fullcourtdefense-cli 1.36.3 → 1.36.4

package/dist/actionPolicyEngine.d.ts

@@ -309,6 +309,25 @@ export declare function inferToolContext(toolName: string, args: Record<string,
     operation: string;
     context: Record<string, string>;
 };
+/**
+ * What kind of site a destination host is, for the few kinds that change how an
+ * upload should be read. A curated list, not a reputation feed: a host is in it
+ * only when its PURPOSE is the category (a paste site exists to publish text; a
+ * request catcher exists to capture whatever is sent to it). Deliberately absent:
+ * general cloud storage, code hosting and gists, which are everyday developer
+ * destinations and would turn the category into noise.
+ */
+export type DestinationCategory = 'paste' | 'file_drop' | 'request_capture' | 'tunnel' | 'messaging' | 'news';
+export declare const DESTINATION_CATEGORY_HOSTS: Readonly<Record<DestinationCategory, readonly string[]>>;
+/** Categories whose purpose is to receive data from strangers: a first upload there is high risk. */
+export declare const HIGH_RISK_DESTINATION_CATEGORIES: ReadonlySet<DestinationCategory>;
+/** The listed host itself or any subdomain of it (`www.pastebin.com`, `x.m.pipedream.net`); never a look-alike (`notpastebin.com`). */
+export declare function destinationCategory(host: string | undefined | null): DestinationCategory | undefined;
+/** A host's category and whether that category exists to receive data from anyone — the shape the anomaly scorer takes. */
+export declare function classifyDestinationHost(host: string): {
+    category: DestinationCategory;
+    dataDrop: boolean;
+} | undefined;
 /** Exported for reproducible detector artifacts; policy decisions are not packaged. */
 export declare function inferBundledToolContext(toolName: string, args: Record<string, any>): {
     operation: string;

package/dist/actionPolicyEngine.js

@@ -24,14 +24,18 @@ __export(actionPolicyEngine_exports, {
   ACTION_POLICY_GRANT_MAX_USES: () => ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS: () => CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL: () => DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS: () => DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE: () => GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE: () => GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE: () => GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES: () => HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS: () => MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL: () => WORKSTATION_ASK_APPROVAL,
   approvalExceptionError: () => approvalExceptionError,
   canonicalAgentClient: () => canonicalAgentClient,
+  classifyDestinationHost: () => classifyDestinationHost,
   deriveToolOperations: () => deriveToolOperations,
+  destinationCategory: () => destinationCategory,
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
@@ -6888,6 +6892,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "destination.host",
   "destination.type",
   "destination.repository",
+  "destination.category",
   "destinationHost",
   "host",
   "hostname",
@@ -8767,8 +8772,145 @@ function inferToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
+var DESTINATION_CATEGORY_HOSTS = {
+  paste: [
+    "pastebin.com",
+    "paste.ee",
+    "hastebin.com",
+    "rentry.co",
+    "rentry.org",
+    "dpaste.org",
+    "dpaste.com",
+    "paste.rs",
+    "termbin.com",
+    "controlc.com",
+    "justpaste.it",
+    "privatebin.net",
+    "ix.io",
+    "sprunge.us",
+    "pastes.io",
+    "paste.mozilla.org"
+  ],
+  file_drop: [
+    "transfer.sh",
+    "file.io",
+    "0x0.st",
+    "temp.sh",
+    "bashupload.com",
+    "gofile.io",
+    "catbox.moe",
+    "uguu.se",
+    "tmpfiles.org",
+    "filebin.net",
+    "wetransfer.com",
+    "we.tl",
+    "sendspace.com",
+    "mediafire.com",
+    "mega.nz",
+    "anonfiles.com",
+    "oshi.at",
+    "pixeldrain.com",
+    "ufile.io",
+    "keep.sh",
+    "filetransfer.io"
+  ],
+  request_capture: [
+    "webhook.site",
+    "pipedream.net",
+    "beeceptor.com",
+    "hookbin.com",
+    "requestcatcher.com",
+    "interact.sh",
+    "oast.fun",
+    "oast.pro",
+    "oast.live",
+    "oast.site",
+    "oast.online",
+    "oast.me",
+    "oastify.com",
+    "burpcollaborator.net",
+    "dnslog.cn",
+    "ceye.io"
+  ],
+  tunnel: [
+    "ngrok.io",
+    "ngrok.app",
+    "ngrok.dev",
+    "ngrok-free.app",
