PRINTER_ACTIONS.some(p => p.re.test(s)) || (item ? new RegExp(`\\b${(CREDENTIAL_PROGRAM[item] || '\\S')}`, 'i').test(s) : false))
+        : source === 'credential' ? matchedSegment(command, s => TOKEN_PRINTER_ACTIONS.some(p => p.re.test(codeOf(s))) || (item ? new RegExp(`\\b${(CREDENTIAL_PROGRAM[item] || '\\S')}`, 'i').test(codeOf(s)) : false))
             : source === 'cloud' ? (matchedSegment(command, s => toolSegment(decisiveTools, how).test(s) && !/\bgcloud\s+(?:auth|config)\b/i.test(s))
                 || matchedSegment(command, s => toolSegment(decisiveTools, 'any').test(s)))
                 : undefined;
@@ -545,7 +584,7 @@ function buildAskHeader(input) {
     let always = alwaysRow(input);
     if (credential) {
         const bound = subject.credentialHosts || [];
-        const followed = bound.length ? [] : (0, commandNarrative_1.tokenDestinations)(command);
+        const followed = bound.length ? [] : flows.length ? flows : (0, commandNarrative_1.tokenDestinations)(command);
         const label = (item && TOKEN_RULES.has(item)) || (!credentialAction && printer) ? 'Token sent to' : 'Secret sent to';
         secretSentTo = { label, value: [...bound, ...followed].slice(0, 3).join(', ') || 'unknown' };
         // A destination IS readable, but another step on the line is not: say that, not "could not be read".

package/dist/commandNarrative.d.ts

@@ -39,6 +39,11 @@ export declare function splitCommandSteps(command: string): string[];
 export declare function shortCode(value: string, max?: number): string;
 /** Every host a token read on this line is sent to, as the step list names it. Empty when none is readable. */
 export declare function tokenDestinations(command: string): string[];
+/**
+ * Every host a value stored by an assignment is sent to, when the assignment's value is one `reads`
+ * recognizes (a secret read the narrative does not capture), plus what `tokenDestinations` follows.
+ */
+export declare function capturedValueDestinations(command: string, reads: (segment: string) => boolean): string[];
 /** One plain-words line per step, in order. */
 export declare function describeShellCommand(command: string): CommandStep[];
 /** The step lines as the explanation prints them (`- …`). */

