fullcourtdefense-cli 1.36.2 → 1.36.4

package/dist/commands/deterministicGuard.d.ts

@@ -204,12 +204,28 @@ export declare function setShellAstMode(mode: ShellAstMode): void;
 export declare function getShellAstMode(): ShellAstMode;
 /** Shadow telemetry: the comparison recorded by the most recent shell scan (consumed once). */
 export declare function takeShellAstComparison(): ShellAstComparison | undefined;
+/**
+ * PowerShell line, judged on its CODE only (`unquotedCode`): a cmdlet named
+ * inside a commit message or issue body does not change how the shell reads it.
+ */
+export declare function isPowerShellLine(text: string): boolean;
 /**
  * Code-only view of a line: each `'…'` / `"…"` / `` `…` `` span becomes a
  * space. Detectors that ask "does this EXECUTE" must look here; the raw line
  * still carries fixture strings and docs.
  */
 export declare function unquotedCode(text: string): string;
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+export declare function posixHeredocs(text: string): Array<{
+    bodyStart: number;
+    bodyEnd: number;
+    end: number;
+    body: string;
+    receiver: {
+        kind: 'shell' | 'language' | 'data';
+        program: string;
+    };
+}>;
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -46,7 +46,9 @@ exports.setShellAstProvider = setShellAstProvider;
 exports.setShellAstMode = setShellAstMode;
 exports.getShellAstMode = getShellAstMode;
 exports.takeShellAstComparison = takeShellAstComparison;
+exports.isPowerShellLine = isPowerShellLine;
 exports.unquotedCode = unquotedCode;
+exports.posixHeredocs = posixHeredocs;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
@@ -1055,9 +1057,10 @@ function destructiveCommandDecision(value, commandContext) {
     if (astHit)
         return astHit;
     // The AST parsed the literal command only. A hit that exists only in a
-    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) is
-    // outside what it saw, so it cannot clear it.
-    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(value, { literalOnly: true })?.itemId || ''))
+    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) or in
+    // a heredoc body a shell runs (`bash <<'EOF'`) is outside what it saw, so it
+    // cannot clear it.
+    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(withoutActingHeredocBodies(value), { literalOnly: true })?.itemId || ''))
         return regexHit;
     if (regexRm) {
         // The AST cleared the rm-scope hit; other destructive rules still apply.
@@ -1510,13 +1513,15 @@ function isSensitivePathContext(toolName, candidate) {
 //      (`wsl -e bash -c ""r""m"…`) that per-span reasoning cannot survive.
 //   2. A double-quoted span containing $( … ) or real backtick command
 //      substitution is kept — substitution executes BEFORE the outer command.
-//      A single-char backtick pair (`n, `t) is a PowerShell ESCAPE, not code.
+//      A single-char backtick pair (`n, `t) is a PowerShell ESCAPE, not code;
+//      on a PowerShell line (`isPowerShellLine`) so is every `$ `" `` `n in
+//      a body that uses the backtick only that way. `""` is an escaped quote.
 //   3. Single-token quoted spans (rm -rf "/") are argv, not prose — kept.
 //   4. Quoted spans in a CODE POSITION (interpreter -c/-Command/-e flags, or a
 //      remote executor earlier in the same statement) are kept.
 //   5. Secret-literal rules and honeypot/custom rules never use this view —
 //      a token pasted into a commit message still leaks.
-const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+const DATA_TO_INTERPRETER = /\b(?:iex|icm|invoke-expression|invoke-command)\b|\[scriptblock\]::create\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
 // A LANGUAGE interpreter's `-c` / `-e` argument is CODE in another language, not
 // a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
 // `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
@@ -1541,36 +1546,70 @@ function interpreterFileArguments(text) {
     if (text.length > 32_000)
         return '';
     const paths = [];
-    let calls = 0;
+    const budget = { calls: 0 };
     text.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
         if (!LANG_INTERPRETER_CODE_BEFORE.test(text.slice(Math.max(0, offset - 80), offset)))
             return whole;
-        const code = dq !== undefined ? dq : (sq || '');
-        // Preserve offsets while masking string contents: a call printed inside a
-        // string is not an invocation; a sensitive path in another argument is data.