+    "ngrok-free.dev",
+    "trycloudflare.com",
+    "loca.lt",
+    "localtunnel.me",
+    "serveo.net",
+    "localhost.run",
+    "lhr.life",
+    "pinggy.io",
+    "pinggy.link",
+    "bore.pub"
+  ],
+  messaging: ["discord.com", "discordapp.com", "api.telegram.org", "hooks.slack.com"],
+  news: [
+    "ynet.co.il",
+    "ynetnews.com",
+    "walla.co.il",
+    "mako.co.il",
+    "n12.co.il",
+    "haaretz.co.il",
+    "haaretz.com",
+    "themarker.com",
+    "maariv.co.il",
+    "globes.co.il",
+    "calcalist.co.il",
+    "israelhayom.co.il",
+    "kan.org.il",
+    "timesofisrael.com",
+    "jpost.com",
+    "i24news.tv",
+    "bbc.com",
+    "bbc.co.uk",
+    "cnn.com",
+    "nytimes.com",
+    "reuters.com",
+    "apnews.com",
+    "theguardian.com",
+    "washingtonpost.com",
+    "wsj.com",
+    "bloomberg.com",
+    "ft.com",
+    "foxnews.com",
+    "nbcnews.com",
+    "cbsnews.com",
+    "npr.org",
+    "aljazeera.com"
+  ]
+};
+var HIGH_RISK_DESTINATION_CATEGORIES = /* @__PURE__ */ new Set(["paste", "file_drop", "request_capture", "tunnel"]);
+var DESTINATION_CATEGORY_BY_HOST = new Map(
+  Object.entries(DESTINATION_CATEGORY_HOSTS).flatMap(([category, hosts]) => hosts.map((host) => [host, category]))
+);
+function destinationCategory(host) {
+  let candidate = String(host || "").trim().toLowerCase().replace(/\.$/, "");
+  while (candidate) {
+    const category = DESTINATION_CATEGORY_BY_HOST.get(candidate);
+    if (category) return category;
+    const dot = candidate.indexOf(".");
+    if (dot < 0) return void 0;
+    candidate = candidate.slice(dot + 1);
+  }
+  return void 0;
+}
+function classifyDestinationHost(host) {
+  const category = destinationCategory(host);
+  return category ? { category, dataDrop: HIGH_RISK_DESTINATION_CATEGORIES.has(category) } : void 0;
+}
+function applyDestinationCategoryFact(context) {
+  delete context["destination.category"];
+  const category = destinationCategory(context["destination.domain"]);
+  if (category) context["destination.category"] = category;
+}
 function applyRemoteControlFact(toolName, args, context) {
   delete context["toolArgs.remoteControl"];
   const shellText = remoteControlProvider ? shellCommandTextOf(toolName, args) : void 0;
@@ -8920,6 +9062,7 @@ function inferBundledToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
 var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
@@ -9021,14 +9164,18 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL,
   approvalExceptionError,
   canonicalAgentClient,
+  classifyDestinationHost,
   deriveToolOperations,
+  destinationCategory,
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,

package/dist/commandNarrative.js

@@ -21,6 +21,7 @@ exports.tokenDestinations = tokenDestinations;
 exports.capturedValueDestinations = capturedValueDestinations;
 exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
 /** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
@@ -643,7 +644,7 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'python3':
         case 'tsx':
         case 'ts-node':
-            return step(`Runs ${program} ${rest[1] ? `(${shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
+            return step(`Runs ${program} ${rest[1] ? `(${/[\\/]/.test(rest[1]) && !rest[1].startsWith('-') ? [shortPath(rest[1]), ...rest.slice(2)].join(' ').slice(0, 80) : shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
         case 'curl':
         case 'wget':
         case 'invoke-webrequest':
@@ -678,7 +679,10 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'mkdir':
         case 'new-item':
         case 'ni':
-        case 'touch': return step(`Creates ${shortValue(rest.slice(1).filter(t => !t.startsWith('-')).join(', '), 60)}`);
+        case 'touch': {
+            const made = rest.slice(1).filter(t => !t.startsWith('-'));
+            return step(`Creates ${made.length === 1 ? shortPath(made[0]) : shortValue(made.join(', '), 60)}`);
+        }
         case 'cat':
         case 'get-content':
         case 'gc':
@@ -686,8 +690,22 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'head':
         case 'tail':
         case 'less':
-        case 'more':
-            return step(`Reads the file ${shortValue(rest.slice(1).filter(t => !t.startsWith('-'))[0] || '', 60)}${redirectNote}`);
+        case 'more': {
+            // `cat > f` / `cat 2>/dev/null f`: redirections and their targets are not files read.
