fullcourtdefense-cli 1.36.3 → 1.37.0

package/dist/commands/desktopChatGuard.js

@@ -460,6 +460,8 @@ function startDesktopChatGuard(runtime) {
                 shieldKey: runtime.shieldKey,
                 developerName: snapshotIdentity.developerName,
                 machineName: snapshotIdentity.machineName,
+                // Read what the daemon poll keeps current — no re-download per tick.
+                hotPath: true,
             });
             scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
         }

package/dist/commands/deterministicGuard.d.ts

@@ -215,6 +215,17 @@ export declare function isPowerShellLine(text: string): boolean;
  * still carries fixture strings and docs.
  */
 export declare function unquotedCode(text: string): string;
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+export declare function posixHeredocs(text: string): Array<{
+    bodyStart: number;
+    bodyEnd: number;
+    end: number;
+    body: string;
+    receiver: {
+        kind: 'shell' | 'language' | 'data';
+        program: string;
+    };
+}>;
 export declare function stripInertDataSegments(text: string): string;
 export declare function scanDeterministicToolCall(toolName: string, toolArgs: Record<string, unknown>, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;
 export declare function scanDeterministicTextResponse(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/deterministicGuard.js

@@ -48,6 +48,7 @@ exports.getShellAstMode = getShellAstMode;
 exports.takeShellAstComparison = takeShellAstComparison;
 exports.isPowerShellLine = isPowerShellLine;
 exports.unquotedCode = unquotedCode;
+exports.posixHeredocs = posixHeredocs;
 exports.stripInertDataSegments = stripInertDataSegments;
 exports.scanDeterministicToolCall = scanDeterministicToolCall;
 exports.scanDeterministicTextResponse = scanDeterministicTextResponse;
@@ -1056,9 +1057,10 @@ function destructiveCommandDecision(value, commandContext) {
     if (astHit)
         return astHit;
     // The AST parsed the literal command only. A hit that exists only in a
-    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) is
-    // outside what it saw, so it cannot clear it.
-    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(value, { literalOnly: true })?.itemId || ''))
+    // decoded or de-obfuscated surface (`echo <base64> | base64 -d | sh`) or in
+    // a heredoc body a shell runs (`bash <<'EOF'`) is outside what it saw, so it
+    // cannot clear it.
+    if (regexRm && !RM_SCOPE_ITEMS.has(destructiveCommandReason(withoutActingHeredocBodies(value), { literalOnly: true })?.itemId || ''))
         return regexHit;
     if (regexRm) {
         // The AST cleared the rm-scope hit; other destructive rules still apply.
@@ -1519,7 +1521,7 @@ function isSensitivePathContext(toolName, candidate) {
 //      remote executor earlier in the same statement) are kept.
 //   5. Secret-literal rules and honeypot/custom rules never use this view —
 //      a token pasted into a commit message still leaks.
-const DATA_TO_INTERPRETER = /\b(?:iex|invoke-expression|invoke-command)\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
+const DATA_TO_INTERPRETER = /\b(?:iex|icm|invoke-expression|invoke-command)\b|\[scriptblock\]::create\b|\beval\b|\bxargs\b|\bbase64\b[^\n]*(?:-d\b|--decode\b)|frombase64string|-encodedcommand\b|\s-enc\s|(?<!\|)\|(?!\|)\s*&?\s*(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?|node|python[0-9.]*|perl|ruby)\b|\b(?:sh|bash|zsh|dash|ksh|csh|pwsh|powershell(?:\.exe)?|cmd(?:\.exe)?)\s+(?:-c|\/c|-e|-command|-scriptblock)\b|\b(?:ssh|wsl(?:\.exe)?|chroot)\b|\b(?:docker|kubectl|podman|nerdctl)(?:\.exe)?\s+(?:exec|run)\b/i;
 // A LANGUAGE interpreter's `-c` / `-e` argument is CODE in another language, not
 // a shell command line. `node -e "console.log('rm -rf /')"` prints a string;
 // `python -c "print('DROP TABLE')"` prints a string. That code only reaches the
@@ -1544,33 +1546,42 @@ function interpreterFileArguments(text) {
     if (text.length > 32_000)
         return '';
     const paths = [];
-    let calls = 0;
+    const budget = { calls: 0 };
     text.replace(/"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'/g, (whole, dq, sq, offset) => {
         if (!LANG_INTERPRETER_CODE_BEFORE.test(text.slice(Math.max(0, offset - 80), offset)))
             return whole;
-        const code = dq !== undefined ? dq : (sq || '');
-        // Preserve offsets while masking string contents: a call printed inside a
-        // string is not an invocation; a sensitive path in another argument is data.
