fullcourtdefense-cli 1.36.3 → 1.37.0

package/dist/actionPolicyEngine.d.ts

@@ -309,6 +309,25 @@ export declare function inferToolContext(toolName: string, args: Record<string,
     operation: string;
     context: Record<string, string>;
 };
+/**
+ * What kind of site a destination host is, for the few kinds that change how an
+ * upload should be read. A curated list, not a reputation feed: a host is in it
+ * only when its PURPOSE is the category (a paste site exists to publish text; a
+ * request catcher exists to capture whatever is sent to it). Deliberately absent:
+ * general cloud storage, code hosting and gists, which are everyday developer
+ * destinations and would turn the category into noise.
+ */
+export type DestinationCategory = 'paste' | 'file_drop' | 'request_capture' | 'tunnel' | 'messaging' | 'news';
+export declare const DESTINATION_CATEGORY_HOSTS: Readonly<Record<DestinationCategory, readonly string[]>>;
+/** Categories whose purpose is to receive data from strangers: a first upload there is high risk. */
+export declare const HIGH_RISK_DESTINATION_CATEGORIES: ReadonlySet<DestinationCategory>;
+/** The listed host itself or any subdomain of it (`www.pastebin.com`, `x.m.pipedream.net`); never a look-alike (`notpastebin.com`). */
+export declare function destinationCategory(host: string | undefined | null): DestinationCategory | undefined;
+/** A host's category and whether that category exists to receive data from anyone — the shape the anomaly scorer takes. */
+export declare function classifyDestinationHost(host: string): {
+    category: DestinationCategory;
+    dataDrop: boolean;
+} | undefined;
 /** Exported for reproducible detector artifacts; policy decisions are not packaged. */
 export declare function inferBundledToolContext(toolName: string, args: Record<string, any>): {
     operation: string;