+            const operands = [];
+            for (let k = 1; k < rest.length; k++) {
+                if (/^(?:\d*>{1,2}|&>|<)$/.test(rest[k])) {
+                    k++;
+                    continue;
+                }
+                if (/^(?:\d*>|&>|<)/.test(rest[k]) || rest[k].startsWith('-'))
+                    continue;
+                operands.push(rest[k]);
+            }
+            if (!operands.length && redirectTo)
+                return step(`Writes its input to ${shortValue(redirectTo, 60)}`);
+            return step(`Reads the file ${shortValue(operands[0] || '', 60)}${redirectNote}`);
+        }
         case 'ls':
         case 'dir':
         case 'get-childitem':
@@ -948,13 +966,75 @@ function noteTokenDestinations(steps) {
         return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
     });
 }
+const HEREDOC_OPENER = /(?:^|[^<])<<-?[ \t]*(?:'[^'\n]*'|"[^"\n]*"|\\?[^\s;&|<>()'"]+)/g;
+/**
+ * A heredoc body is the input of the step that opens it, not steps of its own:
+ * drop every body (and its delimiter line) and hand each opener step its body.
+ */
+function stepsWithHeredocs(command) {
+    const heredocs = (0, deterministicGuard_1.posixHeredocs)(command);
+    if (!heredocs.length)
+        return splitCommandSteps(command).map(segment => ({ segment, heredocs: [] }));
+    let code = '';
+    let at = 0;
+    for (const heredoc of heredocs) {
+        code += command.slice(at, heredoc.bodyStart);
+        at = Math.min(command.length, heredoc.end + 1);
+    }
+    code += command.slice(at);
+    let next = 0;
+    return splitCommandSteps(code).map(segment => {
+        const opened = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => (/<</.test(m) ? m : '""')).match(HEREDOC_OPENER) || [];
+        const mine = heredocs.slice(next, next + opened.length);
+        next += opened.length;
+        return { segment, heredocs: mine };
+    });
+}
+/** A long path shortened from the front: the file name is what the reader needs. */
+function shortPath(path, max = 60) {
+    if (path.length <= max)
+        return path;
+    const parts = path.split(/[\\/]/);
+    let out = parts.pop() || '';
+    while (parts.length && out.length + parts[parts.length - 1].length + 3 <= max)
+        out = `${parts.pop()}/${out}`;
+    return `…/${out}`.slice(0, max + 2);
+}
+function lineCount(body) {
+    return body ? body.split('\n').length : 0;
+}
+/** What a step does with the heredoc bodies it opens. */
+function describeHeredocStep(segment, heredocs, fns) {
+    const [heredoc] = heredocs;
+    const lines = lineCount(heredoc.body);
+    const size = `${lines}-line`;
+    const masked = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => m.replace(/[>|]/g, '_'));
+    const target = /(?:^|[^>0-9-])>{1,2}\s*("[^"]*"|'[^']*'|[^\s&|;<]+)/.exec(masked);
+    const file = target ? unquote(segment.slice(target.index + target[0].length - target[1].length, target.index + target[0].length)) : '';
+    const words = tokens(segment).filter(t => !/^<</.test(t));
+    const program = (words[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
+    const { kind, program: reader } = heredoc.receiver;
+    const into = program === 'cat' ? file : program === 'tee' ? (file || words.slice(1).find(t => !t.startsWith('-')) || '') : '';
+    // Writing the body to a file is this step; a later step that runs the file says so itself.
+    if (into && !/\|/.test(masked)) {
+        const what = kind === 'shell' ? `a ${size} shell script` : kind === 'language' ? `a ${size} ${reader} script` : `${lines} line${lines === 1 ? '' : 's'} of text`;
+        return { segment, text: shortValue(`Writes ${what} to ${shortPath(into)}`, MAX_LINE), known: true };
+    }
+    if (kind === 'shell')
+        return { segment, text: shortValue(`Runs a ${size} script with ${reader || program}`, MAX_LINE), known: true };
+    if (kind === 'language')
+        return { segment, text: shortValue(`Runs a ${size} ${reader} script`, MAX_LINE), known: true };
+    const base = describeOne(segment.replace(HEREDOC_OPENER, m => m.replace(/<<[\s\S]*$/, '')), undefined, fns);
+    return { ...base, segment, text: shortValue(`${base.text} (given ${lines} line${lines === 1 ? '' : 's'} of input text)`, MAX_LINE) };
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
-    const steps = splitCommandSteps(command);
+    const parts = stepsWithHeredocs(command);
+    const steps = parts.map(part => part.segment);
     const fns = localFunctions(command);
-    const described = steps.map(segment => {
+    const described = parts.map(({ segment, heredocs }) => {
         try {
-            return describeOne(segment, undefined, fns);
+            return heredocs.length ? describeHeredocStep(segment, heredocs, fns) : describeOne(segment, undefined, fns);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };

package/dist/commands/deterministicGuard.d.ts

@@ -215,6 +215,17 @@ export declare function isPowerShellLine(text: string): boolean;
  * still carries fixture strings and docs.