-        const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
-        for (const call of instructions.matchAll(/\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes)\s*\(/g)) {
-            if (++calls > 48)
-                break;
-            const start = (call.index || 0) + call[0].length;
-            let depth = 1;
-            for (let end = start; end < instructions.length; end++) {
-                const ch = instructions[end];
-                if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
-                    paths.push(code.slice(start, end));
-                    break;
-                }
-                if (ch === '(')
-                    depth++;
-            }
-        }
+        collectFileCallArguments(dq !== undefined ? dq : (sq || ''), paths, budget);
         return whole;
     });
+    // Heredoc bodies a language interpreter runs (`python3 - <<'EOF'`, or
+    // `cat > x.js <<'EOF' … node x.js`) are the same inline code.
+    for (const heredoc of heredocView(text)?.heredocs || []) {
+        if (heredoc.receiver.kind === 'language')
+            collectFileCallArguments(heredoc.body, paths, budget);
+    }
     return paths.join('\n');
 }
+const FILE_CALL_RE = /\b(?:open|fopen|readFile(?:Sync)?|createReadStream|ReadAllText|ReadAllBytes|readTextFile|file_get_contents|copyFile(?:Sync)?|copyfile|copy2?|Path|File\.read)\s*\(/g;
+function collectFileCallArguments(code, paths, budget) {
+    // Preserve offsets while masking string contents: a call printed inside a
+    // string is not an invocation; a sensitive path in another argument is data.
+    const instructions = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, literal => ' '.repeat(literal.length));
+    for (const call of instructions.matchAll(FILE_CALL_RE)) {
+        if (++budget.calls > 48)
+            break;
+        const start = (call.index || 0) + call[0].length;
+        let depth = 1;
+        for (let end = start; end < instructions.length; end++) {
+            const ch = instructions[end];
+            if ((ch === ')' && --depth === 0) || (ch === ',' && depth === 1)) {
+                paths.push(code.slice(start, end));
+                break;
+            }
+            if (ch === '(')
+                depth++;
+        }
+    }
+}
 // $( … ) always executes; backtick pairs only with ≥2 chars of content
 // (PowerShell escapes like `n / `t are single-char and inert).
 const INTERPOLATES = /\$\(|`[^`]{2,}`/;
@@ -1717,16 +1728,414 @@ function replaceQuotedSpans(src, fn) {
     }
     return out + src.slice(from);
 }
+// Stdin of these is executed as shell/SQL code; `done`/`fi`/`esac`/`}`/`)`
+// close a compound command whose body acts on what it reads (`while read c; do $c; done <<EOF`).