-        const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
-        for (const call of instructions.matchAll(/\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes)\s*\(/g)) {
-            if (++calls > 48)
-                break;
-            const start = (call.index || 0) + call[0].length;
-            let depth = 1;
-            for (let end = start; end < instructions.length; end++) {
-                const ch = instructions[end];
-                if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
-                    paths.push(code.slice(start, end));
-                    break;
-                }
-                if (ch === '(')
-                    depth++;
-            }
-        }
+        collectFileCallArguments(dq !== undefined ? dq : (sq || ''), paths, budget);
         return whole;
     });
+    // Heredoc bodies a language interpreter runs (`python3 - <<'EOF'`, or
+    // `cat > x.js <<'EOF' … node x.js`) are the same inline code.
+    for (const heredoc of heredocView(text)?.heredocs || []) {
+        if (heredoc.receiver.kind === 'language')
+            collectFileCallArguments(heredoc.body, paths, budget);
+    }
     return paths.join('\n');
 }
+const FILE_CALL_RE = /\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes|readTextFile|file_get_contents|copyFile(?:Sync)?|copyfile|copy2?|Path|File\.read)\s*\(/g;
+function collectFileCallArguments(code, paths, budget) {
+    // Preserve offsets while masking string contents: a call printed inside a
+    // string is not an invocation; a sensitive path in another argument is data.
+    const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
+    for (const call of instructions.matchAll(FILE_CALL_RE)) {
+        if (++budget.calls > 48)
+            break;
+        const start = (call.index || 0) + call[0].length;
+        let depth = 1;
+        for (let end = start; end < instructions.length; end++) {
+            const ch = instructions[end];
+            if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
+                paths.push(code.slice(start, end));
+                break;
+            }
+            if (ch === '(')
+                depth++;
+        }
+    }
+}
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
+// Same signals as shellDialectOf (shellQuoteMask.ts / shellAst.ts looksLikePowerShell).
+const POWERSHELL_LINE = /\$env:|-ErrorAction\b|\bWrite-(?:Output|Host)\b|\b(?:Get|Set|New|Remove|Start|Stop|Invoke|Select|Where|ForEach|Test|Add|Format|Out|ConvertTo|ConvertFrom|Import|Export|Measure|Sort|Group|Restart|Register|Unregister|Enable|Disable|Copy|Move|Rename|Resolve|Split|Join|Read|Wait|Clear)-[A-Z][A-Za-z]+\b|@\{|@'|@"|\[(?:System\.|Security\.|IO\.|math\])|\$_\.|\$\w+\s*=\s*(?:Get|New|Read)-|\|\s*%\s|\|\s*\?\s/;
+const POWERSHELL_ONLY_SYNTAX = /(?:^|[\s;{(|])\$[A-Za-z_][\w:]*\s*[+-]?=(?!=)|`"|(?:^|[\s;{])(?:if|elseif|foreach|while|switch)\s*\((?!\()|\}\s*(?:else|elseif|catch|finally)\b|\|\s*(?:where|foreach|%|\?)\s*\{/i;
+/**
+ * PowerShell line, judged on its CODE only (`unquotedCode`): a cmdlet named
+ * inside a commit message or issue body does not change how the shell reads it.
+ */
+function isPowerShellLine(text) {
+    const code = unquotedCode(text);
+    return POWERSHELL_LINE.test(code) || POWERSHELL_ONLY_SYNTAX.test(code);
+}
+// Every backtick is a canonical PowerShell escape (`$ `" `' `` `n `t `r `0 …).
+const POWERSHELL_ESCAPES_ONLY = /^(?:[^`]|`[$"'`0abefnrtuv])*$/;
+/**
+ * Does a double-quoted body run code before its command? `$( … )` always does.
+ * A backtick pair is POSIX command substitution, except on a PowerShell line
+ * whose body uses the backtick only as PowerShell's escape character there.
+ */
+function doubleQuotedInterpolates(body, powershell) {
+    if (body.includes('$('))
+        return true;
+    if (!/`[^`]{2,}`/.test(body))
+        return false;
+    return !(powershell && POWERSHELL_ESCAPES_ONLY.test(body));
+}
 const INERT_DATA = ' fcd_inert_data ';
 // Code position immediately before a quoted span: interpreter code flags or a
 // remote/nested executor earlier in the same statement (no ; & | between).