  */
 export declare function unquotedCode(text: string): string;
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+export declare function posixHeredocs(text: string): Array<{
+    bodyStart: number;
+    bodyEnd: number;
+    end: number;
+    body: string;
+    receiver: {
+        kind: 'shell' | 'language' | 'data';
+        program: string;
+    };
+}>;
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -48,6 +48,7 @@ exports.getShellAstMode = getShellAstMode;
 exports.takeShellAstComparison = takeShellAstComparison;
 exports.isPowerShellLine = isPowerShellLine;
 exports.unquotedCode = unquotedCode;
+exports.posixHeredocs = posixHeredocs;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
@@ -1056,9 +1057,10 @@ function destructiveCommandDecision(value, commandContext) {
     if (astHit)
         return astHit;
     // The AST parsed the literal command only. A hit that exists only in a
-    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) is
-    // outside what it saw, so it cannot clear it.
-    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(value, { literalOnly: true })?.itemId || ''))
+    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) or in
+    // a heredoc body a shell runs (`bash <<'EOF'`) is outside what it saw, so it
+    // cannot clear it.
+    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(withoutActingHeredocBodies(value), { literalOnly: true })?.itemId || ''))
         return regexHit;
     if (regexRm) {
         // The AST cleared the rm-scope hit; other destructive rules still apply.
@@ -1519,7 +1521,7 @@ function isSensitivePathContext(toolName, candidate) {
 //      remote executor earlier in the same statement) are kept.
 //   5. Secret-literal rules and honeypot/custom rules never use this view —
 //      a token pasted into a commit message still leaks.
-const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+const DATA_TO_INTERPRETER = /\b(?:iex|icm|invoke-expression|invoke-command)\b|\[scriptblock\]::create\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
 // A LANGUAGE interpreter's `-c` / `-e` argument is CODE in another language, not
 // a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
 // `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
@@ -1544,33 +1546,42 @@ function interpreterFileArguments(text) {
     if (text.length > 32_000)
         return '';
     const paths = [];
-    let calls = 0;
+    const budget = { calls: 0 };
     text.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
         if (!LANG_INTERPRETER_CODE_BEFORE.test(text.slice(Math.max(0, offset - 80), offset)))
             return whole;
-        const code = dq !== undefined ? dq : (sq || '');
-        // Preserve offsets while masking string contents: a call printed inside a
-        // string is not an invocation; a sensitive path in another argument is data.
-        const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
-        for (const call of instructions.matchAll(/\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes)\s*\(/g)) {
-            if (++calls > 48)
-                break;
-            const start = (call.index || 0) + call[0].length;
-            let depth = 1;
-            for (let end = start; end < instructions.length; end++) {
-                const ch = instructions[end];
-                if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
-                    paths.push(code.slice(start, end));
-                    break;
-                }
-                if (ch === '(')
-                    depth++;
-            }
-        }
+        collectFileCallArguments(dq !== undefined ? dq : (sq || ''), paths, budget);
         return whole;
     });
+    // Heredoc bodies a language interpreter runs (`python3 - <<'EOF'`, or
+    // `cat > x.js <<'EOF' … node x.js`) are the same inline code.
+    for (const heredoc of heredocView(text)?.heredocs || []) {
+        if (heredoc.receiver.kind === 'language')
+            collectFileCallArguments(heredoc.body, paths, budget);
+    }
     return paths.join('\n');
 }
+const FILE_CALL_RE = /\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes|readTextFile|file_get_contents|copyFile(?:Sync)?|copyfile|copy2?|Path|File\.read)\s*\(/g;
+function collectFileCallArguments(code, paths, budget) {
+    // Preserve offsets while masking string contents: a call printed inside a
+    // string is not an invocation; a sensitive path in another argument is data.