+const SHELL_STDIN_PROGRAMS = /^(?:sh|bash|zsh|dash|ksh|mksh|ash|csh|tcsh|fish|busybox|pwsh|powershell|cmd|ssh|wsl|chroot|su|eval|source|\.|xargs|parallel|at|batch|crontab|expect|tclsh|wish|osascript|script|psql|mysql|mariadb|sqlite3|sqlcmd|mongosh|mongo|redis-cli|cqlsh|clickhouse-client|duckdb|snowsql|done|fi|esac|\}|\))$/;
+const LANGUAGE_STDIN_PROGRAMS = /^(?:node|nodejs|deno|bun|python[0-9.]*|py|pypy[0-9.]*|perl|ruby|php|lua|luajit|tsx|ts-node|rscript|julia|groovy)$/;
+const CONTAINER_CLI_PROGRAMS = /^(?:docker|podman|nerdctl|kubectl|oc)$/;
+const RECEIVER_RANK = { data: 0, language: 1, shell: 2 };
+function programName(token) {
+    return token.toLowerCase().replace(/^.*[\\/]/, '').replace(/\.(?:exe|cmd|bat)$/, '');
+}
+/** Words of one stage without assignments and redirections (`> f`, `2>&1`, `<<'EOF'`). */
+function stageWords(stage) {
+    const words = [];
+    const tokens = segmentTokens(stage.trim());
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (/^(?:\d*>{1,2}|&>{1,2}|<{1,3}-?|\d*<)$/.test(token)) {
+            i++;
+            continue;
+        }
+        if (/^(?:\d*>|&>|<)/.test(token))
+            continue;
+        if (!words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        words.push(token);
+    }
+    return words;
+}
+/** How one pipeline stage treats the bytes on its stdin. */
+function stdinReceiver(stage) {
+    const words = stageWords(stage);
+    for (let i = 0; i < words.length; i++) {
+        const program = programName(words[i]);
+        if (SHELL_STDIN_PROGRAMS.test(program))
+            return { kind: 'shell', program };
+        if (LANGUAGE_STDIN_PROGRAMS.test(program))
+            return { kind: 'language', program };
+        if (CONTAINER_CLI_PROGRAMS.test(program)) {
+            return words.slice(i + 1).some(word => /^(?:exec|run|attach|debug)$/i.test(word)) ? { kind: 'shell', program } : { kind: 'data', program };
+        }
+        if (AST_TRANSPARENT_WRAPPERS.has(program)) {
+            // `sudo -u root bash`, `env X=1 node`, `timeout 5 sh`: the reader is a later word, past the wrapper's own options.
+            let reader = { kind: 'data', program };
+            for (const word of words.slice(i + 1))
+                reader = strongerReceiver(reader, stdinReceiver(word));
+            return reader;
+        }
+        return { kind: 'data', program };
+    }
+    return { kind: 'data', program: '' };
+}
+function strongerReceiver(a, b) {
+    return RECEIVER_RANK[b.kind] > RECEIVER_RANK[a.kind] ? b : a;
+}
+/** Files the opener stage writes its stdin to (`cat > f`, `tee f`). */
+function stageWriteTargets(stage) {
+    const targets = redirectTargets(stage);
+    const words = stageWords(stage);
+    if (programName(words[0] || '') === 'tee')
+        targets.push(...words.slice(1).filter(word => !word.startsWith('-')));
+    return targets.map(target => programName(target)).filter(Boolean);
+}
+/** The strongest program among `statements` that runs one of `files` (`node x.js`, `bash x.sh`, `./x.sh`). */
+function laterRunnerOf(files, statements) {
+    let runner = { kind: 'data', program: '' };
+    if (!files.length)
+        return runner;
+    for (const stages of statements) {
+        for (const stage of stages) {
+            const words = stageWords(stage);
+            if (!words.some(word => files.includes(programName(word))))
+                continue;
+            const direct = files.includes(programName(words[0] || ''));
+            runner = strongerReceiver(runner, direct ? { kind: 'shell', program: programName(words[0]) } : stdinReceiver(stage));
+        }
+    }
+    return runner;
+}
+/**
+ * Every heredoc of a POSIX command line, with its exact body and its stages.
+ * `undefined` when the line does not lex (an unclosed quote or substitution):
+ * callers then keep every body as code.
