@blogic-cz/agent-tools 0.14.60 → 0.14.62

package/README.md

@@ -252,6 +252,12 @@ export default { handleToolExecuteBefore };
 
 All tools support `--help` for full usage documentation. Legacy `agent-tools-*` binary names (e.g. `agent-tools-gh`) still work for backwards compatibility.
 
+### Kubernetes command safety
+
+`k8s-tool` parses generic kubectl commands into arguments and invokes `kubectl` directly. Shell pipelines, chaining, substitution, user overrides of the configured cluster or credentials, mutating `config`/`auth` subcommands, and `cluster-info dump` are rejected. Direct Secret reads, raw kubeconfig output, filename/kustomize reads, and `kubectl diff` are also blocked.
+
+Pod `exec` is limited to direct `redis-cli PING/INFO` and `ls` diagnostics. Generic exec cannot read file contents; use `logs-tool`, which confines files to the configured log directory, tails them through an internal structured operation, and applies the same case-insensitive literal substring filter locally and remotely. Configured log directories are a trusted boundary and must not permit adversarial symlink replacement during reads.
+
 ### gh-tool machine contracts
 
 `pr view` adds `headSha` and `baseSha`; failed-check evidence adds the same SHA pair. Review summaries, inline comments, and threads add `commitSha` plus `feedbackOrigin`: `current_head` only for an exact `commitSha === headSha`, `pre_existing` for a different known SHA (not an obsolescence verdict), and `unknown` when either SHA is absent. Issue comments always use `commitSha: null` and `feedbackOrigin: unknown`. `review-triage` preserves existing fields and adds `inlineComments` plus per-kind `feedbackOriginCounts`; batch triage returns the same object per PR.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.14.60",
+  "version": "0.14.62",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/gh-tool/pr/core.ts

@@ -16,6 +16,7 @@ import type {
   WorkflowRunDetail,
 } from "#gh/types";
 
+import type { GitHubAuthError, GitHubNotFoundError } from "#gh/errors";
 import { GitHubCommandError, GitHubMergeError } from "#gh/errors";
 import { GitHubService } from "#gh/service";
 
@@ -24,6 +25,7 @@ import { runLocalCommand } from "./helpers";
 import { diagnoseLogEntries, fetchJobLogs, formatLogEntries, parseRawJobLogs } from "#gh/workflow";
 
 const CHECK_JSON_FIELDS = "name,state,bucket,link";
+const LONG_LIVED_BRANCHES = new Set(["main", "master", "develop", "staging", "production"]);
 const STABLE_SNAPSHOT_ATTEMPTS = 3;
 const GITHUB_ACTIONS_RUN_ID_RE = /github\.com\/[^/]+\/[^/]+\/actions\/runs\/(\d+)/;
 
@@ -695,13 +697,22 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
     "number,url,title,headRefName,baseRefName,state,isDraft,mergeable",
   ]);
 
+  const repo = opts.deleteBranch ? yield* gh.getRepoInfo() : null;
+
+  // A long-lived branch (default/env branch) as PR head means a promotion PR
+  // (e.g. main -> staging). PRs based on it are unrelated work, not a stack —
+  // retargeting them would mass-rewrite their base — and the branch itself
+  // must never be deleted.
+  const headIsLongLived =
+    LONG_LIVED_BRANCHES.has(info.headRefName) || info.headRefName === repo?.defaultBranch;
+
   // Stacked-PR safety: find open PRs that depend on this PR's head branch.
   // Deleting the head branch of an open PR that uses it as its base CLOSES that
   // PR (GitHub CLI behavior, see cli/cli#1168) instead of retargeting it. We
   // retarget such dependents onto this PR's base first, and only delete the
   // branch if EVERY retarget succeeds (fail-closed).
   const dependentOpenPrs =
-    opts.deleteBranch && info.headRefName
+    opts.deleteBranch && !headIsLongLived && info.headRefName
       ? yield* gh.runGhJson<Array<{ number: number; headRefName: string; baseRefName: string }>>([
           "pr",
           "list",
@@ -722,18 +733,23 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
         ? "PR is mergeable."
         : `PR mergeable status: ${info.mergeable}`;
 
-    const dependentNote =
-      dependentOpenPrs.length > 0
+    const dependentNote = headIsLongLived
+      ? opts.deleteBranch
+        ? `Head \`${info.headRefName}\` is a long-lived branch; deletion and dependent retargeting are skipped. `
+        : ""
+      : dependentOpenPrs.length > 0
         ? `${dependentOpenPrs.length} dependent open PR(s) (${dependentOpenPrs
             .map((d) => `#${d.number}`)
-            .join(", ")}) will be retargeted to \`${info.baseRefName}\` before deletion; ` +
-          "branch deletion is skipped if any retarget fails. "
+            .join(", ")}) will be retargeted to \`${info.baseRefName}\` before deletion ` +
+          "(rolled back if the merge fails); branch deletion is skipped if any retarget fails. "
         : "";
 
     yield* Console.log(
       `DRY RUN: Would merge PR #${info.number} "${info.title}" via ${opts.strategy.toUpperCase()}. ` +
         `Branch \`${info.headRefName}\` → \`${info.baseRefName}\`. ` +
-        (opts.deleteBranch ? `Remote branch \`${info.headRefName}\` will be deleted. ` : "") +
+        (opts.deleteBranch && !headIsLongLived
+          ? `Remote branch \`${info.headRefName}\` will be deleted. `
+          : "") +
         dependentNote +
         mergeableNote,
     );
@@ -747,14 +763,16 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
     return result;
   }
 