+    const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
+    for (const call of instructions.matchAll(FILE_CALL_RE)) {
+        if (++budget.calls > 48)
+            break;
+        const start = (call.index || 0) + call[0].length;
+        let depth = 1;
+        for (let end = start; end < instructions.length; end++) {
+            const ch = instructions[end];
+            if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
+                paths.push(code.slice(start, end));
+                break;
+            }
+            if (ch === '(')
+                depth++;
+        }
+    }
+}
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
@@ -1717,16 +1728,414 @@ function replaceQuotedSpans(src, fn) {
     }
     return out + src.slice(from);
 }
+// Stdin of these is executed as shell/SQL code; `done`/`fi`/`esac`/`}`/`)`
+// close a compound command whose body acts on what it reads (`while read c; do $c; done <<EOF`).
+const SHELL_STDIN_PROGRAMS = /^(?:sh|bash|zsh|dash|ksh|mksh|ash|csh|tcsh|fish|busybox|pwsh|powershell|cmd|ssh|wsl|chroot|su|eval|source|\.|xargs|parallel|at|batch|crontab|expect|tclsh|wish|osascript|script|psql|mysql|mariadb|sqlite3|sqlcmd|mongosh|mongo|redis-cli|cqlsh|clickhouse-client|duckdb|snowsql|done|fi|esac|\}|\))$/;
+const LANGUAGE_STDIN_PROGRAMS = /^(?:node|nodejs|deno|bun|python[0-9.]*|py|pypy[0-9.]*|perl|ruby|php|lua|luajit|tsx|ts-node|rscript|julia|groovy)$/;
+const CONTAINER_CLI_PROGRAMS = /^(?:docker|podman|nerdctl|kubectl|oc)$/;
+const RECEIVER_RANK = { data: 0, language: 1, shell: 2 };
+function programName(token) {
+    return token.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.(?:exe|cmd|bat)$/, '');
+}
+/** Words of one stage without assignments and redirections (`> f`, `2>&1`, `<<'EOF'`). */
+function stageWords(stage) {
+    const words = [];
+    const tokens = segmentTokens(stage.trim());
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (/^(?:\d*>{1,2}|&>{1,2}|<{1,3}-?|\d*<)$/.test(token)) {
+            i++;
+            continue;
+        }
+        if (/^(?:\d*>|&>|<)/.test(token))
+            continue;
+        if (!words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        words.push(token);
+    }
+    return words;
+}
+/** How one pipeline stage treats the bytes on its stdin. */
+function stdinReceiver(stage) {
+    const words = stageWords(stage);
+    for (let i = 0; i < words.length; i++) {
+        const program = programName(words[i]);
+        if (SHELL_STDIN_PROGRAMS.test(program))
+            return { kind: 'shell', program };
+        if (LANGUAGE_STDIN_PROGRAMS.test(program))
+            return { kind: 'language', program };
+        if (CONTAINER_CLI_PROGRAMS.test(program)) {
+            return words.slice(i + 1).some(word => /^(?:exec|run|attach|debug)$/i.test(word)) ? { kind: 'shell', program } : { kind: 'data', program };
+        }
+        if (AST_TRANSPARENT_WRAPPERS.has(program)) {
+            // `sudo -u root bash`, `env X=1 node`, `timeout 5 sh`: the reader is a later word, past the wrapper's own options.
+            let reader = { kind: 'data', program };
+            for (const word of words.slice(i + 1))
+                reader = strongerReceiver(reader, stdinReceiver(word));
+            return reader;
+        }
+        return { kind: 'data', program };
+    }
+    return { kind: 'data', program: '' };
+}
+function strongerReceiver(a, b) {
+    return RECEIVER_RANK[b.kind] > RECEIVER_RANK[a.kind] ? b : a;
+}
+/** Files the opener stage writes its stdin to (`cat > f`, `tee f`). */
+function stageWriteTargets(stage) {
+    const targets = redirectTargets(stage);
+    const words = stageWords(stage);
+    if (programName(words[0] || '') === 'tee')
+        targets.push(...words.slice(1).filter(word => !word.startsWith('-')));
+    return targets.map(target => programName(target)).filter(Boolean);
+}
+/** The strongest program among `statements` that runs one of `files` (`node x.js`, `bash x.sh`, `./x.sh`). */
+function laterRunnerOf(files, statements) {
+    let runner = { kind: 'data', program: '' };
+    if (!files.length)
+        return runner;
+    for (const stages of statements) {
+        for (const stage of stages) {
+            const words = stageWords(stage);
+            if (!words.some(word => files.includes(programName(word))))
+                continue;
+            const direct = files.includes(programName(words[0] || ''));
+            runner = strongerReceiver(runner, direct ? { kind: 'shell', program: programName(words[0]) } : stdinReceiver(stage));
+        }
+    }
+    return runner;
+}
+/**
+ * Every heredoc of a POSIX command line, with its exact body and its stages.