+ */
+function lexHeredocs(text) {
+    const spans = [];
+    const pending = [];
+    const frame = (closer, stageStart) => ({ closer, quote: '', depth: 0, afterPipe: false, stageStart, stages: [], open: [] });
+    const stack = [frame('', 0)];
+    /** `i` at the first `(` of `((`: index of the closing `))` (arithmetic holds no heredoc; `<<` there is a shift). */
+    const arithmeticEnd = (i) => {
+        let depth = 0;
+        for (let k = i; k < text.length; k++) {
+            if (text[k] === '(')
+                depth++;
+            else if (text[k] === ')' && --depth === 0)
+                return k;
+        }
+        return -1;
+    };
+    const codeSlice = (from, to) => {
+        let out = '';
+        let at = from;
+        for (const span of spans) {
+            if (span.end <= at || span.bodyStart >= to)
+                continue;
+            out += text.slice(at, Math.max(at, span.bodyStart));
+            at = Math.max(at, span.end);
+        }
+        return out + text.slice(at, Math.max(at, to));
+    };
+    const endStage = (ctx, at) => { ctx.stages.push(codeSlice(ctx.stageStart, at)); ctx.stageStart = at + 1; };
+    const endStatement = (ctx, at) => {
+        endStage(ctx, at);
+        for (const { span, stage } of ctx.open)
+            span.stages = ctx.stages.slice(stage);
+        ctx.stages = [];
+        ctx.open = [];
+    };
+    const readBodies = (newline) => {
+        let pos = newline + 1;
+        for (const { span, delimiter, stripTabs } of pending.splice(0)) {
+            span.bodyStart = pos;
+            span.bodyEnd = span.end = text.length;
+            while (pos < text.length) {
+                const lineEnd = text.indexOf('\n', pos);
+                const stop = lineEnd < 0 ? text.length : lineEnd;
+                let line = text.slice(pos, stop).replace(/\r$/, '');
+                if (stripTabs)
+                    line = line.replace(/^\t+/, '');
+                if (line === delimiter) {
+                    span.bodyEnd = pos;
+                    span.end = stop;
+                    pos = stop + 1;
+                    break;
+                }
+                pos = stop + 1;
+            }
+            span.body = text.slice(span.bodyStart, span.bodyEnd < text.length ? Math.max(span.bodyStart, span.bodyEnd - 1) : text.length);
+            spans.push(span);
+        }
+        return pos;
+    };
+    for (let i = 0; i < text.length; i++) {
+        const ctx = stack[stack.length - 1];
+        const c = text[i];
+        const next = text[i + 1];
+        if (ctx.quote === "'") {
+            if (c === "'")
+                ctx.quote = '';
+            continue;
+        }
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (ctx.quote === '"') {
+            if (c === '"')
+                ctx.quote = '';
+            else if (c === '$' && next === '(' && text[i + 2] === '(') {
+                const e = arithmeticEnd(i + 1);
+                if (e < 0)
+                    return undefined;
+                i = e;
+            }
+            else if (c === '$' && next === '(') {
+                stack.push(frame(')', i + 2));
+                i++;
+            }
+            else if (c === '`')
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c !== '|' && c !== '\n' && !/\s/.test(c))
+            ctx.afterPipe = false;
+        if (c === '#' && (i === 0 || /[\s;&|(]/.test(text[i - 1]))) {
+            const nl = text.indexOf('\n', i);
+            i = (nl < 0 ? text.length : nl) - 1;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            ctx.quote = c;
+            continue;
+        }
+        if ((c === '$' && next === '(' && text[i + 2] === '(') || (c === '(' && next === '(')) {
+            const e = arithmeticEnd(c === '$' ? i + 1 : i);
+            if (e < 0)
+                return undefined;
+            i = e;
+            continue;
+        }
+        if (c === '$' && next === '(') {
+            stack.push(frame(')', i + 2));
+            i++;
+            continue;
+        }
+        if (c === '`') {
+            if (ctx.closer === '`') {
+                endStatement(ctx, i);
+                stack.pop();
+            }
+            else
+                stack.push(frame('`', i + 1));
+            continue;
+        }
+        if (c === '(') {
+            endStatement(ctx, i);
+            ctx.depth++;
+            continue;
+        }
+        if (c === ')') {
+            endStatement(ctx, i);
+            if (ctx.depth > 0)
+                ctx.depth--;
+            else if (ctx.closer === ')' && stack.length > 1)
+                stack.pop();
+            continue;
+        }
+        if (c === '{' && (next === undefined || /\s/.test(next))) {
+            endStatement(ctx, i);
+            continue;
+        }
+        if (c === ';' || (c === '&' && next !== '>' && text[i - 1] !== '>' && text[i - 1] !== '<')) {
+            endStatement(ctx, i);
+            if ((c === '&' && next === '&') || (c === ';' && next === ';'))
+                i++;
+            continue;
+        }
+        if (c === '|') {
+            if (next === '|') {
+                endStatement(ctx, i);
+                i++;
+            }
+            else {
+                endStage(ctx, i);
+                ctx.afterPipe = true;
+                if (next === '&')
+                    i++;
+            }
+            continue;
+        }
+        if (c === '\n') {
+            // `cat <<'EOF' |` continues the pipeline on the line after the body.