-  // Retarget dependents BEFORE merging so the head branch can be deleted safely.
-  // If any retarget fails, keep the branch (fail-closed) so no dependent PR is closed.
-  let willDeleteBranch = opts.deleteBranch;
-  let branchDeleteSkipped = false;
+  let willDeleteBranch = opts.deleteBranch && !headIsLongLived;
+  let branchDeleteSkipped = opts.deleteBranch && headIsLongLived;
   const retargetedChildren: number[] = [];
-  const repo = opts.deleteBranch ? yield* gh.getRepoInfo() : null;
 
-  if (opts.deleteBranch && dependentOpenPrs.length > 0 && repo) {
+  // Retarget dependents BEFORE merging: repos with "Automatically delete head
+  // branches" delete the head as part of the merge itself, which closes any PR
+  // still based on it (cli/cli#1168). A failed merge rolls the retargets back.
+  // If any retarget fails, keep the branch (fail-closed) so no dependent PR is
+  // closed.
+  if (willDeleteBranch && dependentOpenPrs.length > 0 && repo) {
     for (const child of dependentOpenPrs) {
       const retargeted = yield* gh
         .runGh([
@@ -780,54 +798,102 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
     }
   }
 
+  const rollbackRetargets = Effect.gen(function* () {
+    const failed: number[] = [];
+    if (retargetedChildren.length === 0 || !repo) {
+      return failed;
+    }
+    for (const child of retargetedChildren) {
+      const rolledBack = yield* gh
+        .runGh([
+          "api",
+          "--method",
+          "PATCH",
+          `repos/${repo.owner}/${repo.name}/pulls/${child}`,
+          "-f",
+          `base=${info.headRefName}`,
+        ])
+        .pipe(
+          Effect.as(true),
+          Effect.orElseSucceed(() => false),
+        );
+      if (!rolledBack) {
+        failed.push(child);
+      }
+    }
+    return failed;
+  });
+
   const mergeArgs = ["pr", "merge", String(opts.pr), `--${opts.strategy}`];
 
   const mergeResult = yield* gh.runGh(mergeArgs).pipe(
-    Effect.catchTag("GitHubCommandError", (error) => {
-      const stderr = error.stderr.toLowerCase();
-
-      if (stderr.includes("merge conflict") || stderr.includes("conflicts")) {
-        return Effect.fail(
-          new GitHubMergeError({
-            message: `PR #${opts.pr} has merge conflicts`,
-            reason: "conflicts",
-            hint: "Resolve merge conflicts locally, push the fix, then retry the merge.",
-            nextCommand: `gh pr diff ${opts.pr}`,
-          }),
-        );
-      }
+    Effect.catch((error) =>
+      rollbackRetargets.pipe(
+        Effect.andThen(
+          (
+            rollbackFailed,
+          ): Effect.Effect<never, GitHubNotFoundError | GitHubAuthError | GitHubMergeError> => {
+            const rollbackNote =
+              rollbackFailed.length > 0
+                ? ` ROLLBACK INCOMPLETE: dependent PR(s) ${rollbackFailed
+                    .map((child) => `#${child}`)
+                    .join(", ")} are still retargeted to \`${info.baseRefName}\`; ` +
+                  `manually restore their base to \`${info.headRefName}\`.`
+                : "";
+
+            if (error._tag !== "GitHubCommandError") {
+              return rollbackNote === ""
+                ? Effect.fail(error)
+                : Console.error(rollbackNote.trim()).pipe(Effect.andThen(Effect.fail(error)));
+            }
 
-      if (stderr.includes("required status check") || stderr.includes("checks")) {
-        return Effect.fail(
-          new GitHubMergeError({
-            message: `PR #${opts.pr} has failing required checks`,
-            reason: "checks_failing",
-            hint: "Wait for CI checks to pass or investigate failures before merging.",
-            nextCommand: `agent-tools-gh pr checks --pr ${opts.pr}`,
-            retryable: true,
-          }),
-        );
-      }
+            const stderr = error.stderr.toLowerCase();
+
+            if (stderr.includes("merge conflict") || stderr.includes("conflicts")) {
+              return Effect.fail(
+                new GitHubMergeError({
+                  message: `PR #${opts.pr} has merge conflicts`,
+                  reason: "conflicts",
+                  hint: `Resolve merge conflicts locally, push the fix, then retry the merge.${rollbackNote}`,
+                  nextCommand: `gh pr diff ${opts.pr}`,
+                }),
+              );
+            }
 
-      if (stderr.includes("protected branch")) {
-        return Effect.fail(
-          new GitHubMergeError({
-            message: `PR #${opts.pr} targets a protected branch`,
-            reason: "branch_protected",
-            hint: "This branch has protection rules. Ensure required reviews and checks are satisfied, or ask a repo admin.",
-          }),
-        );
-      }
+            if (stderr.includes("required status check") || stderr.includes("checks")) {
+              return Effect.fail(
+                new GitHubMergeError({
+                  message: `PR #${opts.pr} has failing required checks`,
+                  reason: "checks_failing",
+                  hint: `Wait for CI checks to pass or investigate failures before merging.${rollbackNote}`,
+                  nextCommand: `agent-tools-gh pr checks --pr ${opts.pr}`,
+                  retryable: true,
+                }),
+              );
+            }
 
-      return Effect.fail(
-        new GitHubMergeError({
-          message: `Failed to merge PR #${opts.pr}: ${error.stderr}`,
-          reason: "unknown",
-          hint: "Check the PR state and branch protections. The PR may already be merged or closed.",
-          nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
-        }),
-      );
-    }),
+            if (stderr.includes("protected branch")) {
+              return Effect.fail(
+                new GitHubMergeError({
+                  message: `PR #${opts.pr} targets a protected branch`,
+                  reason: "branch_protected",
+                  hint: `This branch has protection rules. Ensure required reviews and checks are satisfied, or ask a repo admin.${rollbackNote}`,
+                }),
+              );
+            }
+
+            return Effect.fail(
+              new GitHubMergeError({
+                message: `Failed to merge PR #${opts.pr}: ${error.stderr}`,
+                reason: "unknown",
+                hint: `Check the PR state and branch protections. The PR may already be merged or closed.${rollbackNote}`,
+                nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+              }),
+            );
+          },
+        ),
+      ),
+    ),
   );
 
   const shaMatch = mergeResult.stdout.match(/([0-9a-f]{7,40})/);

package/src/k8s-tool/index.ts

@@ -219,7 +219,7 @@ const kubectlCommand = Command.make(
     `Kubernetes CLI Tool for Coding Agents
 
 Executes kubectl commands against the correct cluster context.
-Supports shell pipes and complex commands.
+Parses commands into arguments and rejects shell syntax.
 