package/dist/actionPolicyEngine.js

@@ -24,14 +24,18 @@ __export(actionPolicyEngine_exports, {
   ACTION_POLICY_GRANT_MAX_USES: () => ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS: () => CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL: () => DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS: () => DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE: () => GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE: () => GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE: () => GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES: () => HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS: () => MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL: () => WORKSTATION_ASK_APPROVAL,
   approvalExceptionError: () => approvalExceptionError,
   canonicalAgentClient: () => canonicalAgentClient,
+  classifyDestinationHost: () => classifyDestinationHost,
   deriveToolOperations: () => deriveToolOperations,
+  destinationCategory: () => destinationCategory,
   detectSecretKind: () => detectSecretKind,
   effectiveApprovalScope: () => effectiveApprovalScope,
   evaluateActionPolicies: () => evaluateActionPolicies,
@@ -6888,6 +6892,7 @@ var OPERATION_MATCH_SKIP_FIELDS = /* @__PURE__ */ new Set([
   "destination.host",
   "destination.type",
   "destination.repository",
+  "destination.category",
   "destinationHost",
   "host",
   "hostname",
@@ -8767,8 +8772,145 @@ function inferToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
+var DESTINATION_CATEGORY_HOSTS = {
+  paste: [
+    "pastebin.com",
+    "paste.ee",
+    "hastebin.com",
+    "rentry.co",
+    "rentry.org",
+    "dpaste.org",
+    "dpaste.com",
+    "paste.rs",
+    "termbin.com",
+    "controlc.com",
+    "justpaste.it",
+    "privatebin.net",
+    "ix.io",
+    "sprunge.us",
+    "pastes.io",
+    "paste.mozilla.org"
+  ],
+  file_drop: [
+    "transfer.sh",
+    "file.io",
+    "0x0.st",
+    "temp.sh",
+    "bashupload.com",
+    "gofile.io",
+    "catbox.moe",
+    "uguu.se",
+    "tmpfiles.org",
+    "filebin.net",
+    "wetransfer.com",
+    "we.tl",
+    "sendspace.com",
+    "mediafire.com",
+    "mega.nz",
+    "anonfiles.com",
+    "oshi.at",
+    "pixeldrain.com",
+    "ufile.io",
+    "keep.sh",
+    "filetransfer.io"
+  ],
+  request_capture: [
+    "webhook.site",
+    "pipedream.net",
+    "beeceptor.com",
+    "hookbin.com",
+    "requestcatcher.com",
+    "interact.sh",
+    "oast.fun",
+    "oast.pro",
+    "oast.live",
+    "oast.site",
+    "oast.online",
+    "oast.me",
+    "oastify.com",
+    "burpcollaborator.net",
+    "dnslog.cn",
+    "ceye.io"
+  ],
+  tunnel: [
+    "ngrok.io",
+    "ngrok.app",
+    "ngrok.dev",
+    "ngrok-free.app",
+    "ngrok-free.dev",
+    "trycloudflare.com",
+    "loca.lt",
+    "localtunnel.me",
+    "serveo.net",
+    "localhost.run",
+    "lhr.life",
+    "pinggy.io",
+    "pinggy.link",
+    "bore.pub"
+  ],
+  messaging: ["discord.com", "discordapp.com", "api.telegram.org", "hooks.slack.com"],
+  news: [
+    "ynet.co.il",
+    "ynetnews.com",
+    "walla.co.il",
+    "mako.co.il",
+    "n12.co.il",
+    "haaretz.co.il",
+    "haaretz.com",
+    "themarker.com",
+    "maariv.co.il",
+    "globes.co.il",
+    "calcalist.co.il",
+    "israelhayom.co.il",
+    "kan.org.il",
+    "timesofisrael.com",
+    "jpost.com",
+    "i24news.tv",
+    "bbc.com",
+    "bbc.co.uk",
+    "cnn.com",
+    "nytimes.com",
+    "reuters.com",
+    "apnews.com",
+    "theguardian.com",
+    "washingtonpost.com",
+    "wsj.com",
+    "bloomberg.com",
+    "ft.com",
+    "foxnews.com",
+    "nbcnews.com",
+    "cbsnews.com",
+    "npr.org",
+    "aljazeera.com"
+  ]
+};
+var HIGH_RISK_DESTINATION_CATEGORIES = /* @__PURE__ */ new Set(["paste", "file_drop", "request_capture", "tunnel"]);
+var DESTINATION_CATEGORY_BY_HOST = new Map(
+  Object.entries(DESTINATION_CATEGORY_HOSTS).flatMap(([category, hosts]) => hosts.map((host) => [host, category]))
+);
+function destinationCategory(host) {
+  let candidate = String(host || "").trim().toLowerCase().replace(/\.$/, "");
+  while (candidate) {
+    const category = DESTINATION_CATEGORY_BY_HOST.get(candidate);
+    if (category) return category;
+    const dot = candidate.indexOf(".");
+    if (dot < 0) return void 0;
+    candidate = candidate.slice(dot + 1);
+  }
+  return void 0;
+}
+function classifyDestinationHost(host) {
+  const category = destinationCategory(host);
+  return category ? { category, dataDrop: HIGH_RISK_DESTINATION_CATEGORIES.has(category) } : void 0;
+}
+function applyDestinationCategoryFact(context) {
+  delete context["destination.category"];
+  const category = destinationCategory(context["destination.domain"]);
+  if (category) context["destination.category"] = category;
+}
 function applyRemoteControlFact(toolName, args, context) {
   delete context["toolArgs.remoteControl"];
   const shellText = remoteControlProvider ? shellCommandTextOf(toolName, args) : void 0;
@@ -8920,6 +9062,7 @@ function inferBundledToolContext(toolName, args) {
   }
   applyRemoteControlFact(toolName, args, context);
   applyWebReadFacts(toolName, args, context);
+  applyDestinationCategoryFact(context);
   return { operation, context };
 }
 var RESERVED_INPUT_FACTS = /* @__PURE__ */ new Set([
@@ -9021,14 +9164,18 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   ACTION_POLICY_GRANT_MAX_USES,
   CONTENT_FACT_FIELDS,
   DEFAULT_ACTION_POLICY_APPROVAL,
+  DESTINATION_CATEGORY_HOSTS,
   GCLOUD_DELETE_VERB_RE,
   GCLOUD_READ_VERB_RE,
   GCLOUD_WRITE_VERB_RE,
+  HIGH_RISK_DESTINATION_CATEGORIES,
   MACHINE_KINDS,
   WORKSTATION_ASK_APPROVAL,
   approvalExceptionError,
   canonicalAgentClient,
+  classifyDestinationHost,
   deriveToolOperations,
+  destinationCategory,
   detectSecretKind,
   effectiveApprovalScope,
   evaluateActionPolicies,