+            if (!ctx.afterPipe)
+                endStatement(ctx, i);
+            if (pending.length) {
+                const after = readBodies(i);
+                if (ctx.stageStart <= after)
+                    ctx.stageStart = after;
+                i = after - 1;
+            }
+            continue;
+        }
+        if (c === '<' && next === '<' && text[i - 1] !== '<') {
+            if (text[i + 2] === '<') {
+                i += 2;
+                continue;
+            } // `<<<` here-string: quoted-span pass
+            let j = i + 2;
+            const stripTabs = text[j] === '-';
+            if (stripTabs)
+                j++;
+            while (text[j] === ' ' || text[j] === '\t')
+                j++;
+            let delimiter = '';
+            let literal = false;
+            while (j < text.length && !/[\s;&|<>()]/.test(text[j])) {
+                const q = text[j];
+                if (q === "'" || q === '"') {
+                    const close = text.indexOf(q, j + 1);
+                    if (close < 0)
+                        return undefined;
+                    delimiter += text.slice(j + 1, close);
+                    literal = true;
+                    j = close + 1;
+                }
+                else if (q === '\\') {
+                    delimiter += text[j + 1] || '';
+                    literal = true;
+                    j += 2;
+                }
+                else {
+                    delimiter += q;
+                    j++;
+                }
+            }
+            if (!delimiter) {
+                i = j - 1;
+                continue;
+            }
+            const span = { bodyStart: text.length, bodyEnd: text.length, end: text.length, body: '', literal, stages: [] };
+            pending.push({ span, delimiter, stripTabs });
+            ctx.open.push({ span, stage: ctx.stages.length });
+            i = j - 1;
+            continue;
+        }
+    }
+    if (stack.length > 1 || stack[0].quote)
+        return undefined;
+    if (pending.length)
+        readBodies(text.length - 1);
+    endStatement(stack[0], text.length);
+    return spans;
+}
+/** Heredocs of a POSIX line, each with the receiver that decides what its body is. */
+function heredocView(text) {
+    if (!text.includes('<<') || text.length > 256_000)
+        return undefined;
+    const spans = lexHeredocs(text);
+    if (!spans || !spans.length)
+        return undefined;
+    let skeleton = '';
+    let at = 0;
+    for (const span of spans) {
+        skeleton += text.slice(at, span.bodyStart);
+        at = span.end;
+    }
+    skeleton += text.slice(at);
+    const statements = splitUnquotedPipelines(skeleton);
+    const heredocs = spans.map(span => {
+        let receiver = { kind: 'data', program: '' };
+        for (const stage of span.stages)
+            receiver = strongerReceiver(receiver, stdinReceiver(stage));
+        receiver = strongerReceiver(receiver, laterRunnerOf(stageWriteTargets(span.stages[0] || ''), statements));
+        return { ...span, receiver };
+    });
+    return { heredocs, skeleton };
+}
+/** POSIX heredocs of a command line, in order: body span, delimiter-line end, and receiver. */
+function posixHeredocs(text) {
+    return (heredocView(text)?.heredocs || []).map(({ bodyStart, bodyEnd, end, body, receiver }) => ({ bodyStart, bodyEnd, end, body, receiver }));
+}
+/** Does this heredoc body run as code where it lands? */
+function heredocBodyActs(heredoc) {
+    // Unquoted delimiter: `$( … )` / backticks in the body run before any receiver sees it.