 IMPORTANT FOR AI AGENTS:
 Always use this tool instead of kubectl directly to ensure
@@ -233,24 +233,25 @@ CLUSTER CONFIGURATION:
 
 WORKFLOW FOR AI AGENTS:
   1. Use this tool for ALL kubectl operations on test/prod
-  2. Pipes are supported - use shell syntax
-  3. Use -n <namespace> for target namespace
+  2. Do not use pipes, chaining, substitution, or shell interpreters
+  3. Use logs-tool for remote log filtering
+  4. Use -n <namespace> for target namespace
 
 EXAMPLES:
   # List pods in test namespace
   bun run src/k8s-tool kubectl --env test --cmd "get pods -n my-app-test"
 
-  # Get pod logs with grep
-  bun run src/k8s-tool kubectl --env test --cmd "logs -l app=web-app -n my-app-test --tail=100 | grep error"
+  # Get pod logs (use logs-tool when filtering is required)
+  bun run src/k8s-tool kubectl --env test --cmd "logs -l app=web-app -n my-app-test --tail=100"
 
   # Check resource usage
   bun run src/k8s-tool kubectl --env test --cmd "top pod -n my-app-test"
 
-  # Describe pod with filtered output
-  bun run src/k8s-tool kubectl --env test --cmd "describe pod web-app-xxx -n my-app-test | grep -A20 Events"
+  # Describe a pod
+  bun run src/k8s-tool kubectl --env test --cmd "describe pod web-app-xxx -n my-app-test"
 
-  # Execute command in pod
-  bun run src/k8s-tool kubectl --env test --cmd "exec web-app-xxx -n my-app-test -- cat /app/logs/app.log | tail -50"
+  # Execute an allowlisted diagnostic in a pod
+  bun run src/k8s-tool kubectl --env test --cmd "exec web-app-xxx -n my-app-test -- redis-cli INFO commandstats"
 
   # Dry run - show command without executing
   bun run src/k8s-tool kubectl --env test --cmd "get pods -n my-app-test" --dry-run
@@ -367,7 +368,7 @@ const execCommand = Command.make(
     ...commonFlags,
     pod: Flag.string("pod").pipe(Flag.withDescription("Pod name")),
     execCmd: Flag.string("exec-cmd").pipe(
-      Flag.withDescription("Command to run inside the pod; wrap in quotes for spaces"),
+      Flag.withDescription("Allowlisted diagnostic: redis-cli PING/INFO or ls"),
     ),
     namespace: Flag.string("namespace").pipe(
       Flag.withDescription("Namespace containing the pod"),
@@ -391,7 +392,7 @@ const execCommand = Command.make(
       ]);
       return yield* runK8sCommand(command, { dryRun, env, format, profile });
     }),
-).pipe(Command.withDescription("Execute a command in a pod (kubectl exec <pod> -- <cmd>)"));
+).pipe(Command.withDescription("Run an allowlisted diagnostic in a pod"));
 
 const topCommand = Command.make(
   "top",

package/src/k8s-tool/security.ts

@@ -1,12 +1,5 @@
-/**
- * K8s Security Module
- *
- * Validates kubectl commands before execution. Only read-only operations
- * are allowed for AI agents. Mutating operations (delete, apply, patch, etc.)
- * are blocked to prevent accidental or unauthorized changes to clusters.
- */
+import { posix } from "node:path";
 
-/** Kubectl verbs that are safe for AI agents (read-only / non-destructive) */
 export const ALLOWED_KUBECTL_VERBS = [
   "get",
   "describe",
@@ -18,14 +11,10 @@ export const ALLOWED_KUBECTL_VERBS = [
   "version",
   "cluster-info",
   "auth",
-  "diff",
   "wait",
   "exec",
-  "port-forward",
   "config",
 ] as const;
-
-/** Kubectl verbs that are explicitly blocked (mutating / destructive) */
 export const BLOCKED_KUBECTL_VERBS = [
   "delete",
   "drain",
@@ -51,51 +40,278 @@ export const BLOCKED_KUBECTL_VERBS = [
 export type K8sSecurityCheckResult = {
   allowed: boolean;
   command: string;
+  argv?: string[];
   reason?: string;
+  hint?: string;
   verb?: string;
 };
 
-/**
- * Checks if a kubectl command is allowed for AI agent execution.
- * Extracts the kubectl verb and validates against allow/block lists.
- *
- * Handles piped commands by checking only the kubectl portion (before first pipe).
- */
-export function isKubectlCommandAllowed(cmd: string): K8sSecurityCheckResult {
-  const trimmed = cmd.trim();
-
-  // Handle piped commands — only validate the kubectl verb (before first |)
-  const kubectlPart = trimmed.split("|")[0].trim();
+export function parseKubectlCommand(cmd: string): string[] | undefined {
+  const argv: string[] = [];
+  let word = "";
+  let quote: "'" | '"' | undefined;
+  let escaped = false;
+  for (const char of cmd) {
+    if (escaped) {
+      word += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\n" || char === "\r") return undefined;
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = undefined;
+      else word += char;
+    } else if (char === "'" || char === '"') quote = char;
+    else if (/[$`;&|<>()[\]]/.test(char)) return undefined;
+    else if (/\s/.test(char)) {
+      if (word) {
+        argv.push(word);
+        word = "";
+      }
+    } else word += char;
+  }
+  if (quote || escaped) return undefined;
+  if (word) argv.push(word);
+  return argv.length ? argv : undefined;
+}
 