package/dist/askDialog.d.ts

@@ -96,6 +96,7 @@ export declare function resolveAskWithDialog(verdict: HookVerdict, options?: {
     clientLabel?: string;
     timeoutMs?: number;
     dialog?: DialogFn;
+    deadlineAt?: number;
 }): Promise<HookVerdict & {
     resolution?: AskResolution;
     envelope?: AskEnvelope;

package/dist/askDialog.js

@@ -36,6 +36,8 @@ const callerEnv_1 = require("./callerEnv");
 exports.ASK_ENVELOPE_FIELD = 'fcdAsk';
 /** Default wait for the person. Cursor's hook window is 90 s, Claude's 60 s by default; stay inside both. */
 exports.ASK_DIALOG_TIMEOUT_MS = 55_000;
+/** Less time than this before the IDE's cutoff is not enough to read and answer a dialog. */
+const MIN_DIALOG_TIMEOUT_MS = 5_000;
 /** Which channel asks the developer. `dialog` (default) = our OS dialog, `ide` = the IDE's own card. */
 function askChannel() {
     return ((0, callerEnv_1.callerEnv)().FCD_ASK_CHANNEL || '').trim().toLowerCase() === 'ide' ? 'ide' : 'dialog';
@@ -97,9 +99,20 @@ function rewriteDecision(decision, allowed, userMsg, agentMsg) {
  * written as-is with the envelope removed. Then the process exits.
  */
 async function emitVerdictForIde(args, result, entry) {
+    // This process ends with the verdict below: an upload the dialog's outcome
+    // asks for (allow, decline, timeout) starts after stdout, at exit — never
+    // while the IDE still waits for the answer.
+    try {
+        (0, telemetry_1.deferFlushUntilExit)();
+    }
+    catch { /* best-effort */ }
     let final = result;
     try {
-        const resolved = await resolveAskWithDialog(result, { clientLabel: args.agentClient });
+        // This is the per-event process the IDE started: its clock started with
+        // the process, so the dialog must end before the IDE's hook timeout does
+        // (a killed hook runs the action without anyone's answer).
+        const processStartedAt = Date.now() - Math.round(process.uptime() * 1000);
+        const resolved = await resolveAskWithDialog(result, { clientLabel: args.agentClient, deadlineAt: (0, callerEnv_1.ideWaitCutoff)(processStartedAt) });
         if (resolved.resolution)
             (0, hookIo_1.dbg)({ phase: 'ask_dialog', event: args.event, entry, resolution: resolved.resolution, tool: resolved.envelope?.toolName });
         final = resolved;
@@ -137,7 +150,11 @@ async function resolveAskWithDialog(verdict, options = {}) {
     const clean = { ...verdict, stdout: taken.stdout, envelope };
     // An injected dialog (tests, embedding hosts) only needs a person; the OS dialog also needs a display.
     const canAsk = options.dialog ? (0, devConfirm_1.isHumanPresent)() : (0, devConfirm_1.nativeDialogAvailable)();
-    if (askChannel() === 'ide' || !canAsk)
+    // Wait = min(configured, time left before the IDE's cutoff). Too little time
+    // left for a person to read and answer: the IDE's own ask card takes the
+    // question instead, so the hook still answers inside the IDE's window.
+    const dialogTimeoutMs = Math.min(options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, options.deadlineAt === undefined ? Number.POSITIVE_INFINITY : options.deadlineAt - Date.now());
+    if (askChannel() === 'ide' || !canAsk || dialogTimeoutMs < MIN_DIALOG_TIMEOUT_MS)
         return { ...clean, resolution: 'ide' };
     const grantHash = envelope.ruleHash || envelope.policyHash;
     const grantLimits = envelope.grantLimits === null ? undefined : (envelope.grantLimits || { ttlMs: devConfirm_1.GRANT_TTL_MS });
@@ -163,7 +180,7 @@ async function resolveAskWithDialog(verdict, options = {}) {
     let outcome = 'unavailable';
     let latencyMs = 0;
     try {
-        ({ outcome, latencyMs } = await dialog(reason, options.timeoutMs ?? exports.ASK_DIALOG_TIMEOUT_MS, { allowAlways, alwaysScopeLabel: scopeLabel, alwaysLimitsLabel: limitsLabel, alwaysCovers, alwaysNotOffered, subject }));
+        ({ outcome, latencyMs } = await dialog(reason, dialogTimeoutMs, { allowAlways, alwaysScopeLabel: scopeLabel, alwaysLimitsLabel: limitsLabel, alwaysCovers, alwaysNotOffered, subject }));
     }
     catch {
         outcome = 'unavailable';