+ * `undefined` when the line does not lex (an unclosed quote or substitution):
+ * callers then keep every body as code.
+ */
+function lexHeredocs(text) {
+    const spans = [];
+    const pending = [];
+    const frame = (closer, stageStart) => ({ closer, quote: '', depth: 0, afterPipe: false, stageStart, stages: [], open: [] });
+    const stack = [frame('', 0)];
+    /** `i` at the first `(` of `((`: index of the closing `))` (arithmetic holds no heredoc; `<<` there is a shift). */
+    const arithmeticEnd = (i) => {
+        let depth = 0;
+        for (let k = i; k < text.length; k++) {
+            if (text[k] === '(')
+                depth++;
+            else if (text[k] === ')' && --depth === 0)
+                return k;
+        }
+        return -1;
+    };
+    const codeSlice = (from, to) => {
+        let out = '';
+        let at = from;
+        for (const span of spans) {
+            if (span.end <= at || span.bodyStart >= to)
+                continue;
+            out += text.slice(at, Math.max(at, span.bodyStart));
+            at = Math.max(at, span.end);
+        }
+        return out + text.slice(at, Math.max(at, to));
+    };
+    const endStage = (ctx, at) => { ctx.stages.push(codeSlice(ctx.stageStart, at)); ctx.stageStart = at + 1; };
+    const endStatement = (ctx, at) => {
+        endStage(ctx, at);
+        for (const { span, stage } of ctx.open)
+            span.stages = ctx.stages.slice(stage);
+        ctx.stages = [];
+        ctx.open = [];
+    };
+    const readBodies = (newline) => {
+        let pos = newline + 1;
+        for (const { span, delimiter, stripTabs } of pending.splice(0)) {
+            span.bodyStart = pos;
+            span.bodyEnd = span.end = text.length;
+            while (pos < text.length) {
+                const lineEnd = text.indexOf('\n', pos);
+                const stop = lineEnd < 0 ? text.length : lineEnd;
+                let line = text.slice(pos, stop).replace(/\r$/, '');
+                if (stripTabs)
+                    line = line.replace(/^\t+/, '');
+                if (line === delimiter) {
+                    span.bodyEnd = pos;
+                    span.end = stop;
+                    pos = stop + 1;
+                    break;
+                }
+                pos = stop + 1;
+            }
+            span.body = text.slice(span.bodyStart, span.bodyEnd < text.length ? Math.max(span.bodyStart, span.bodyEnd - 1) : text.length);
+            spans.push(span);
+        }
+        return pos;
+    };
+    for (let i = 0; i < text.length; i++) {
+        const ctx = stack[stack.length - 1];
+        const c = text[i];
+        const next = text[i + 1];
+        if (ctx.quote === "'") {
+            if (c === "'")
+                ctx.quote = '';
+            continue;
+        }
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (ctx.quote === '"') {
+            if (c === '"')
+                ctx.quote = '';
+            else if (c === '$' && next === '(' && text[i + 2] === '(') {
+                const e = arithmeticEnd(i + 1);
+                if (e < 0)
+                    return undefined;
+                i = e;
+            }
+            else if (c === '$' && next === '(') {
+                stack.push(frame(')', i + 2));
+                i++;
+            }
+            else if (c === '`')
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c !== '|' && c !== '\n' && !/\s/.test(c))
+            ctx.afterPipe = false;
+        if (c === '#' && (i === 0 || /[\s;&|(]/.test(text[i - 1]))) {
+            const nl = text.indexOf('\n', i);
+            i = (nl < 0 ? text.length : nl) - 1;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            ctx.quote = c;
+            continue;
+        }
+        if ((c === '$' && next === '(' && text[i + 2] === '(') || (c === '(' && next === '(')) {
+            const e = arithmeticEnd(c === '$' ? i + 1 : i);
+            if (e < 0)
+                return undefined;
+            i = e;
+            continue;
+        }
+        if (c === '$' && next === '(') {
+            stack.push(frame(')', i + 2));
+            i++;
+            continue;
+        }
+        if (c === '`') {
+            if (ctx.closer === '`') {
+                endStatement(ctx, i);
+                stack.pop();
+            }
+            else
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c === '(') {
+            endStatement(ctx, i);
+            ctx.depth++;
+            continue;
+        }
+        if (c === ')') {
+            endStatement(ctx, i);
+            if (ctx.depth > 0)
+                ctx.depth--;
+            else if (ctx.closer === ')' && stack.length > 1)
+                stack.pop();
+            continue;
+        }
+        if (c === '{' && (next === undefined || /\s/.test(next))) {
+            endStatement(ctx, i);
+            continue;
+        }
+        if (c === ';' || (c === '&' && next !== '>' && text[i - 1] !== '>' && text[i - 1] !== '<')) {
+            endStatement(ctx, i);
+            if ((c === '&' && next === '&') || (c === ';' && next === ';'))
+                i++;
+            continue;
+        }
+        if (c === '|') {
+            if (next === '|') {
+                endStatement(ctx, i);
+                i++;
+            }
+            else {
+                endStage(ctx, i);
+                ctx.afterPipe = true;
+                if (next === '&')
+                    i++;
+            }
+            continue;
+        }
+        if (c === '\n') {
+            // `cat <<'EOF' |` continues the pipeline on the line after the body.