+    if (!heredoc.literal && INTERPOLATES.test(heredoc.body))
+        return true;
+    if (heredoc.receiver.kind === 'shell')
+        return true;
+    if (heredoc.receiver.kind === 'language') {
+        return CODE_SPAWNS_PROCESS.test(heredoc.body)
+            || (/^(?:perl|ruby)$/.test(heredoc.receiver.program) && /`[^`]*`|%x[\[{(]/.test(heredoc.body))
+            || interpreterCodeRequestsMetadata(heredoc.body);
+    }
+    return false;
+}
+/**
+ * Each body becomes `inert` when it is data, or `acting(index)` when it runs
+ * (left as is without `acting`). Delimiter lines stay, so the result still
+ * lexes. Returns the bodies that run so a caller can put them back verbatim.
+ */
+function replaceHeredocBodies(text, view, inert, acting) {
+    let out = '';
+    let at = 0;
+    const kept = [];
+    for (const heredoc of view.heredocs) {
+        const acts = heredocBodyActs(heredoc);
+        if (acts && !acting)
+            continue;
+        out += text.slice(at, heredoc.bodyStart) + (acts ? acting(kept.push(heredoc.body) - 1) : inert);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return { text: out + text.slice(at), acting: kept };
+}
+/** The line as a bash parser sees it: bodies that RUN are opaque text there, so blank them. */
+function withoutActingHeredocBodies(text) {
+    const view = heredocView(text);
+    if (!view)
+        return text;
+    let out = '';
+    let at = 0;
+    for (const heredoc of view.heredocs) {
+        if (!heredocBodyActs(heredoc))
+            continue;
+        out += text.slice(at, heredoc.bodyStart);
+        at = heredoc.bodyStart + heredoc.body.length;
+    }
+    return out + text.slice(at);
+}
+const ACTING_BODY_MARK = (index) => `fcd_acting_heredoc_${index}_`;
+/** Receiver of a `<<<` here-string whose quoted word starts at `offset`. */
+function hereStringReceiver(src, offset) {
+    const head = src.slice(src.lastIndexOf('\n', offset - 1) + 1, offset).replace(/<<<\s*$/, '');
+    const statements = splitUnquotedPipelines(head);
+    const stages = statements[statements.length - 1] || [];
+    return stdinReceiver(stages[stages.length - 1] || '');
+}
 function stripInertDataSegments(text) {
-    if (DATA_TO_INTERPRETER.test(unquotedCode(text)))
+    const heredocs = heredocView(text);
+    // A data body (`cat > notes.md <<'EOF' … ssh … EOF`) cannot make the line an
+    // interpreter feed; only the code around it, and bodies that run, can.
+    const executable = heredocs ? replaceHeredocBodies(text, heredocs, '').text : text;
+    if (DATA_TO_INTERPRETER.test(unquotedCode(executable)))
         return text;
+    // A body that runs is code line for line: park it so the quoted-span pass
+    // below cannot read `os.system('rm -rf ~')` as prose, then put it back.
+    const parked = heredocs ? replaceHeredocBodies(text, heredocs, INERT_DATA, ACTING_BODY_MARK) : { text, acting: [] };
+    let out = stripQuotedData(parked.text);
+    parked.acting.forEach((body, index) => {
+        const mark = ACTING_BODY_MARK(index);
+        out = out.includes(mark) ? out.replace(mark, () => body) : `${out}\n${body}`;
+    });
+    return out;
+}
+/** Here-strings and quoted prose of a line whose heredoc bodies are already resolved. */
+function stripQuotedData(text) {
     let out = text;
     // PowerShell here-strings: @'…'@ is fully literal; @"…"@ interpolates $( ).
     out = replaceDelimited(out, "@'", "'@", () => INERT_DATA);
     out = replaceDelimited(out, '@"', '"@', m => (m.includes('$(') ? m : INERT_DATA));
-    // POSIX heredocs: quoted delimiter (<<'EOF') is literal; unquoted interpolates.