package/dist/callerEnv.d.ts

@@ -11,10 +11,23 @@
  *
  * Node built-ins only: this leaf is on the slim hook's warm-path module graph.
  */
-export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
+export declare const CALLER_ENV_KEYS: readonly ["FCD_HUMAN_PRESENT", "FCD_EPHEMERAL", "FULLCOURTDEFENSE_EPHEMERAL", "CI", "GITHUB_ACTIONS", "GITLAB_CI", "TF_BUILD", "JENKINS_URL", "BUILDKITE", "CIRCLECI", "DISPLAY", "WAYLAND_DISPLAY", "FCD_ASK_CHANNEL", "FCD_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CODEX_THREAD_ID", "FCD_RUN_ID", "GITHUB_RUN_ID", "CI_PIPELINE_ID", "FCD_WORKLOAD_INSTANCE_ID", "CLAUDECODE", "CLAUDE_PROJECT_DIR", "VSCODE_PID", "TERM_PROGRAM", "WORKSPACE_PATH", "FCD_HOOK_IDE_TIMEOUT_MS", "FCD_TAINT_APPROVE_ONCE_DISABLED", "FCD_TAINT_APPROVAL_TIMEOUT_MS", "FCD_HOOK_DEBUG", "CLOUDSDK_CORE_PROJECT", "CLOUDSDK_ACTIVE_CONFIG_NAME", "CLOUDSDK_CONFIG", "APPDATA", "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_CONFIG_FILE", "AWS_SHARED_CREDENTIALS_FILE", "AWS_ACCESS_KEY_ID", "KUBECONFIG", "HELM_KUBECONTEXT", "HELM_NAMESPACE", "HELM_KUBEAPISERVER", "HELM_KUBETOKEN", "HELM_KUBEASUSER", "DOCKER_HOST", "DOCKER_CONTEXT", "AZURE_CONFIG_DIR", "AZURE_DEFAULTS_GROUP", "TF_WORKSPACE", "TF_DATA_DIR", "PGHOST", "PGDATABASE", "PGSERVICE", "MYSQL_HOST"];
 export type CallerEnvSnapshot = Partial<Record<(typeof CALLER_ENV_KEYS)[number], string>>;
+/**
+ * Keys a decision reads only for WHETHER they are set (cloudGrantTools: static
+ * AWS keys beat every profile; a helm API server / token / impersonation makes
+ * the target unknown) — and some are credentials (HELM_KUBETOKEN is a bearer
+ * token). A snapshot that is written to disk keeps only that they are set.
+ */
+export declare const PRESENCE_ONLY_CALLER_ENV_KEYS: readonly (typeof CALLER_ENV_KEYS)[number][];
 /** The keys above that are set in `env` — what the thin client sends. */
 export declare function snapshotCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
+/**
+ * snapshotCallerEnv for a snapshot that is STORED (the monitor fast path's
+ * local queue): the same decision facts, without credential values — a
+ * presence-only key keeps '1' when set (non-blank), '' when blank.
+ */
+export declare function storableCallerEnv(env?: NodeJS.ProcessEnv): CallerEnvSnapshot;
 /** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
 export declare function callerEnv(): NodeJS.ProcessEnv;
 /**
@@ -26,11 +39,25 @@ export declare function withCallerEnv<T>(snapshot: unknown, fn: () => T): T;
 /**
  * How long the IDE lets an approval-capable hook run before it kills the hook
  * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
- * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it — per hook entry (applyIdeTimeoutArg) and
+ * for drills.
  */
 export declare const IDE_HOOK_TIMEOUT_MS = 90000;
 export declare const IDE_TIMEOUT_MARGIN_MS = 15000;
 export declare function ideHookTimeoutMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * The installer writes each hook entry's real IDE timeout into its command
+ * (`--ide-timeout <seconds>`, the same number as the entry's `timeout`): Claude
+ * Code PostToolUse 10s, UserPromptSubmit 30s, PreToolUse 90s; Cursor per event.
+ * A hook the IDE kills runs the action, so every wait must end before THAT
+ * timeout, not before a fixed 90s. Applied, in the hook's own process only, as
+ * its FCD_HOOK_IDE_TIMEOUT_MS — a caller-env key, so the daemon evaluating the
+ * call applies it too (older daemons already honour it). It only ever narrows
+ * the 90s default: an entry configured longer keeps today's waits. An explicit
+ * FCD_HOOK_IDE_TIMEOUT_MS (drills) wins; a command line without the argument
+ * (older installs) keeps the default.
+ */
+export declare function applyIdeTimeoutArg(seconds: string | undefined, env?: NodeJS.ProcessEnv): void;
 /** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
 export declare function ideWaitCutoff(startedAt: number, ideTimeoutMs?: number): number;
 /** CI / pipeline environments — no human at a keyboard. Shared by hooks and discovery. */