@@ -1596,6 +1635,11 @@ function unquotedCode(text) {
                     i += 2;
                     continue;
                 }
+                // `""` inside "…" is PowerShell's escaped quote; POSIX reads close+reopen, text either way.
+                if (q === '"' && text[i] === '"' && text[i + 1] === '"') {
+                    i += 2;
+                    continue;
+                }
                 if (text[i] === q)
                     break;
                 i += 1;
@@ -1629,12 +1673,12 @@ function replaceDelimited(text, open, close, fn) {
 }
 const LINE_TERMINATOR = new Set(['\n', '\r', '\u2028', '\u2029']);
 /**
- * `src.replace(/"((?:[^"\\`]|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, fn)` in one
+ * `src.replace(/"((?:[^"\\`]|""|\\.|`[\s\S])*)"|'((?:[^'\\]|\\.)*)'/g, fn)` in one
  * pass, same matches and callback arguments (a PowerShell backtick escapes any
- * character inside double quotes). After an unclosed quote the regex retried
- * every later quote of that kind; each one before the dead end is the tail of an
- * escape pair and walks the same path to the same dead end (quadratic on a body
- * of `\"`).
+ * character inside double quotes; `""` is an escaped quote there). After an
+ * unclosed quote the regex retried every later quote of that kind; each one
+ * before the dead end is the tail of an escape pair and walks the same path to
+ * the same dead end (quadratic on a body of `\"`).
  */
 function replaceQuotedSpans(src, fn) {
     const deadUntil = { '"': -1, "'": -1 };
@@ -1651,6 +1695,10 @@ function replaceQuotedSpans(src, fn) {
         let closed = -1;
         while (j < src.length) {
             const c = src[j];
+            if (c === '"' && quote === '"' && src[j + 1] === '"') {
+                j += 2;
+                continue;
+            }
             if (c === quote) {
                 closed = j;
                 break;
@@ -1680,30 +1728,437 @@ function replaceQuotedSpans(src, fn) {
     }
     return out + src.slice(from);
 }
+// Stdin of these is executed as shell/SQL code; `done`/`fi`/`esac`/`}`/`)`
+// close a compound command whose body acts on what it reads (`while read c; do $c; done <<EOF`).
+const SHELL_STDIN_PROGRAMS = /^(?:sh|bash|zsh|dash|ksh|mksh|ash|csh|tcsh|fish|busybox|pwsh|powershell|cmd|ssh|wsl|chroot|su|eval|source|\.|xargs|parallel|at|batch|crontab|expect|tclsh|wish|osascript|script|psql|mysql|mariadb|sqlite3|sqlcmd|mongosh|mongo|redis-cli|cqlsh|clickhouse-client|duckdb|snowsql|done|fi|esac|\}|\))$/;
+const LANGUAGE_STDIN_PROGRAMS = /^(?:node|nodejs|deno|bun|python[0-9.]*|py|pypy[0-9.]*|perl|ruby|php|lua|luajit|tsx|ts-node|rscript|julia|groovy)$/;
+const CONTAINER_CLI_PROGRAMS = /^(?:docker|podman|nerdctl|kubectl|oc)$/;
+const RECEIVER_RANK = { data: 0, language: 1, shell: 2 };
+function programName(token) {
+    return token.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.(?:exe|cmd|bat)$/, '');
+}
+/** Words of one stage without assignments and redirections (`> f`, `2>&1`, `<<'EOF'`). */
+function stageWords(stage) {
+    const words = [];
+    const tokens = segmentTokens(stage.trim());
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (/^(?:\d*>{1,2}|&>{1,2}|<{1,3}-?|\d*<)$/.test(token)) {
+            i++;
+            continue;
+        }
+        if (/^(?:\d*>|&>|<)/.test(token))
+            continue;
+        if (!words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        words.push(token);
+    }
+    return words;
+}
+/** How one pipeline stage treats the bytes on its stdin. */
+function stdinReceiver(stage) {
+    const words = stageWords(stage);
+    for (let i = 0; i < words.length; i++) {
+        const program = programName(words[i]);
+        if (SHELL_STDIN_PROGRAMS.test(program))
+            return { kind: 'shell', program };
+        if (LANGUAGE_STDIN_PROGRAMS.test(program))
+            return { kind: 'language', program };
+        if (CONTAINER_CLI_PROGRAMS.test(program)) {
+            return words.slice(i + 1).some(word => /^(?:exec|run|attach|debug)$/i.test(word)) ? { kind: 'shell', program } : { kind: 'data', program };
+        }
+        if (AST_TRANSPARENT_WRAPPERS.has(program)) {
+            // `sudo -u root bash`, `env X=1 node`, `timeout 5 sh`: the reader is a later word, past the wrapper's own options.