-    out = out.replace(/<<-?\s*'(\w+)'[\s\S]*?(?:\n\1\b|$)/g, INERT_DATA);
-    out = out.replace(/<<-?\s*"?(\w+)"?[\s\S]*?(?:\n\1\b|$)/g, m => (INTERPOLATES.test(m) ? m : INERT_DATA));
     // Generic quoted-span pass: whitespace inside quotes ⇒ free text ⇒ inert,
     // unless the span sits in a code position (invariants 2–4 above).
     const src = out;
@@ -1736,6 +2145,14 @@ function stripInertDataSegments(text) {
         if (!/\s/.test(body))
             return whole; // single token: argv, not prose
         const before = src.slice(Math.max(0, offset - 80), offset);
+        // `bash <<< "…"` feeds the quoted word to stdin: it is what its reader makes of it.
+        if (/<<<\s*$/.test(before)) {
+            const receiver = hereStringReceiver(src, offset);
+            if (receiver.kind === 'shell')
+                return whole;
+            if (receiver.kind === 'language')
+                return CODE_SPAWNS_PROCESS.test(body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;
+        }
         // Language-interpreter code: data unless it spawns a process (see above).
         if (LANG_INTERPRETER_CODE_BEFORE.test(before))
             return interpreterCodeSpawnsProcess(before, body) || interpreterCodeRequestsMetadata(body) ? whole : INERT_DATA;

package/dist/commands/discoverPaths.d.ts

@@ -38,6 +38,16 @@ export declare function claudeDesktopInstallTargets(configPath?: string): Claude
 export declare function candidateConfigPaths(cwd: string, extra?: string): ConfigPathCandidate[];
 /** Common places developers keep code, used by `--scan-root auto`. */
 export declare function defaultScanRoots(): string[];
+type ProjectConfigScan = {
+    candidates: ConfigPathCandidate[];
+    scannedDirs: number;
+    excludedDirs: number;
+    truncated: boolean;
+    truncatedReason?: ScanTruncationReason;
+    maxDepth: number;
+    maxDirs: number;
+};
+export declare function setProjectConfigScanPass(key: string | undefined): void;
 /**
  * Bounded walk of developer folders looking for project-scoped MCP configs
  * (`--scan-root`). Depth- and volume-capped so it stays fast and predictable —
@@ -48,15 +58,7 @@ export declare function scanRootsForProjectConfigs(roots: string[], options?: {
     maxDepth?: number;
     maxDirs?: number;
     excludedRoots?: string[];
-}): {
-    candidates: ConfigPathCandidate[];
-    scannedDirs: number;
-    excludedDirs: number;
-    truncated: boolean;
-    truncatedReason?: ScanTruncationReason;
-    maxDepth: number;
-    maxDirs: number;
-};
+}): ProjectConfigScan;
 export interface FolderCatalogEntry {
     path: string;
     /** Depth relative to its walk root (home or a dev root) — lets the UI indent. */
@@ -85,3 +87,4 @@ export declare function discoverScanTargets(cwd: string, extra?: string): Config
  * `~/.codex` / `~/.cursor` without Cursor.exe must not count as installed.
  */
 export declare function detectIdeAppInstalled(clientKey: string, env?: NodeJS.ProcessEnv, home?: string, platform?: NodeJS.Platform): boolean;
+export {};

package/dist/commands/discoverPaths.js

@@ -46,6 +46,7 @@ exports.claudeDesktopLikelyInstalled = claudeDesktopLikelyInstalled;
 exports.claudeDesktopInstallTargets = claudeDesktopInstallTargets;
 exports.candidateConfigPaths = candidateConfigPaths;
 exports.defaultScanRoots = defaultScanRoots;
+exports.setProjectConfigScanPass = setProjectConfigScanPass;
 exports.scanRootsForProjectConfigs = scanRootsForProjectConfigs;
 exports.buildFolderCatalog = buildFolderCatalog;
 exports.resolveScanRoots = resolveScanRoots;
@@ -297,6 +298,23 @@ function defaultScanRoots() {
         }
     });
 }
+/**
+ * Reuse of one walk across a single daemon protection pass. A pass inspects,
+ * repairs, rescans and verifies, and each step walked every scan root again
+ * (4-7 walks of up to 25,000 folders). Only the daemon's housekeeping sets a
+ * pass key; every other caller (and work between a pass's steps) walks fresh.