-  // Extract verb: first non-flag word
-  const verb = kubectlPart
-    .split(/\s+/)
-    .find((word) => !word.startsWith("-"))
-    ?.toLowerCase();
+const flagsWithValues = new Set([
+  "-n",
+  "--namespace",
+  "-o",
+  "--output",
+  "-l",
+  "--selector",
+  "--field-selector",
+  "-L",
+  "--label-columns",
+  "--chunk-size",
+  "--sort-by",
+  "--subresource",
+  "--template",
+  "--context",
+  "--kubeconfig",
+  "--request-timeout",
+  "-s",
+  "--server",
+  "--as",
+  "--as-group",
+  "--as-uid",
+  "--token",
+  "--certificate-authority",
+  "--cache-dir",
+  "--client-certificate",
+  "--client-key",
+  "--cluster",
+  "--password",
+  "--profile",
+  "--profile-output",
+  "--tls-server-name",
+  "--user",
+  "--username",
+]);
+const controlledFlags = new Set([
+  "-s",
+  "--context",
+  "--kubeconfig",
+  "--server",
+  "--token",
+  "--user",
+  "--username",
+  "--password",
+  "--profile",
+  "--profile-output",
+  "--as",
+  "--as-group",
+  "--as-uid",
+  "--certificate-authority",
+  "--client-certificate",
+  "--client-key",
+  "--cluster",
+  "--tls-server-name",
+  "--insecure-skip-tls-verify",
+  "--insecure-skip-tls-verify-backend",
+]);
+const attachedShortValueFlags = ["-n", "-o", "-l", "-L"] as const;
+const flagsWithoutValues = new Set([
+  "-A",
+  "--all-namespaces",
+  "--allow-missing-template-keys",
+  "--ignore-not-found",
+  "--no-headers",
+  "--output-watch-events",
+  "-R",
+  "--recursive",
+  "--server-print",
+  "--show-events",
+  "--show-kind",
+  "--show-labels",
+  "--show-managed-fields",
+  "--use-openapi-print-columns",
+  "-w",
+  "--watch",
+  "--watch-only",
+]);
+const isSecretResource = (resource: string) =>
+  resource.split(",").some((part) => /^(?:secrets?|secrets?\.[^/]+)(?:\/|$)/i.test(part));
 
-  if (!verb) {
-    return { allowed: false, command: cmd, reason: "Empty kubectl command." };
+function resourceOperand(argv: string[], verbIndex: number): string | null | undefined {
+  let flagsEnded = false;
+  for (let i = verbIndex + 1; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === undefined) return undefined;
+    if (!flagsEnded && arg === "--") {
+      flagsEnded = true;
+      continue;
+    }
+    if (!flagsEnded && arg.startsWith("-")) {
+      const [flag] = arg.split("=", 1);
+      if (flag !== undefined && flagsWithValues.has(flag)) {
+        if (!arg.includes("=")) i++;
+        continue;
+      }
+      if (
+        attachedShortValueFlags.some(
+          (shortFlag) => arg.startsWith(shortFlag) && arg.length > shortFlag.length,
+        )
+      )
+        continue;
+      if (flag !== undefined && flagsWithoutValues.has(flag)) continue;
+      return null;
+    }
+    return arg;
   }
+}
 
-  // Explicit blocklist — clear message about what's blocked and why
-  if ((BLOCKED_KUBECTL_VERBS as readonly string[]).includes(verb)) {
-    return {
-      allowed: false,
-      command: cmd,
-      verb,
-      reason: `'${verb}' is a mutating operation blocked for AI agents. Only read-only operations are allowed: ${ALLOWED_KUBECTL_VERBS.join(", ")}.`,
-    };
-  }
+export function isSafeLogPath(path: string): boolean {
+  const normalizedPath = posix.normalize(path);
+  return (
+    path.startsWith("/") &&
+    !path.split("/").includes("..") &&
+    /^\/(?!proc(?:\/|$)|sys(?:\/|$)|var\/run\/secrets(?:\/|$)).*\.log$/.test(normalizedPath) &&
+    !normalizedPath.toLowerCase().includes("serviceaccount")
+  );
+}
 
-  // Allowlist — unknown verbs are also blocked for safety
-  if (!(ALLOWED_KUBECTL_VERBS as readonly string[]).includes(verb)) {
-    return {
-      allowed: false,
-      command: cmd,
-      verb,
-      reason: `Unknown kubectl verb '${verb}'. Only known read-only operations are allowed: ${ALLOWED_KUBECTL_VERBS.join(", ")}.`,
-    };
-  }
+function execAllowed(argv: string[], separator: number): boolean {
+  const command = argv[separator + 1];
+  const args = argv.slice(separator + 2);
+  if (!command) return false;
+  if (command === "redis-cli")
+    return (
+      (args.length === 1 && args[0] === "PING") ||
+      ((args.length === 1 || args.length === 2) && args[0]?.toUpperCase() === "INFO")
+    );
+  if (command === "ls")
+    return args.every((arg) => arg === "-la" || (arg.startsWith("/") && !arg.includes("..")));
+  return false;
+}
 