package/dist/callerEnv.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDE_TIMEOUT_MARGIN_MS = exports.IDE_HOOK_TIMEOUT_MS = exports.CALLER_ENV_KEYS = void 0;
+exports.IDE_TIMEOUT_MARGIN_MS = exports.IDE_HOOK_TIMEOUT_MS = exports.PRESENCE_ONLY_CALLER_ENV_KEYS = exports.CALLER_ENV_KEYS = void 0;
 exports.snapshotCallerEnv = snapshotCallerEnv;
+exports.storableCallerEnv = storableCallerEnv;
 exports.callerEnv = callerEnv;
 exports.withCallerEnv = withCallerEnv;
 exports.ideHookTimeoutMs = ideHookTimeoutMs;
+exports.applyIdeTimeoutArg = applyIdeTimeoutArg;
 exports.ideWaitCutoff = ideWaitCutoff;
 exports.isCiEnvironment = isCiEnvironment;
 exports.isHumanPresent = isHumanPresent;
@@ -34,6 +36,8 @@ exports.CALLER_ENV_KEYS = [
     'CLAUDECODE', 'CLAUDE_PROJECT_DIR', 'VSCODE_PID', 'TERM_PROGRAM', 'WORKSPACE_PATH',
     // Human-wait budget and approve-once switches.
     'FCD_HOOK_IDE_TIMEOUT_MS', 'FCD_TAINT_APPROVE_ONCE_DISABLED', 'FCD_TAINT_APPROVAL_TIMEOUT_MS',
+    // Support diagnostics: per-phase hook.log lines for this caller's verdicts (never a decision fact).
+    'FCD_HOOK_DEBUG',
     // Which GCP project a gcloud line targets when it names none (cloudGrant.activeGcloudProject).
     'CLOUDSDK_CORE_PROJECT', 'CLOUDSDK_ACTIVE_CONFIG_NAME', 'CLOUDSDK_CONFIG', 'APPDATA',
     // Which aws profile / region and which kube context an aws / kubectl / helm line targets
@@ -49,6 +53,15 @@ exports.CALLER_ENV_KEYS = [
     // Which database host / name a psql / mysql line falls back to (cloudGrantTools).
     'PGHOST', 'PGDATABASE', 'PGSERVICE', 'MYSQL_HOST',
 ];
+/**
+ * Keys a decision reads only for WHETHER they are set (cloudGrantTools: static
+ * AWS keys beat every profile; a helm API server / token / impersonation makes
+ * the target unknown) — and some are credentials (HELM_KUBETOKEN is a bearer
+ * token). A snapshot that is written to disk keeps only that they are set.
+ */
+exports.PRESENCE_ONLY_CALLER_ENV_KEYS = [
+    'AWS_ACCESS_KEY_ID', 'HELM_KUBEAPISERVER', 'HELM_KUBETOKEN', 'HELM_KUBEASUSER',
+];
 /** The keys above that are set in `env` — what the thin client sends. */
 function snapshotCallerEnv(env = process.env) {
     const snapshot = {};
@@ -59,6 +72,20 @@ function snapshotCallerEnv(env = process.env) {
     }
     return snapshot;
 }
+/**
+ * snapshotCallerEnv for a snapshot that is STORED (the monitor fast path's
+ * local queue): the same decision facts, without credential values — a
+ * presence-only key keeps '1' when set (non-blank), '' when blank.
+ */
+function storableCallerEnv(env = process.env) {
+    const snapshot = snapshotCallerEnv(env);
+    for (const key of exports.PRESENCE_ONLY_CALLER_ENV_KEYS) {
+        const value = snapshot[key];
+        if (typeof value === 'string')
+            snapshot[key] = value.trim() ? '1' : '';
+    }
+    return snapshot;
+}
 const requestEnv = new async_hooks_1.AsyncLocalStorage();
 /** The environment decision facts are read from: the requesting caller's inside a daemon request, else this process's. */
 function callerEnv() {
@@ -85,7 +112,8 @@ function withCallerEnv(snapshot, fn) {
 /**
  * How long the IDE lets an approval-capable hook run before it kills the hook
  * (and runs the action): Claude Code / Copilot / VS Code and Cursor: 90s.
- * FCD_HOOK_IDE_TIMEOUT_MS narrows it for drills.
+ * FCD_HOOK_IDE_TIMEOUT_MS narrows it — per hook entry (applyIdeTimeoutArg) and
+ * for drills.
  */
 exports.IDE_HOOK_TIMEOUT_MS = 90_000;
 exports.IDE_TIMEOUT_MARGIN_MS = 15_000;
@@ -93,6 +121,24 @@ function ideHookTimeoutMs(env = callerEnv()) {
     const override = Number(env.FCD_HOOK_IDE_TIMEOUT_MS);
     return override > 0 ? override : exports.IDE_HOOK_TIMEOUT_MS;
 }
+/**
+ * The installer writes each hook entry's real IDE timeout into its command
+ * (`--ide-timeout <seconds>`, the same number as the entry's `timeout`): Claude
+ * Code PostToolUse 10s, UserPromptSubmit 30s, PreToolUse 90s; Cursor per event.
+ * A hook the IDE kills runs the action, so every wait must end before THAT
+ * timeout, not before a fixed 90s. Applied, in the hook's own process only, as
+ * its FCD_HOOK_IDE_TIMEOUT_MS — a caller-env key, so the daemon evaluating the
+ * call applies it too (older daemons already honour it). It only ever narrows
+ * the 90s default: an entry configured longer keeps today's waits. An explicit
+ * FCD_HOOK_IDE_TIMEOUT_MS (drills) wins; a command line without the argument
+ * (older installs) keeps the default.
+ */
+function applyIdeTimeoutArg(seconds, env = process.env) {
+    const ms = Math.round(Number(seconds) * 1000);
+    if (!Number.isFinite(ms) || ms <= 0 || Number(env.FCD_HOOK_IDE_TIMEOUT_MS) > 0)
+        return;
+    env.FCD_HOOK_IDE_TIMEOUT_MS = String(Math.min(ms, exports.IDE_HOOK_TIMEOUT_MS));
+}
 /** Absolute time every wait inside a hook must end by, leaving the margin before the IDE's timeout. */
 function ideWaitCutoff(startedAt, ideTimeoutMs = ideHookTimeoutMs()) {
     return startedAt + ideTimeoutMs - Math.min(exports.IDE_TIMEOUT_MARGIN_MS, ideTimeoutMs / 4);