+            let reader = { kind: 'data', program };
+            for (const word of words.slice(i + 1))
+                reader = strongerReceiver(reader, stdinReceiver(word));
+            return reader;
+        }
+        return { kind: 'data', program };
+    }
+    return { kind: 'data', program: '' };
+}
+function strongerReceiver(a, b) {
+    return RECEIVER_RANK[b.kind] > RECEIVER_RANK[a.kind] ? b : a;
+}
+/** Files the opener stage writes its stdin to (`cat > f`, `tee f`). */
+function stageWriteTargets(stage) {
+    const targets = redirectTargets(stage);
+    const words = stageWords(stage);
+    if (programName(words[0] || '') === 'tee')
+        targets.push(...words.slice(1).filter(word => !word.startsWith('-')));
+    return targets.map(target => programName(target)).filter(Boolean);
+}
+/** The strongest program among `statements` that runs one of `files` (`node x.js`, `bash x.sh`, `./x.sh`). */
+function laterRunnerOf(files, statements) {
+    let runner = { kind: 'data', program: '' };
+    if (!files.length)
+        return runner;
+    for (const stages of statements) {
+        for (const stage of stages) {
+            const words = stageWords(stage);
+            if (!words.some(word => files.includes(programName(word))))
+                continue;
+            const direct = files.includes(programName(words[0] || ''));
+            runner = strongerReceiver(runner, direct ? { kind: 'shell', program: programName(words[0]) } : stdinReceiver(stage));
+        }
+    }
+    return runner;
+}
+/**
+ * Every heredoc of a POSIX command line, with its exact body and its stages.
+ * `undefined` when the line does not lex (an unclosed quote or substitution):
+ * callers then keep every body as code.
+ */
+function lexHeredocs(text) {
+    const spans = [];
+    const pending = [];
+    const frame = (closer, stageStart) => ({ closer, quote: '', depth: 0, afterPipe: false, stageStart, stages: [], open: [] });
+    const stack = [frame('', 0)];
+    /** `i` at the first `(` of `((`: index of the closing `))` (arithmetic holds no heredoc; `<<` there is a shift). */
+    const arithmeticEnd = (i) => {
+        let depth = 0;
+        for (let k = i; k < text.length; k++) {
+            if (text[k] === '(')
+                depth++;
+            else if (text[k] === ')' && --depth === 0)
+                return k;
+        }
+        return -1;
+    };
+    const codeSlice = (from, to) => {
+        let out = '';
+        let at = from;
+        for (const span of spans) {
+            if (span.end <= at || span.bodyStart >= to)
+                continue;
+            out += text.slice(at, Math.max(at, span.bodyStart));
+            at = Math.max(at, span.end);
+        }
+        return out + text.slice(at, Math.max(at, to));
+    };
+    const endStage = (ctx, at) => { ctx.stages.push(codeSlice(ctx.stageStart, at)); ctx.stageStart = at + 1; };
+    const endStatement = (ctx, at) => {
+        endStage(ctx, at);
+        for (const { span, stage } of ctx.open)
+            span.stages = ctx.stages.slice(stage);
+        ctx.stages = [];
+        ctx.open = [];
+    };
+    const readBodies = (newline) => {
+        let pos = newline + 1;
+        for (const { span, delimiter, stripTabs } of pending.splice(0)) {
+            span.bodyStart = pos;
+            span.bodyEnd = span.end = text.length;
+            while (pos < text.length) {
+                const lineEnd = text.indexOf('\n', pos);
+                const stop = lineEnd < 0 ? text.length : lineEnd;
+                let line = text.slice(pos, stop).replace(/\r$/, '');
+                if (stripTabs)
+                    line = line.replace(/^\t+/, '');
+                if (line === delimiter) {
+                    span.bodyEnd = pos;
+                    span.end = stop;
+                    pos = stop + 1;
+                    break;
+                }
+                pos = stop + 1;
+            }
+            span.body = text.slice(span.bodyStart, span.bodyEnd < text.length ? Math.max(span.bodyStart, span.bodyEnd - 1) : text.length);
+            spans.push(span);
+        }
+        return pos;
+    };
+    for (let i = 0; i < text.length; i++) {
+        const ctx = stack[stack.length - 1];
+        const c = text[i];
+        const next = text[i + 1];
+        if (ctx.quote === "'") {
+            if (c === "'")
+                ctx.quote = '';