+ */
+let scanPassKey;
+const scanPassResults = new Map();
+const SCAN_PASSES_KEPT = 4;
+function setProjectConfigScanPass(key) {
+    scanPassKey = key;
+    if (key === undefined || scanPassResults.has(key))
+        return;
+    scanPassResults.set(key, new Map());
+    while (scanPassResults.size > SCAN_PASSES_KEPT)
+        scanPassResults.delete(scanPassResults.keys().next().value);
+}
 /**
  * Bounded walk of developer folders looking for project-scoped MCP configs
  * (`--scan-root`). Depth- and volume-capped so it stays fast and predictable —
@@ -304,6 +322,18 @@ function defaultScanRoots() {
  * are pruned; only the known project config filenames are checked.
  */
 function scanRootsForProjectConfigs(roots, options = {}) {
+    const pass = scanPassKey === undefined ? undefined : scanPassResults.get(scanPassKey);
+    if (!pass)
+        return walkProjectConfigs(roots, options);
+    const memoKey = JSON.stringify([roots, options.maxDepth, options.maxDirs, options.excludedRoots]);
+    const cached = pass.get(memoKey);
+    if (cached)
+        return { ...cached, candidates: cached.candidates.map(candidate => ({ ...candidate })) };
+    const result = walkProjectConfigs(roots, options);
+    pass.set(memoKey, result);
+    return { ...result, candidates: result.candidates.map(candidate => ({ ...candidate })) };
+}
+function walkProjectConfigs(roots, options) {
     const maxDepth = options.maxDepth ?? 4;
     const maxDirs = options.maxDirs ?? 25000;
     const candidates = [];

package/dist/commands/ephemeralStack.js

@@ -51,6 +51,7 @@ const config_1 = require("../config");
 const child_process_1 = require("child_process");
 const installClaudeHook_1 = require("./installClaudeHook");
 const mcpGateway_1 = require("./mcpGateway");
+const refreshPolicyCache_1 = require("./refreshPolicyCache");
 /**
  * Written by `ci-protect` / `workload-protect` next to the credentials they
  * save. Its presence says "the enrollment on this machine is EPHEMERAL", so a
@@ -214,6 +215,12 @@ async function startDetachedHttpGateway(input) {
  */
 async function installEphemeralProtectionStack(options, config) {
     const sendLog = options.sendLog || exports.silentLogSink;
+    // Seed both policy caches before the agent's first action, as login does:
+    // hooks and gateways never fetch policy while a cache exists, and a job or
+    // container has no daemon to poll. Callers export the ephemeral identity
+    // (FCD_MACHINE_ID) first, so the seed carries it. Best-effort and silent —
+    // on failure the hot path's single-flight no-cache attempt still applies.
+    await (0, refreshPolicyCache_1.refreshPolicyCachesInBackground)({ apiUrl: options.apiUrl, shieldId: options.shieldId, shieldKey: options.shieldKey });
     // The Claude-format hook covers Claude Code, VS Code agent mode, and
     // Copilot CLI — the common agents on runners and in containers.
     if (options.hooks !== 'false') {

package/dist/commands/flushSpool.d.ts

@@ -4,6 +4,8 @@ export interface FlushSpoolArgs {
     shieldId?: string;
     shieldKey?: string;
     heartbeat?: string;
+    /** `false`: leave the terminal guard rule files alone (the daemon keeps their 30 s cadence). */
+    guardRules?: string;
 }
 /**
  * `fullcourtdefense flush-spool` — drain the local telemetry spool to the backend