package/dist/commandNarrative.js

@@ -21,6 +21,7 @@ exports.tokenDestinations = tokenDestinations;
 exports.capturedValueDestinations = capturedValueDestinations;
 exports.describeShellCommand = describeShellCommand;
 exports.describeShellCommandLines = describeShellCommandLines;
+const deterministicGuard_1 = require("./commands/deterministicGuard");
 const MAX_STEPS = 14;
 const MAX_LINE = 220;
 /** Token printers whose output can be assigned; `issuer` = who accepts the token (identity tokens go to their audience). */
@@ -643,7 +644,7 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'python3':
         case 'tsx':
         case 'ts-node':
-            return step(`Runs ${program} ${rest[1] ? `(${shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
+            return step(`Runs ${program} ${rest[1] ? `(${/[\\/]/.test(rest[1]) && !rest[1].startsWith('-') ? [shortPath(rest[1]), ...rest.slice(2)].join(' ').slice(0, 80) : shortValue(rest.slice(1).join(' '), 60)})` : ''}`, false);
         case 'curl':
         case 'wget':
         case 'invoke-webrequest':
@@ -678,7 +679,10 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'mkdir':
         case 'new-item':
         case 'ni':
-        case 'touch': return step(`Creates ${shortValue(rest.slice(1).filter(t => !t.startsWith('-')).join(', '), 60)}`);
+        case 'touch': {
+            const made = rest.slice(1).filter(t => !t.startsWith('-'));
+            return step(`Creates ${made.length === 1 ? shortPath(made[0]) : shortValue(made.join(', '), 60)}`);
+        }
         case 'cat':
         case 'get-content':
         case 'gc':
@@ -686,8 +690,22 @@ function describeOne(segmentIn, captured, fns = new Map()) {
         case 'head':
         case 'tail':
         case 'less':
-        case 'more':
-            return step(`Reads the file ${shortValue(rest.slice(1).filter(t => !t.startsWith('-'))[0] || '', 60)}${redirectNote}`);
+        case 'more': {
+            // `cat > f` / `cat 2>/dev/null f`: redirections and their targets are not files read.
+            const operands = [];
+            for (let k = 1; k < rest.length; k++) {
+                if (/^(?:\d*>{1,2}|&>|<)$/.test(rest[k])) {
+                    k++;
+                    continue;
+                }
+                if (/^(?:\d*>|&>|<)/.test(rest[k]) || rest[k].startsWith('-'))
+                    continue;
+                operands.push(rest[k]);
+            }
+            if (!operands.length && redirectTo)
+                return step(`Writes its input to ${shortValue(redirectTo, 60)}`);
+            return step(`Reads the file ${shortValue(operands[0] || '', 60)}${redirectNote}`);
+        }
         case 'ls':
         case 'dir':
         case 'get-childitem':
@@ -948,13 +966,75 @@ function noteTokenDestinations(steps) {
         return { ...step, text: shortValue(`${step.text}, then sends it to ${described.join('; ')}`, MAX_LINE) };
     });
 }
+const HEREDOC_OPENER = /(?:^|[^<])<<-?[ \t]*(?:'[^'\n]*'|"[^"\n]*"|\\?[^\s;&|<>()'"]+)/g;
+/**
+ * A heredoc body is the input of the step that opens it, not steps of its own:
+ * drop every body (and its delimiter line) and hand each opener step its body.
+ */
+function stepsWithHeredocs(command) {
+    const heredocs = (0, deterministicGuard_1.posixHeredocs)(command);
+    if (!heredocs.length)
+        return splitCommandSteps(command).map(segment => ({ segment, heredocs: [] }));
+    let code = '';
+    let at = 0;
+    for (const heredoc of heredocs) {
+        code += command.slice(at, heredoc.bodyStart);