-  return { allowed: true, command: cmd, verb };
+export function isKubectlCommandAllowed(cmd: string): K8sSecurityCheckResult {
+  const argv = parseKubectlCommand(cmd);
+  if (!argv)
+    return { allowed: false, command: cmd, reason: "Empty, malformed, or shell syntax command." };
+  let verbIndex = 0;
+  while (argv[verbIndex]?.startsWith("-")) {
+    const flag = argv[verbIndex];
+    if (flag !== undefined && flagsWithValues.has(flag)) verbIndex++;
+    verbIndex++;
+  }
+  const verb = argv[verbIndex]?.toLowerCase();
+  if (!verb) return { allowed: false, command: cmd, reason: "Empty kubectl command." };
+  const denied = (reason: string, hint?: string): K8sSecurityCheckResult => ({
+    allowed: false,
+    command: cmd,
+    verb,
+    reason,
+    hint,
+  });
+  if ((BLOCKED_KUBECTL_VERBS as readonly string[]).includes(verb))
+    return denied(
+      `'${verb}' is a mutating operation blocked for AI agents. Only read-only operations are allowed: ${ALLOWED_KUBECTL_VERBS.join(", ")}.`,
+    );
+  if (!(ALLOWED_KUBECTL_VERBS as readonly string[]).includes(verb))
+    return denied(
+      `Unknown kubectl verb '${verb}'. Only known read-only operations are allowed: ${ALLOWED_KUBECTL_VERBS.join(", ")}.`,
+    );
+  const controlledFlag = argv.find((arg) => {
+    const flag = arg.split("=", 1)[0] ?? "";
+    return controlledFlags.has(flag) || (arg.startsWith("-s") && !arg.startsWith("--"));
+  });
+  if (controlledFlag !== undefined)
+    return denied(
+      `Cluster, authentication, and impersonation flag '${controlledFlag}' is controlled by the selected profile.`,
+      "Remove the override and select the intended Kubernetes profile instead.",
+    );
+  const subcommand = argv[verbIndex + 1]?.toLowerCase();
+  if (
+    verb === "config" &&
+    (subcommand === undefined || !["view", "get-contexts", "current-context"].includes(subcommand))
+  )
+    return denied(
+      "Only read-only kubectl config subcommands are allowed.",
+      "Use config view, config get-contexts, or config current-context.",
+    );
+  if (verb === "auth" && !["can-i", "whoami"].includes(subcommand ?? ""))
+    return denied(
+      "Only read-only kubectl auth subcommands are allowed.",
+      "Use auth can-i or auth whoami.",
+    );
+  if (verb === "cluster-info" && subcommand === "dump")
+    return denied(
+      "cluster-info dump is blocked because it may expose sensitive diagnostic data.",
+      "Use cluster-info without dump.",
+    );
+  const resource = resourceOperand(argv, verbIndex);
+  const hasSensitiveInputFlag = argv.some(
+    (arg) =>
+      arg === "-f" ||
+      arg.startsWith("-f") ||
+      arg === "--filename" ||
+      arg === "-k" ||
+      arg.startsWith("-k") ||
+      arg === "--kustomize" ||
+      /^(?:--filename|--kustomize)=/.test(arg) ||
+      /^--raw(?:=|$)/.test(arg),
+  );
+  if ((verb === "get" || verb === "describe") && hasSensitiveInputFlag)
+    return denied(
+      "Kubernetes Secret reads and file-based reads are blocked because they may expose credentials.",
+      "Use a targeted non-secret resource diagnostic instead.",
+    );
+  if ((verb === "get" || verb === "describe") && resource === null)
+    return denied(
+      "Unsupported flag before the resource operand.",
+      "Use a documented get/describe flag or place the resource first.",
+    );
+  const hasNamedSecretResource = argv
+    .slice(verbIndex + 1)
+    .some((arg) => arg.includes("/") && isSecretResource(arg));
+  if (
+    (verb === "get" || verb === "describe") &&
+    ((resource !== undefined && resource !== null && isSecretResource(resource)) ||
+      hasNamedSecretResource)
+  )
+    return denied(
+      "Kubernetes Secret reads and file-based reads are blocked because they may expose credentials.",
+      "Use a targeted non-secret resource diagnostic instead.",
+    );
+  if (verb === "config" && argv.includes("view") && argv.some((arg) => /^--raw(?:=|$)/.test(arg)))
+    return denied(
+      "Raw kubeconfig output is blocked because it may expose credentials.",
+      "Use 'config view' without --raw.",
+    );
+  if (verb === "exec") {
+    const separator = argv.indexOf("--", verbIndex + 1);
+    if (separator < 0 || !execAllowed(argv, separator))
+      return denied(
+        "Only narrow diagnostic commands are allowed in pods.",
+        "Use redis-cli PING/INFO or ls. Use logs-tool to read log files.",
+      );
+  }
+  return { allowed: true, command: cmd, argv, verb };
 }

package/src/k8s-tool/service.ts

@@ -1,3 +1,5 @@
+import { posix } from "node:path";
+
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { Context, Effect, Layer, Option, Ref, Stream } from "effect";
 
@@ -16,7 +18,7 @@ import { resolveEnvTemplate } from "#shared/env-template";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
-import { isKubectlCommandAllowed } from "./security";
+import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -37,6 +39,16 @@ export class K8sService extends Context.Service<
       CommandResult,
       K8sContextError | K8sCommandError | K8sTimeoutError | K8sDangerousCommandError
     >;
+    readonly runLogTail: (
+      pod: string,
+      basePath: string,
+      path: string,
+      lines: number,
+      profile?: string,
+    ) => Effect.Effect<
+      CommandResult,
+      K8sContextError | K8sCommandError | K8sTimeoutError | K8sDangerousCommandError
+    >;
   }
 >()("@agent-tools/K8sService") {
   static readonly layer = Layer.effect(
@@ -86,6 +98,10 @@ export class K8sService extends Context.Service<
 
         const withKubeconfig = (command: string, kubeconfig: string | undefined) =>
           kubeconfig ? `KUBECONFIG=${quoteShellArg(kubeconfig)} ${command}` : command;
+        const renderArg = (arg: string) =>
+          /^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg);
+        const renderKubectlCommand = (context: string, argv: readonly string[]) =>
+          ["kubectl", "--context", context, ...argv].map(renderArg).join(" ");
 