+            continue;
+        }
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (ctx.quote === '"') {
+            if (c === '"')
+                ctx.quote = '';
+            else if (c === '$' && next === '(' && text[i + 2] === '(') {
+                const e = arithmeticEnd(i + 1);
+                if (e < 0)
+                    return undefined;
+                i = e;
+            }
+            else if (c === '$' && next === '(') {
+                stack.push(frame(')', i + 2));
+                i++;
+            }
+            else if (c === '`')
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c !== '|' && c !== '\n' && !/\s/.test(c))
+            ctx.afterPipe = false;
+        if (c === '#' && (i === 0 || /[\s;&|(]/.test(text[i - 1]))) {
+            const nl = text.indexOf('\n', i);
+            i = (nl < 0 ? text.length : nl) - 1;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            ctx.quote = c;
+            continue;
+        }
+        if ((c === '$' && next === '(' && text[i + 2] === '(') || (c === '(' && next === '(')) {
+            const e = arithmeticEnd(c === '$' ? i + 1 : i);
+            if (e < 0)
+                return undefined;
+            i = e;
+            continue;
+        }
+        if (c === '$' && next === '(') {
+            stack.push(frame(')', i + 2));
+            i++;
+            continue;
+        }
+        if (c === '`') {
+            if (ctx.closer === '`') {
+                endStatement(ctx, i);
+                stack.pop();
+            }
+            else
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c === '(') {
+            endStatement(ctx, i);
+            ctx.depth++;
+            continue;
+        }
+        if (c === ')') {
+            endStatement(ctx, i);
+            if (ctx.depth > 0)
+                ctx.depth--;
+            else if (ctx.closer === ')' && stack.length > 1)
+                stack.pop();
+            continue;
+        }
+        if (c === '{' && (next === undefined || /\s/.test(next))) {
+            endStatement(ctx, i);
+            continue;
+        }
+        if (c === ';' || (c === '&' && next !== '>' && text[i - 1] !== '>' && text[i - 1] !== '<')) {
+            endStatement(ctx, i);
+            if ((c === '&' && next === '&') || (c === ';' && next === ';'))
+                i++;
+            continue;
+        }
+        if (c === '|') {
+            if (next === '|') {
+                endStatement(ctx, i);
+                i++;
+            }
+            else {
+                endStage(ctx, i);
+                ctx.afterPipe = true;
+                if (next === '&')
+                    i++;
+            }
+            continue;
+        }
+        if (c === '\n') {
+            // `cat <<'EOF' |` continues the pipeline on the line after the body.
+            if (!ctx.afterPipe)
+                endStatement(ctx, i);
+            if (pending.length) {
+                const after = readBodies(i);
+                if (ctx.stageStart <= after)
+                    ctx.stageStart = after;
+                i = after - 1;
+            }
+            continue;
+        }
+        if (c === '<' && next === '<' && text[i - 1] !== '<') {
+            if (text[i + 2] === '<') {
+                i += 2;
+                continue;
+            } // `<<<` here-string: quoted-span pass
+            let j = i + 2;
+            const stripTabs = text[j] === '-';
+            if (stripTabs)
+                j++;
+            while (text[j] === ' ' || text[j] === '\t')
+                j++;
+            let delimiter = '';
+            let literal = false;
+            while (j < text.length && !/[\s;&|<>()]/.test(text[j])) {
+                const q = text[j];
+                if (q === "'" || q === '"') {
+                    const close = text.indexOf(q, j + 1);
+                    if (close < 0)
+                        return undefined;
+                    delimiter += text.slice(j + 1, close);
+                    literal = true;
+                    j = close + 1;
+                }
+                else if (q === '\\') {
+                    delimiter += text[j + 1] || '';
+                    literal = true;
+                    j += 2;
+                }
+                else {
+                    delimiter += q;
+                    j++;
+                }
+            }
+            if (!delimiter) {