+            if (!ctx.afterPipe)
+                endStatement(ctx, i);
+            if (pending.length) {
+                const after = readBodies(i);
+                if (ctx.stageStart <= after)
+                    ctx.stageStart = after;
+                i = after - 1;
+            }
+            continue;
+        }
+        if (c === '<' && next === '<' && text[i - 1] !== '<') {
+            if (text[i + 2] === '<') {
+                i += 2;
+                continue;
+            } // `<<<` here-string: quoted-span pass
+            let j = i + 2;
+            const stripTabs = text[j] === '-';
+            if (stripTabs)
+                j++;
+            while (text[j] === ' ' || text[j] === '\t')
+                j++;
+            let delimiter = '';
+            let literal = false;
+            while (j < text.length && !/[\s;&|<>()]/.test(text[j])) {
+                const q = text[j];
+                if (q === "'" || q === '"') {
+                    const close = text.indexOf(q, j + 1);
+                    if (close < 0)
+                        return undefined;
+                    delimiter += text.slice(j + 1, close);
+                    literal = true;
+                    j = close + 1;
+                }
+                else if (q === '\\') {
+                    delimiter += text[j + 1] || '';
+                    literal = true;
+                    j += 2;
+                }
+                else {
+                    delimiter += q;
+                    j++;
+                }
+            }
+            if (!delimiter) {
+                i = j - 1;
+                continue;
+            }
+            const span = { bodyStart: text.length, bodyEnd: text.length, end: text.length, body: '', literal, stages: [] };
+            pending.push({ span, delimiter, stripTabs });
+            ctx.open.push({ span, stage: ctx.stages.length });
+            i = j - 1;
+            continue;
+        }
+    }
+    if (stack.length > 1 || stack[0].quote)
+        return undefined;
+    if (pending.length)
+        readBodies(text.length - 1);
+    endStatement(stack[0], text.length);
+    return spans;
+}
+/** Heredocs of a POSIX line, each with the receiver that decides what its body is. */
+function heredocView(text) {
+    if (!text.includes('<<') || text.length > 256_000)
+        return undefined;
+    const spans = lexHeredocs(text);
+    if (!spans || !spans.length)
+        return undefined;
+    let skeleton = '';
+    let at = 0;
+    for (const span of spans) {
+        skeleton += text.slice(at, span.bodyStart);
+        at = span.end;
+    }
+    skeleton += text.slice(at);
+    const statements = splitUnquotedPipelines(skeleton);
+    const heredocs = spans.map(span => {
+        let receiver = { kind: 'data', program: '' };
+        for (const stage of span.stages)
+            receiver = strongerReceiver(receiver, stdinReceiver(stage));
+        receiver = strongerReceiver(receiver, laterRunnerOf(stageWriteTargets(span.stages[0] || ''), statements));
+        return { ...span, receiver };
+    });
+    return { heredocs, skeleton };
+}
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+function posixHeredocs(text) {
+    return (heredocView(text)?.heredocs || []).map(({ bodyStart, bodyEnd, end, body, receiver }) => ({ bodyStart, bodyEnd, end, body, receiver }));
+}
+/** Does this heredoc body run as code where it lands? */
+function heredocBodyActs(heredoc) {
+    // Unquoted delimiter: `$( … )` / backticks in the body run before any receiver sees it.