+        at = Math.min(command.length, heredoc.end + 1);
+    }
+    code += command.slice(at);
+    let next = 0;
+    return splitCommandSteps(code).map(segment => {
+        const opened = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => (/<</.test(m) ? m : '""')).match(HEREDOC_OPENER) || [];
+        const mine = heredocs.slice(next, next + opened.length);
+        next += opened.length;
+        return { segment, heredocs: mine };
+    });
+}
+/** A long path shortened from the front: the file name is what the reader needs. */
+function shortPath(path, max = 60) {
+    if (path.length <= max)
+        return path;
+    const parts = path.split(/[\\/]/);
+    let out = parts.pop() || '';
+    while (parts.length && out.length + parts[parts.length - 1].length + 3 <= max)
+        out = `${parts.pop()}/${out}`;
+    return `…/${out}`.slice(0, max + 2);
+}
+function lineCount(body) {
+    return body ? body.split('\n').length : 0;
+}
+/** What a step does with the heredoc bodies it opens. */
+function describeHeredocStep(segment, heredocs, fns) {
+    const [heredoc] = heredocs;
+    const lines = lineCount(heredoc.body);
+    const size = `${lines}-line`;
+    const masked = segment.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, m => m.replace(/[>|]/g, '_'));
+    const target = /(?:^|[^>0-9-])>{1,2}\s*("[^"]*"|'[^']*'|[^\s&|;<]+)/.exec(masked);
+    const file = target ? unquote(segment.slice(target.index + target[0].length - target[1].length, target.index + target[0].length)) : '';
+    const words = tokens(segment).filter(t => !/^<</.test(t));
+    const program = (words[0] || '').toLowerCase().replace(/^.*[\\/]/, '');
+    const { kind, program: reader } = heredoc.receiver;
+    const into = program === 'cat' ? file : program === 'tee' ? (file || words.slice(1).find(t => !t.startsWith('-')) || '') : '';
+    // Writing the body to a file is this step; a later step that runs the file says so itself.
+    if (into && !/\|/.test(masked)) {
+        const what = kind === 'shell' ? `a ${size} shell script` : kind === 'language' ? `a ${size} ${reader} script` : `${lines} line${lines === 1 ? '' : 's'} of text`;
+        return { segment, text: shortValue(`Writes ${what} to ${shortPath(into)}`, MAX_LINE), known: true };
+    }
+    if (kind === 'shell')
+        return { segment, text: shortValue(`Runs a ${size} script with ${reader || program}`, MAX_LINE), known: true };
+    if (kind === 'language')
+        return { segment, text: shortValue(`Runs a ${size} ${reader} script`, MAX_LINE), known: true };
+    const base = describeOne(segment.replace(HEREDOC_OPENER, m => m.replace(/<<[\s\S]*$/, '')), undefined, fns);
+    return { ...base, segment, text: shortValue(`${base.text} (given ${lines} line${lines === 1 ? '' : 's'} of input text)`, MAX_LINE) };
+}
 /** One plain-words line per step, in order. */
 function describeShellCommand(command) {
-    const steps = splitCommandSteps(command);
+    const parts = stepsWithHeredocs(command);
+    const steps = parts.map(part => part.segment);
     const fns = localFunctions(command);
-    const described = steps.map(segment => {
+    const described = parts.map(({ segment, heredocs }) => {
         try {
-            return describeOne(segment, undefined, fns);
+            return heredocs.length ? describeHeredocStep(segment, heredocs, fns) : describeOne(segment, undefined, fns);
         }
         catch {
             return { segment, text: 'Runs a command the grammar does not recognise', known: false };