+                i = j - 1;
+                continue;
+            }
+            const span = { bodyStart: text.length, bodyEnd: text.length, end: text.length, body: '', literal, stages: [] };
+            pending.push({ span, delimiter, stripTabs });
+            ctx.open.push({ span, stage: ctx.stages.length });
+            i = j - 1;
+            continue;
+        }
+    }
+    if (stack.length > 1 || stack[0].quote)
+        return undefined;
+    if (pending.length)
+        readBodies(text.length - 1);
+    endStatement(stack[0], text.length);
+    return spans;
+}
+/** Heredocs of a POSIX line, each with the receiver that decides what its body is. */
+function heredocView(text) {
+    if (!text.includes('<<') || text.length > 256_000)
+        return undefined;
+    const spans = lexHeredocs(text);
+    if (!spans || !spans.length)
+        return undefined;
+    let skeleton = '';
+    let at = 0;
+    for (const span of spans) {
+        skeleton += text.slice(at, span.bodyStart);
+        at = span.end;
+    }
+    skeleton += text.slice(at);
+    const statements = splitUnquotedPipelines(skeleton);
+    const heredocs = spans.map(span => {
+        let receiver = { kind: 'data', program: '' };
+        for (const stage of span.stages)
+            receiver = strongerReceiver(receiver, stdinReceiver(stage));
+        receiver = strongerReceiver(receiver, laterRunnerOf(stageWriteTargets(span.stages[0] || ''), statements));
+        return { ...span, receiver };
+    });
+    return { heredocs, skeleton };
+}
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+function posixHeredocs(text) {
+    return (heredocView(text)?.heredocs || []).map(({ bodyStart, bodyEnd, end, body, receiver }) => ({ bodyStart, bodyEnd, end, body, receiver }));
+}
+/** Does this heredoc body run as code where it lands? */
+function heredocBodyActs(heredoc) {
+    // Unquoted delimiter: `$( … )` / backticks in the body run before any receiver sees it.
+    if (!heredoc.literal && INTERPOLATES.test(heredoc.body))
+        return true;
+    if (heredoc.receiver.kind === 'shell')
+        return true;
+    if (heredoc.receiver.kind === 'language') {
+        return CODE_SPAWNS_PROCESS.test(heredoc.body)
+            || (/^(?:perl|ruby)$/.test(heredoc.receiver.program) && /`[^`]*`|%x[\[{(]/.test(heredoc.body))
+            || interpreterCodeRequestsMetadata(heredoc.body);
+    }
+    return false;
+}
+/**
+ * Each body becomes `inert` when it is data, or `acting(index)` when it runs
+ * (left as is without `acting`). Delimiter lines stay, so the result still
+ * lexes. Returns the bodies that run so a caller can put them back verbatim.
+ */
+function replaceHeredocBodies(text, view, inert, acting) {
+    let out = '';
+    let at = 0;
+    const kept = [];
+    for (const heredoc of view.heredocs) {
+        const acts = heredocBodyActs(heredoc);
+        if (acts && !acting)
+            continue;
+        out += text.slice(at, heredoc.bodyStart) + (acts ? acting(kept.push(heredoc.body) - 1) : inert);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return { text: out + text.slice(at), acting: kept };
+}
+/** The line as a bash parser sees it: bodies that RUN are opaque text there, so blank them. */
+function withoutActingHeredocBodies(text) {
+    const view = heredocView(text);
+    if (!view)
+        return text;
+    let out = '';
+    let at = 0;
+    for (const heredoc of view.heredocs) {
+        if (!heredocBodyActs(heredoc))
+            continue;
+        out += text.slice(at, heredoc.bodyStart);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return out + text.slice(at);
+}
+const ACTING_BODY_MARK = (index) => `fcd_acting_heredoc_${index}_`;
+/** Receiver of a `<<<` here-string whose quoted word starts at `offset`. */
+function hereStringReceiver(src, offset) {
+    const head = src.slice(src.lastIndexOf('\n', offset - 1) + 1, offset).replace(/<<<\s*$/, '');
+    const statements = splitUnquotedPipelines(head);
+    const stages = statements[statements.length - 1] || [];
+    return stdinReceiver(stages[stages.length - 1] || '');
+}
 function stripInertDataSegments(text) {
-    if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
+    const heredocs = heredocView(text);
+    // A data body (`cat > notes.md <<'EOF' … ssh … EOF`) cannot make the line an
+    // interpreter feed; only the code around it, and bodies that run, can.