package/dist/commandNarrative.js

@@ -18,8 +18,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.splitCommandSteps = splitCommandSteps;
 exports.shortCode = shortCode;
 exports.tokenDestinations = tokenDestinations;
+exports.capturedValueDestinations = capturedValueDestinations;
 exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
 /** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
@@ -642,7 +644,7 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'python3':
         case 'tsx':
         case 'ts-node':
-            return step(`Runs ${program} ${rest[1] ? `(${shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
+            return step(`Runs ${program} ${rest[1] ? `(${/[\\/]/.test(rest[1]) && !rest[1].startsWith('-') ? [shortPath(rest[1]), ...rest.slice(2)].join(' ').slice(0, 80) : shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
         case 'curl':
         case 'wget':
         case 'invoke-webrequest':
@@ -677,7 +679,10 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'mkdir':
         case 'new-item':
         case 'ni':
-        case 'touch': return step(`Creates ${shortValue(rest.slice(1).filter(t => !t.startsWith('-')).join(', '), 60)}`);
+        case 'touch': {
+            const made = rest.slice(1).filter(t => !t.startsWith('-'));
+            return step(`Creates ${made.length === 1 ? shortPath(made[0]) : shortValue(made.join(', '), 60)}`);
+        }
         case 'cat':
         case 'get-content':
         case 'gc':
@@ -685,8 +690,22 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'head':
         case 'tail':
         case 'less':
-        case 'more':
-            return step(`Reads the file ${shortValue(rest.slice(1).filter(t => !t.startsWith('-'))[0] || '', 60)}${redirectNote}`);
+        case 'more': {
+            // `cat > f` / `cat 2>/dev/null f`: redirections and their targets are not files read.
+            const operands = [];
+            for (let k = 1; k < rest.length; k++) {
+                if (/^(?:\d*>{1,2}|&>|<)$/.test(rest[k])) {
+                    k++;
+                    continue;
+                }
+                if (/^(?:\d*>|&>|<)/.test(rest[k]) || rest[k].startsWith('-'))
+                    continue;
+                operands.push(rest[k]);
+            }
+            if (!operands.length && redirectTo)
+                return step(`Writes its input to ${shortValue(redirectTo, 60)}`);
+            return step(`Reads the file ${shortValue(operands[0] || '', 60)}${redirectNote}`);
+        }
         case 'ls':
         case 'dir':
         case 'get-childitem':
@@ -904,6 +923,32 @@ function tokenDestinations(command) {
     } });
     return [...new Set(described.flatMap((step, index) => step.captures ? tokenHosts(described, index, step.captures.variable) : []))].sort();
 }
+/** `$v = …` (PowerShell) or `v=$(…)` / `export v=$(…)` (POSIX): the variable an assignment step stores. */
+function assignedVariable(segment) {
+    return /^\s*\$([\w:]+)\s*=(?!=)/.exec(segment)?.[1] || /^\s*(?:export\s+)?([A-Za-z_]\w*)=\$\(/.exec(segment)?.[1];
+}
+/**
+ * Every host a value stored by an assignment is sent to, when the assignment's value is one `reads`
+ * recognizes (a secret read the narrative does not capture), plus what `tokenDestinations` follows.
+ */
+function capturedValueDestinations(command, reads) {
+    const steps = splitCommandSteps(command);
+    const fns = localFunctions(command);
+    const described = steps.map(segment => { try {
+        return describeOne(segment, undefined, fns);
+    }
+    catch {
+        return { segment, text: '', known: false };
+    } });
+    const hosts = new Set();
+    described.forEach((step, index) => {
+        const variable = step.captures?.variable || (reads(step.segment) ? assignedVariable(step.segment) : undefined);
+        if (variable)
+            for (const host of tokenHosts(described, index, variable))
+                hosts.add(host);
+    });
+    return [...hosts].sort();
+}
 function noteTokenDestinations(steps) {
     return steps.map((step, index) => {
         if (!step.captures)
@@ -921,13 +966,75 @@ function noteTokenDestinations(steps) {
         return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
     });
 }
+const HEREDOC_OPENER = /(?:^|[^<])<<-?[ \t]*(?:'[^'\n]*'|"[^"\n]*"|\\?[^\s;&|<>()'"]+)/g;
+/**
+ * A heredoc body is the input of the step that opens it, not steps of its own:
+ * drop every body (and its delimiter line) and hand each opener step its body.
+ */
+function stepsWithHeredocs(command) {
+    const heredocs = (0, deterministicGuard_1.posixHeredocs)(command);
+    if (!heredocs.length)
+        return splitCommandSteps(command).map(segment => ({ segment, heredocs: [] }));
+    let code = '';
+    let at = 0;
+    for (const heredoc of heredocs) {
+        code += command.slice(at, heredoc.bodyStart);
+        at = Math.min(command.length, heredoc.end + 1);
+    }
+    code += command.slice(at);
+    let next = 0;
+    return splitCommandSteps(code).map(segment => {
+        const opened = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => (/<</.test(m) ? m : '""')).match(HEREDOC_OPENER) || [];
+        const mine = heredocs.slice(next, next + opened.length);
+        next += opened.length;
+        return { segment, heredocs: mine };
+    });
+}
+/** A long path shortened from the front: the file name is what the reader needs. */
+function shortPath(path, max = 60) {
+    if (path.length <= max)
+        return path;
+    const parts = path.split(/[\\/]/);
+    let out = parts.pop() || '';
+    while (parts.length && out.length + parts[parts.length - 1].length + 3 <= max)
+        out = `${parts.pop()}/${out}`;
+    return `…/${out}`.slice(0, max + 2);
+}
+function lineCount(body) {
+    return body ? body.split('\n').length : 0;
+}
+/** What a step does with the heredoc bodies it opens. */
+function describeHeredocStep(segment, heredocs, fns) {
+    const [heredoc] = heredocs;
+    const lines = lineCount(heredoc.body);
+    const size = `${lines}-line`;
+    const masked = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => m.replace(/[>|]/g, '_'));
+    const target = /(?:^|[^>0-9-])>{1,2}\s*("[^"]*"|'[^']*'|[^\s&|;<]+)/.exec(masked);
+    const file = target ? unquote(segment.slice(target.index + target[0].length - target[1].length, target.index + target[0].length)) : '';
+    const words = tokens(segment).filter(t => !/^<</.test(t));
+    const program = (words[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
+    const { kind, program: reader } = heredoc.receiver;
+    const into = program === 'cat' ? file : program === 'tee' ? (file || words.slice(1).find(t => !t.startsWith('-')) || '') : '';
+    // Writing the body to a file is this step; a later step that runs the file says so itself.
+    if (into && !/\|/.test(masked)) {
+        const what = kind === 'shell' ? `a ${size} shell script` : kind === 'language' ? `a ${size} ${reader} script` : `${lines} line${lines === 1 ? '' : 's'} of text`;
+        return { segment, text: shortValue(`Writes ${what} to ${shortPath(into)}`, MAX_LINE), known: true };
+    }
+    if (kind === 'shell')
+        return { segment, text: shortValue(`Runs a ${size} script with ${reader || program}`, MAX_LINE), known: true };
+    if (kind === 'language')
+        return { segment, text: shortValue(`Runs a ${size} ${reader} script`, MAX_LINE), known: true };
+    const base = describeOne(segment.replace(HEREDOC_OPENER, m => m.replace(/<<[\s\S]*$/, '')), undefined, fns);
+    return { ...base, segment, text: shortValue(`${base.text} (given ${lines} line${lines === 1 ? '' : 's'} of input text)`, MAX_LINE) };
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
-    const steps = splitCommandSteps(command);
+    const parts = stepsWithHeredocs(command);
+    const steps = parts.map(part => part.segment);
     const fns = localFunctions(command);
-    const described = steps.map(segment => {
+    const described = parts.map(({ segment, heredocs }) => {
         try {
-            return describeOne(segment, undefined, fns);
+            return heredocs.length ? describeHeredocStep(segment, heredocs, fns) : describeOne(segment, undefined, fns);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };

package/dist/commands/daemon.js

@@ -73,6 +73,7 @@ const discoverPaths_1 = require("./discoverPaths");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const policyRefresh_1 = require("../policyRefresh");
 const telemetry_1 = require("../telemetry");
+const identityRecovery_1 = require("../identityRecovery");
 const notify_1 = require("../notify");
 const integrity_1 = require("../integrity");
 const protectionMaintenance_1 = require("../protectionMaintenance");
@@ -1505,6 +1506,7 @@ async function runDaemon(args, config) {
         // flush lock, which drops the daemon marker specifically (hook flushes do
         // not set `daemon: true`), so retrying soon is right in that case too.
         let reported = false;
+        let refusal;
         try {
             let integrity = (0, integrity_1.getLocalIntegrityReport)({ requireDaemon: true });
             // Recovery outside our repair pass (for example a manual fix) also clears
@@ -1568,6 +1570,8 @@ async function runDaemon(args, config) {
                     : undefined,
             });
             reported = result !== null;
+            if (!reported)
+                refusal = (0, telemetry_1.getLastFlushFailure)();
             if (result && unreportedCrash)
                 (0, daemonForensics_1.markPostmortemReported)();
             if (result && result.accepted > 0)
@@ -1583,10 +1587,26 @@ async function runDaemon(args, config) {
         await verifyPendingUpgrade();
         // Surface the miss to the caller (poll loop / resume path) so it retries in
         // seconds. Nothing else can tell them: liveness has exactly one writer.
-        if (!reported)
-            throw new Error('heartbeat did not reach the backend — daemon liveness was not recorded');
+        if (!reported) {
+            // 409 MACHINE_NOT_ENROLLED: the id sent is not the one this shield is
+            // enrolled under — ask the backend for it; the retry then lands.
+            await (0, identityRecovery_1.recoverIdentityAfterRefusal)({ failure: refusal, apiUrl: creds.apiUrl, shieldId: creds.shieldId, shieldKey: creds.shieldKey, log })
+                .catch(() => false);
+            throw new Error((0, identityRecovery_1.describeHeartbeatMiss)(refusal));
+        }
     };
     // --- boot ---------------------------------------------------------------
+    // Settle the machine id before anything reports: the only place a pinned
+    // but unconfirmed fallback id may be re-checked against the OS (#1853).
+    try {
+        const id = (0, machineIdentity_1.reconcileMachineIdentity)('heal');
+        log(`Machine id ${(0, machineIdentity_1.shortMachineId)(id.machineId)} (${id.source}${id.confirmed ? ', backend-confirmed' : ''}${id.probed ? `, native read ${id.probeError ? `failed: ${id.probeError}` : 'ok'}` : ''}).`
+            + (id.healed ? ` Healed from stale fallback id ${(0, machineIdentity_1.shortMachineId)(id.healed.from)}.` : '')
+            + (id.conflict ? ` Native id ${(0, machineIdentity_1.shortMachineId)(id.conflict.native)} disagrees with the confirmed id — kept the confirmed one (machine_id_conflict).` : ''));
+    }
+    catch (error) {
+        log(`Machine id reconcile failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
     // Self-heal autostart + watchdog tasks: machines installed by older versions
     // (or where task creation failed once) must converge without a reinstall.
     ensureWindowsAutostartHealthy(log);
@@ -1625,7 +1645,7 @@ async function runDaemon(args, config) {
     // the network is up (captive portal, VPN, resumed in a lift) is routine, and
     // the heartbeat loop below retries within seconds.
     await heartbeat().catch(error => {
-        log(`First heartbeat did not reach the backend (${error?.message || String(error)}) — the heartbeat loop will retry shortly.`);
+        log(`First heartbeat failed: ${error?.message || String(error)}. The heartbeat loop will retry shortly.`);
     });
     // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
     // chat has no hook and never hits an MCP server, so it is the one machine

package/dist/commands/demoActions.js

@@ -176,8 +176,8 @@ exports.DEMO_SCENARIOS = [
         id: 'recursive-delete',
         title: 'Recursive delete of a project folder',
         event: 'shell',
-        payload: { command: 'rm -rf ~/projects/payments' },
-        why: 'Destructive filesystem operations are classified as DELETE and can be governed by policy.',
+        payload: { command: 'rm -rf ~/projects' },
+        why: 'A recursive delete of a top-level home folder is classified as DELETE and can be governed by policy. Nested work paths (`~/projects/payments`) are workspace writes, not DELETE.',
     },
 ];
 function tildify(filePath) {