         // Cache context by selected profile/cluster instead of a single default profile.
         const contextRef = yield* Ref.make<Record<string, string>>({});
@@ -253,7 +269,7 @@ export class K8sService extends Context.Service<
         });
 
         const executeCommand = Effect.fn("K8sService.executeCommand")(function* (
-          cmd: string,
+          argv: readonly string[],
           profile?: string,
         ) {
           const k8sConfig = yield* requireK8sConfig(profile);
@@ -275,9 +291,29 @@ export class K8sService extends Context.Service<
                 });
               }
 
-              const fullCommand = withKubeconfig(`kubectl --context ${context} ${cmd}`, kubeconfig);
-
-              const resultOption = yield* runShellCommand(fullCommand, timeoutMs);
+              const fullCommand = renderKubectlCommand(context, argv);
+              const command = ChildProcess.make("kubectl", ["--context", context, ...argv], {
+                stdout: "pipe",
+                stderr: "pipe",
+                ...(kubeconfig ? { env: { KUBECONFIG: kubeconfig }, extendEnv: true } : {}),
+              });
+              const resultOption = yield* Effect.scoped(
+                Effect.gen(function* () {
+                  const process = yield* executor.spawn(command);
+                  return yield* collectProcessOutput(process);
+                }),
+              ).pipe(
+                Effect.timeoutOption(timeoutMs),
+                Effect.mapError(
+                  (platformError) =>
+                    new K8sCommandError({
+                      message: `Command execution failed: ${String(platformError)}`,
+                      command: fullCommand,
+                      exitCode: -1,
+                      stderr: undefined,
+                    }),
+                ),
+              );
 
               if (Option.isNone(resultOption)) {
                 return yield* new K8sTimeoutError({
@@ -316,16 +352,18 @@ export class K8sService extends Context.Service<
         ) {
           // Security: block dangerous commands before execution
           const securityCheck = isKubectlCommandAllowed(cmd);
-          if (!securityCheck.allowed) {
+          if (!securityCheck.allowed || !securityCheck.argv) {
             return yield* new K8sDangerousCommandError({
               message: securityCheck.reason ?? "Command not allowed",
               command: cmd,
-              verb: securityCheck.verb,
-              hint: "AI agents can only run read-only kubectl commands. For mutating operations, use kubectl directly or ask a human operator.",
+              ...(securityCheck.verb ? { verb: securityCheck.verb } : {}),
+              hint:
+                securityCheck.hint ??
+                "AI agents can only run read-only kubectl commands. For mutating operations, use kubectl directly or ask a human operator.",
             });
           }
 
-          const result = yield* executeCommand(cmd, profile);
+          const result = yield* executeCommand(securityCheck.argv, profile);
           if (result.exitCode !== 0) {
             return yield* new K8sCommandError({
               message: result.stderr ?? `kubectl exited with code ${result.exitCode}`,
@@ -345,20 +383,22 @@ export class K8sService extends Context.Service<
         ) {
           // Security: block dangerous commands before execution (even dry-run)
           const securityCheck = isKubectlCommandAllowed(cmd);
-          if (!securityCheck.allowed) {
+          if (!securityCheck.allowed || !securityCheck.argv) {
             return yield* new K8sDangerousCommandError({
               message: securityCheck.reason ?? "Command not allowed",
               command: cmd,
-              verb: securityCheck.verb,
-              hint: "AI agents can only run read-only kubectl commands. For mutating operations, use kubectl directly or ask a human operator.",
+              ...(securityCheck.verb ? { verb: securityCheck.verb } : {}),
+              hint:
+                securityCheck.hint ??
+                "AI agents can only run read-only kubectl commands. For mutating operations, use kubectl directly or ask a human operator.",
             });
           }
 
           const startTime = Date.now();
           if (dryRun) {
             const k8sConfig = yield* requireK8sConfig(profile);
-            const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
-            const fullCommand = withKubeconfig(`kubectl --context ${context} ${cmd}`, kubeconfig);
+            const { context } = yield* resolveContext(profile, k8sConfig);
+            const fullCommand = renderKubectlCommand(context, securityCheck.argv);
             return {
               success: true,
               command: fullCommand,
@@ -367,8 +407,88 @@ export class K8sService extends Context.Service<
             };
           }
 