+    const executable = heredocs ? replaceHeredocBodies(text, heredocs, '').text : text;
+    if (DATA_TO_INTERPRETER.test(unquotedCode(executable)))
         return text;
+    // A body that runs is code line for line: park it so the quoted-span pass
+    // below cannot read `os.system('rm -rf ~')` as prose, then put it back.
+    const parked = heredocs ? replaceHeredocBodies(text, heredocs, INERT_DATA, ACTING_BODY_MARK) : { text, acting: [] };
+    let out = stripQuotedData(parked.text);
+    parked.acting.forEach((body, index) => {
+        const mark = ACTING_BODY_MARK(index);
+        out = out.includes(mark) ? out.replace(mark, () => body) : `${out}\n${body}`;
+    });
+    return out;
+}
+/** Here-strings and quoted prose of a line whose heredoc bodies are already resolved. */
+function stripQuotedData(text) {
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
     out = replaceDelimited(out, "@'", "'@", () => INERT_DATA);
     out = replaceDelimited(out, '@"', '"@', m => (m.includes('$(') ? m : INERT_DATA));
-    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
-    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
-    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
+    const powershell = isPowerShellLine(src);
     out = replaceQuotedSpans(src, (whole, dq, sq, offset) => {
         const body = dq !== undefined ? dq : (sq || '');
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
         const before = src.slice(Math.max(0, offset - 80), offset);
+        // `bash <<< "…"` feeds the quoted word to stdin: it is what its reader makes of it.
+        if (/<<<\s*$/.test(before)) {
+            const receiver = hereStringReceiver(src, offset);
+            if (receiver.kind === 'shell')
+                return whole;
+            if (receiver.kind === 'language')
+                return CODE_SPAWNS_PROCESS.test(body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
+        }
         // Language-interpreter code: data unless it spawns a process (see above).
         if (LANG_INTERPRETER_CODE_BEFORE.test(before))
             return interpreterCodeSpawnsProcess(before, body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
         if (CODE_CONTEXT_BEFORE.test(before))
             return whole; // code position: executes
-        if (dq !== undefined && INTERPOLATES.test(body))
+        if (dq !== undefined && doubleQuotedInterpolates(body, powershell))
             return whole; // $( )/`cmd` executes first
         return INERT_DATA;
     });

package/dist/commands/doctor.js

@@ -165,6 +165,7 @@ async function healthCheck(apiUrl, config) {
     }
     console.log('');
     const identity = getMachineIdentity();
+    console.log(`machine id: ${identity.machineId.slice(0, 8)} (source: ${identity.idSource || 'unknown'}${identity.idConfirmed ? ', backend-confirmed' : ', not yet confirmed by the backend'})`);
     const report = await runDeepSelfTest({
         creds,
         developerName: identity.developerName,

package/dist/commands/login.js

@@ -20,6 +20,9 @@ async function loginCommand(args, config) {
         throw new Error('A fleet enrollment token is required. Pass --token <token> or set FCD_ENROLL_TOKEN.\n'
             + 'An org admin issues one from the AI Fleet console (Settings → Fleet enrollment token).');
     }
+    // Enrollment binds the fleet record to this id for good: an unconfirmed
+    // fallback pin gets one native re-check first, throttle or not.
+    (0, machineIdentity_1.reconcileMachineIdentity)('force');
     const identity = (0, machineIdentity_1.getMachineIdentity)();
     const shieldName = (0, machineIdentity_1.suggestedShieldName)(identity);
     const nickname = (args.nickname || process.env.FCD_MACHINE_NICKNAME || '').trim().slice(0, 80) || undefined;
@@ -51,6 +54,7 @@ async function loginCommand(args, config) {
         throw new Error(data.error || `Enrollment failed (HTTP ${resp.status})`);
     }
     const result = data.data;
+    (0, machineIdentity_1.confirmMachineIdentity)(identity.machineId, 'enrollment');
     // Clear any leftover runtime cache (previous enrollment, failed/partial
     // install) so a stale enforcing bundle can never keep blocking on a freshly
     // enrolled machine. The next hook/gateway call fetches the real bundle.