package/dist/commands/daemon.d.ts

@@ -1,5 +1,6 @@
 import { BotGuardConfig } from '../config';
 import { ProtectAllArgs } from './mcpGateway';
+import '../askDialog';
 import { windowsTaskRunsInteractive, windowsTaskRunsVisibly } from '../windowsTaskState';
 export interface DaemonArgs extends ProtectAllArgs {
     install?: string;
@@ -97,6 +98,15 @@ export declare function registerHiddenTask(taskName: string, xml: string | strin
  *  (the pre-1.22.1 VBS launcher) — the migration trigger. */
 export declare function windowsTaskReferencesScriptHost(taskName: string): boolean;
 export { windowsTaskRunsInteractive, windowsTaskRunsVisibly };
+/**
+ * Boot-time self-heal for the Windows autostart chain. Recreates a missing
+ * daemon logon entry, refreshes the launcher scripts (paths move on upgrade),
+ * and re-points the watchdog task at the `watchdog` launcher (older versions
+ * pointed it at daemon.vbs, which restarts but never beacons). Creating
+ * per-user MINUTE tasks needs no elevation; ONLOGON does — fall back to the
+ * per-user Run key exactly like installWindows().
+ */
+export declare function ensureWindowsAutostartHealthy(logFn: (message: string) => void): void;
 /** Snapshot of the resident daemon for out-of-process callers (watchdog/status). */
 export interface DaemonRuntimeState {
     alive: boolean;