-          const result = yield* executeCommand(cmd, profile);
+          const result = yield* executeCommand(securityCheck.argv, profile);
+
+          if (result.exitCode !== 0) {
+            return yield* new K8sCommandError({
+              message: result.stderr ?? `kubectl exited with code ${result.exitCode}`,
+              command: result.command,
+              exitCode: result.exitCode,
+              stderr: result.stderr ?? undefined,
+            });
+          }
+
+          return {
+            success: true,
+            output: result.stdout.trim(),
+            command: result.command,
+            executionTimeMs: Date.now() - startTime,
+          };
+        });
+
+        const runLogTail = Effect.fn("K8sService.runLogTail")(function* (
+          pod: string,
+          basePath: string,
+          path: string,
+          lines: number,
+          profile?: string,
+        ) {
+          const normalizedBase = posix.resolve(basePath);
+          const normalizedPath = posix.resolve(path);
+          const lexicalRelative = posix.relative(normalizedBase, normalizedPath);
+          if (
+            !/^[a-z0-9](?:[-a-z0-9.]*[a-z0-9])?$/.test(pod) ||
+            !Number.isInteger(lines) ||
+            lines < 1 ||
+            lexicalRelative === ".." ||
+            lexicalRelative.startsWith("../") ||
+            posix.isAbsolute(lexicalRelative) ||
+            !isSafeLogPath(normalizedPath)
+          ) {
+            return yield* new K8sDangerousCommandError({
+              message: "Invalid internal log-tail request.",
+              command: "exec tail",
+              verb: "exec",
+              hint: "Use logs-tool with a log file inside its configured remote directory.",
+            });
+          }
+
+          const realpathArgv = ["exec", pod, "--", "realpath", normalizedBase, normalizedPath];
+          const realpathResult = yield* executeCommand(realpathArgv, profile);
+          if (realpathResult.exitCode !== 0) {
+            return yield* new K8sCommandError({
+              message:
+                realpathResult.stderr ||
+                `Remote realpath exited with code ${realpathResult.exitCode}`,
+              command: realpathResult.command,
+              exitCode: realpathResult.exitCode,
+              stderr: realpathResult.stderr || undefined,
+            });
+          }
+          const [canonicalBase, canonicalPath] = realpathResult.stdout.trim().split("\n");
+          const canonicalRelative =
+            canonicalBase === undefined || canonicalPath === undefined
+              ? ".."
+              : posix.relative(canonicalBase, canonicalPath);
+          if (
+            canonicalBase === undefined ||
+            canonicalPath === undefined ||
+            canonicalRelative === ".." ||
+            canonicalRelative.startsWith("../") ||
+            posix.isAbsolute(canonicalRelative) ||
+            !isSafeLogPath(canonicalPath)
+          ) {
+            return yield* new K8sDangerousCommandError({
+              message: "Canonical log path escapes the configured remote directory.",
+              command: realpathResult.command,
+              verb: "exec",
+              hint: "Remove symlinks that point outside the configured remote log directory.",
+            });
+          }
 
+          const argv = ["exec", pod, "--", "tail", "-n", String(lines), canonicalPath];
+          const startTime = Date.now();
+          const result = yield* executeCommand(argv, profile);
           if (result.exitCode !== 0) {
             return yield* new K8sCommandError({
               message: result.stderr ?? `kubectl exited with code ${result.exitCode}`,
@@ -386,7 +506,7 @@ export class K8sService extends Context.Service<
           };
         });
 
-        return { runCommand, runKubectl };
+        return { runCommand, runKubectl, runLogTail };
       }),
     ),
   );

package/src/logs-tool/index.ts

@@ -158,7 +158,7 @@ const readCommand = Command.make(
     ),
     format: formatOption,
     grep: Flag.string("grep").pipe(
-      Flag.withDescription("Filter lines containing pattern"),
+      Flag.withDescription("Filter lines containing case-insensitive literal text"),
       Flag.optional,
     ),
     pretty: Flag.boolean("pretty").pipe(

package/src/logs-tool/service.ts

@@ -1,13 +1,15 @@
+import { isAbsolute, posix, relative, resolve } from "node:path";
+
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Context, Effect, Layer, Result, Stream } from "effect";
+import { Context, Effect, Layer, Result } from "effect";
 
 import type { Environment, LogFile, ReadOptions } from "./types";
 
-import { K8sCommandError } from "#k8s/errors";
 import { K8sService, K8sServiceLayer } from "#k8s/service";
 import { ConfigService, ConfigServiceLayer, getToolConfig } from "#config/loader";
 import type { LogsConfig } from "#config/types";
 import { LogsNotFoundError, LogsReadError, type LogsError } from "./errors";
+import { collectProcessOutput } from "#shared/exec";
 import { transformLogOutput } from "./transformers";
 
 export const parseLogFiles = (output: string): LogFile[] => {
@@ -46,6 +48,33 @@ export const formatPrettyOutput = (output: string): string => {
 export const sanitizeShellArg = (input: string): string => `'${input.replace(/'/g, "'\\''")}'`;
 
 const readCommandOutput = (output: unknown): string => (typeof output === "string" ? output : "");
+const filterLogLines = (output: string, grep: string | undefined): string => {
+  if (!grep) return output;
+  const needle = grep.toLowerCase();
+  return output
+    .split("\n")
+    .filter((line) => line.toLowerCase().includes(needle))
+    .join("\n");
+};
+const resolveLocalLogPath = (base: string, file: string): string | undefined => {
+  const resolvedBase = resolve(base);
+  const resolvedPath = resolve(resolvedBase, file);
+  const relativePath = relative(resolvedBase, resolvedPath);
+  return relativePath === ".." ||
+    relativePath.startsWith(`..${pathSeparator}`) ||
+    isAbsolute(relativePath)
+    ? undefined
+    : resolvedPath;
+};
+const pathSeparator = process.platform === "win32" ? "\\" : "/";
+const resolveRemoteLogPath = (base: string, file: string): string | undefined => {
+  const resolvedBase = posix.resolve(base);
+  const resolvedPath = posix.resolve(resolvedBase, file);
+  const relativePath = posix.relative(resolvedBase, resolvedPath);
+  return relativePath === ".." || relativePath.startsWith("../") || posix.isAbsolute(relativePath)
+    ? undefined
+    : resolvedPath;
+};
 
 export class LogsService extends Context.Service<
   LogsService,
@@ -73,15 +102,7 @@ export class LogsService extends Context.Service<
               stderr: "pipe",
             });
             const process = yield* executor.spawn(command);
-
-            const stdoutChunk = yield* process.stdout.pipe(Stream.decodeText(), Stream.runCollect);
-            const stderrChunk = yield* process.stderr.pipe(Stream.decodeText(), Stream.runCollect);
-
-            const stdout = stdoutChunk.join("");
-            const stderr = stderrChunk.join("");
-            const exitCode = yield* process.exitCode;
-
-            return { stdout, stderr, exitCode };
+            return yield* collectProcessOutput(process);
           }),
         ).pipe(
           Effect.catch((platformError) =>
@@ -93,6 +114,22 @@ export class LogsService extends Context.Service<
           ),
         );
 
+      const runDirectCommand = (executable: string, args: readonly string[]) =>
+        Effect.scoped(
+          Effect.gen(function* () {
+            const command = ChildProcess.make(executable, args, {
+              stdout: "pipe",
+              stderr: "pipe",
+            });
+            const process = yield* executor.spawn(command);
+            return yield* collectProcessOutput(process);
+          }),
+        ).pipe(
+          Effect.catch((platformError) =>
+            Effect.succeed({ stdout: "", stderr: String(platformError), exitCode: -1 }),
+          ),
+        );
+
       const getLogsConfig = (profile?: string): LogsConfig | undefined =>
         getToolConfig<LogsConfig>(config, "logs", profile);
 
@@ -196,27 +233,45 @@ export class LogsService extends Context.Service<
           logFile = latestPath.split("/").pop() ?? latestPath;
         }
 
-        const fullPath = `${localDir}/${logFile}`;
-        let command = `tail -${options.tail} ${sanitizeShellArg(fullPath)}`;
-
-        if (options.grep) {
-          command += ` | grep -i ${sanitizeShellArg(options.grep)}`;
+        const lexicalPath = resolveLocalLogPath(localDir, logFile);
+        if (lexicalPath === undefined) {
+          return yield* new LogsReadError({
+            message: "Log file must stay within the configured local log directory.",
+            source: localDir,
+          });
         }
-
+        const realpathResult = yield* runDirectCommand("realpath", [localDir, lexicalPath]);
+        if (realpathResult.exitCode !== 0) {
+          return yield* new LogsReadError({
+            message:
+              realpathResult.stderr.trim() ||
+              `realpath failed with exit code ${realpathResult.exitCode}`,
+            source: lexicalPath,
+          });
+        }
+        const [canonicalBase, canonicalPath] = realpathResult.stdout.trim().split("\n");
+        if (
+          canonicalBase === undefined ||
+          canonicalPath === undefined ||
+          resolveLocalLogPath(canonicalBase, canonicalPath) !== canonicalPath ||
+          !canonicalPath.endsWith(".log")
+        ) {
+          return yield* new LogsReadError({
+            message: "Canonical log path escapes the configured local log directory.",
+            source: localDir,
+          });
+        }
+        const command = `tail -${options.tail} ${sanitizeShellArg(canonicalPath)}`;
         const result = yield* runShellCommand(command);
 
-        if (result.exitCode !== 0 && result.exitCode !== 1) {
+        if (result.exitCode !== 0) {
           return yield* new LogsReadError({
             message: result.stderr.trim() || `Command failed with exit code ${result.exitCode}`,
-            source: fullPath,
+            source: canonicalPath,
           });
         }
 
-        if (result.exitCode === 1 && options.grep) {
-          return "(no matching lines)";
-        }
-
-        const output = result.stdout.trim();
+        const output = filterLogLines(result.stdout, options.grep).trim();
         if (!output) {
           return "(no matching lines)";
         }
@@ -231,6 +286,14 @@ export class LogsService extends Context.Service<
       ) {
         const remotePath = logsConfig.remotePath;
         const kubernetesProfile = logsConfig.kubernetesProfile;
+        const logFile = options.file ?? "app.log";
+        const logPath = resolveRemoteLogPath(remotePath, logFile);
+        if (logPath === undefined) {
+          return yield* new LogsReadError({
+            message: "Log file must stay within the configured remote log directory.",
+            source: remotePath,
+          });
+        }
 
         const podResult = yield* k8s
           .runKubectl(
@@ -249,38 +312,22 @@ export class LogsService extends Context.Service<
           );
 
         const pod = readCommandOutput(podResult.output).replace(/'/g, "");
-        const logFile = options.file ?? "app.log";
-        const logPath = `${remotePath}/${logFile}`;
-        let command = `tail -${options.tail} ${sanitizeShellArg(logPath)}`;
-
-        if (options.grep) {
-          command += ` | grep -i ${sanitizeShellArg(options.grep)}`;
-        }
-
         const execResult = yield* k8s
-          .runKubectl(`exec ${pod} -- sh -c "${command}"`, false, kubernetesProfile)
+          .runLogTail(pod, remotePath, logPath, options.tail, kubernetesProfile)
           .pipe(Effect.result);
 
         return yield* Result.match(execResult, {
-          onFailure: (error) => {
-            if (error instanceof K8sCommandError && error.exitCode === 1 && options.grep) {
-              return Effect.succeed("(no matching lines)");
-            }
-
-            return Effect.fail(
+          onFailure: (error) =>
+            Effect.fail(
               new LogsReadError({
                 message: error instanceof Error ? error.message : "Failed to read remote logs",
                 source: `${pod}:${logPath}`,
               }),
-            );
-          },
+            ),
           onSuccess: (result) => {
-            const trimmed = readCommandOutput(result.output).trim();
-            if (!trimmed) {
-              return Effect.succeed("(no matching lines)");
-            }
-
-            return Effect.succeed(transformLogOutput(trimmed));
+            const output = readCommandOutput(result.output);
+            const trimmed = filterLogLines(output, options.grep).trim();
+            return Effect.succeed(trimmed ? transformLogOutput(trimmed) : "(no matching lines)");
           },
         });
       });