+    if (!heredoc.literal && INTERPOLATES.test(heredoc.body))
+        return true;
+    if (heredoc.receiver.kind === 'shell')
+        return true;
+    if (heredoc.receiver.kind === 'language') {
+        return CODE_SPAWNS_PROCESS.test(heredoc.body)
+            || (/^(?:perl|ruby)$/.test(heredoc.receiver.program) && /`[^`]*`|%x[\[{(]/.test(heredoc.body))
+            || interpreterCodeRequestsMetadata(heredoc.body);
+    }
+    return false;
+}
+/**
+ * Each body becomes `inert` when it is data, or `acting(index)` when it runs
+ * (left as is without `acting`). Delimiter lines stay, so the result still
+ * lexes. Returns the bodies that run so a caller can put them back verbatim.
+ */
+function replaceHeredocBodies(text, view, inert, acting) {
+    let out = '';
+    let at = 0;
+    const kept = [];
+    for (const heredoc of view.heredocs) {
+        const acts = heredocBodyActs(heredoc);
+        if (acts && !acting)
+            continue;
+        out += text.slice(at, heredoc.bodyStart) + (acts ? acting(kept.push(heredoc.body) - 1) : inert);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return { text: out + text.slice(at), acting: kept };
+}
+/** The line as a bash parser sees it: bodies that RUN are opaque text there, so blank them. */
+function withoutActingHeredocBodies(text) {
+    const view = heredocView(text);
+    if (!view)
+        return text;
+    let out = '';
+    let at = 0;
+    for (const heredoc of view.heredocs) {
+        if (!heredocBodyActs(heredoc))
+            continue;
+        out += text.slice(at, heredoc.bodyStart);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return out + text.slice(at);
+}
+const ACTING_BODY_MARK = (index) => `fcd_acting_heredoc_${index}_`;
+/** Receiver of a `<<<` here-string whose quoted word starts at `offset`. */
+function hereStringReceiver(src, offset) {
+    const head = src.slice(src.lastIndexOf('\n', offset - 1) + 1, offset).replace(/<<<\s*$/, '');
+    const statements = splitUnquotedPipelines(head);
+    const stages = statements[statements.length - 1] || [];
+    return stdinReceiver(stages[stages.length - 1] || '');
+}
 function stripInertDataSegments(text) {
-    if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
+    const heredocs = heredocView(text);
+    // A data body (`cat > notes.md <<'EOF' … ssh … EOF`) cannot make the line an
+    // interpreter feed; only the code around it, and bodies that run, can.
+    const executable = heredocs ? replaceHeredocBodies(text, heredocs, '').text : text;
+    if (DATA_TO_INTERPRETER.test(unquotedCode(executable)))
         return text;
+    // A body that runs is code line for line: park it so the quoted-span pass
+    // below cannot read `os.system('rm -rf ~')` as prose, then put it back.
+    const parked = heredocs ? replaceHeredocBodies(text, heredocs, INERT_DATA, ACTING_BODY_MARK) : { text, acting: [] };
+    let out = stripQuotedData(parked.text);
+    parked.acting.forEach((body, index) => {
+        const mark = ACTING_BODY_MARK(index);
+        out = out.includes(mark) ? out.replace(mark, () => body) : `${out}\n${body}`;
+    });
+    return out;
+}
+/** Here-strings and quoted prose of a line whose heredoc bodies are already resolved. */
+function stripQuotedData(text) {
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
     out = replaceDelimited(out, "@'", "'@", () => INERT_DATA);
     out = replaceDelimited(out, '@"', '"@', m => (m.includes('$(') ? m : INERT_DATA));
-    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
-    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
-    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
@@ -1736,6 +2145,14 @@ function stripInertDataSegments(text) {
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
         const before = src.slice(Math.max(0, offset - 80), offset);
+        // `bash <<< "…"` feeds the quoted word to stdin: it is what its reader makes of it.
+        if (/<<<\s*$/.test(before)) {
+            const receiver = hereStringReceiver(src, offset);
+            if (receiver.kind === 'shell')
+                return whole;
+            if (receiver.kind === 'language')
+                return CODE_SPAWNS_PROCESS.test(body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
+        }
         // Language-interpreter code: data unless it spawns a process (see above).
         if (LANG_INTERPRETER_CODE_BEFORE.test(before))
             return interpreterCodeSpawnsProcess(before, body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.36.3"
+  "version": "1.36.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.36.3",
+  "version": "1.36.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {