@blogic-cz/agent-tools 1.10.1 → 1.12.0

package/src/credential-guard/review4.test.ts

@@ -0,0 +1,83 @@
+import { expect, it } from "vitest";
+import { createCredentialGuard } from "./index";
+
+it.each(["unknown-type"])("rejects unknown Grep type %s", (type) => {
+  const guard = createCredentialGuard();
+  expect(() =>
+    guard.handleToolExecuteBefore(
+      { tool: "Grep" },
+      { args: { pattern: "FAKE", type, output_mode: "content" } },
+    ),
+  ).toThrow();
+});
+it.each(["ts", "js", "sh", "zsh", "json", "py", "md", "yaml"])(
+  "accepts Grep type filter %s",
+  (type) => {
+    const guard = createCredentialGuard();
+    expect(() =>
+      guard.handleToolExecuteBefore(
+        { tool: "Grep" },
+        { args: { pattern: "FAKE", type, output_mode: "content" } },
+      ),
+    ).not.toThrow();
+  },
+);
+it.each([
+  "gh pr view --zz-undeclared -R example/repo",
+  "rtk gain --zz-undeclared",
+  "rtk read --zz-undeclared README.md",
+  "find . --zz-undeclared",
+])("accepts harmless undeclared special-command options: %s", (command) => {
+  const guard = createCredentialGuard();
+  expect(() =>
+    guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+  ).not.toThrow();
+});
+
+it.each([
+  "git grep text -- '*.ts' ':!*.json'",
+  "git grep text -- '*.cs' ':(exclude,glob)*Tests*'",
+  "git grep text -- '*.ts' ':^secrets'",
+  "rg --files -t sh",
+])("accepts exclusions and file listings: %s", (command) => {
+  const guard = createCredentialGuard();
+  expect(() =>
+    guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+  ).not.toThrow();
+});
+it.each([
+  "git fetch origin main --u=printenv",
+  "git --zz=.env",
+  "git diff --unified .env ordinary.ts",
+])("refuses ambiguous or undeclared option forms: %s", (command) => {
+  const guard = createCredentialGuard();
+  expect(() => guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } })).toThrow();
+});
+
+it("checks a qualified environment provider in an attached path parameter", () => {
+  const guard = createCredentialGuard();
+  expect(() =>
+    guard.handleToolExecuteBefore(
+      { tool: "PowerShell" },
+      { args: { command: "Get-ChildItem -Path:'Microsoft.PowerShell.Core\\Environment::'" } },
+    ),
+  ).toThrow();
+});
+it.each(["nodejs", "pypy", "pypy3", "luajit", "lua5.4", "ipython", "ipython3", "bpython"])(
+  "refuses code stdin to %s",
+  (name) => {
+    const guard = createCredentialGuard();
+    expect(() =>
+      guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command: name + " <<< 'x'" } }),
+    ).toThrow();
+  },
+);
+
+it.each(["git grep -hoE pattern -- '*.cs'", "npm run check env"])(
+  "accepts safe data and reader flags: %s",
+  (command) => {
+    expect(() =>
+      createCredentialGuard({}).handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+    ).not.toThrow();
+  },
+);

package/src/credential-guard/review7.test.ts

@@ -0,0 +1,51 @@
+import { expect, it } from "vitest";
+import { createCredentialGuard } from "./index";
+
+it("checks code flags throughout short-option clusters in unknown operands", () => {
+  const guard = createCredentialGuard();
+  for (const prefix of ["unknown-cli", "pnpm exec", "cargo unknown-sub"]) {
+    for (const invocation of [
+      "bash -lc 'env | head'",
+      "bash -ec 'env | head'",
+      "sh -xc 'env | head'",
+      "python3 -Ic 'import os;print(os.environ)'",
+      "python3 -uc 'import os;print(os.environ)'",
+      "python -Ec 'import os;print(os.environ)'",
+      "python3 -Iuc'import os;print(os.environ)'",
+      "perl -we 'print %ENV'",
+      "ruby -we 'p ENV'",
+      "node -pe 'process.env'",
+    ]) {
+      const command = `${prefix} ${invocation}`;
+      expect(() =>
+        guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+      ).toThrow();
+    }
+    for (const invocation of [
+      "python3 -Wc script.py",
+      "ruby -Icode script.rb",
+      "perl -Iexample script.pl",
+    ]) {
+      const command = `${prefix} ${invocation}`;
+      expect(() =>
+        guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+      ).not.toThrow();
+    }
+  }
+});
+
+it("analyzes awk program operands under unknown commands", () => {
+  const guard = createCredentialGuard();
+  for (const prefix of ["unknown-cli", "pnpm exec", "git unknown-sub"]) {
+    for (const flags of ["", "-F:", "-F :", "-v key=1", "-vkey=1", "--", "-e", "--source="]) {
+      const command = `${prefix} awk ${flags}${flags.endsWith("=") ? "" : " "}'BEGIN{print ENVIRON["FAKE_TOKEN"]}'`;
+      expect(() =>
+        guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+      ).toThrow();
+    }
+    const command = `${prefix} awk -F: -v key=1 '{print $1}' input.txt`;
+    expect(() =>
+      guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+    ).not.toThrow();
+  }
+});

package/src/credential-guard/rg-types.json

@@ -0,0 +1,389 @@
+{
+  "ada": ["*.adb", "*.ads"],
+  "agda": ["*.agda", "*.lagda"],
+  "aidl": ["*.aidl"],
+  "alire": ["alire.toml"],
+  "amake": ["*.bp", "*.mk"],
+  "asciidoc": ["*.adoc", "*.asc", "*.asciidoc"],
+  "asm": ["*.S", "*.asm", "*.s"],
+  "asp": ["*.ascx", "*.ascx.cs", "*.ascx.vb", "*.asp", "*.aspx", "*.aspx.cs", "*.aspx.vb"],
+  "ats": ["*.ats", "*.dats", "*.hats", "*.sats"],
+  "avro": ["*.avdl", "*.avpr", "*.avsc"],
+  "awk": ["*.awk"],
+  "bat": ["*.bat"],
+  "batch": ["*.bat"],
+  "bazel": [
+    "*.BUILD",
+    "*.bazel",
+    "*.bazelrc",
+    "*.bzl",
+    "BUILD",
+    "MODULE.bazel",
+    "WORKSPACE",
+    "WORKSPACE.bazel",
+    "WORKSPACE.bzlmod"
+  ],
+  "bitbake": ["*.bb", "*.bbappend", "*.bbclass", "*.conf", "*.inc"],
+  "boxlang": ["*.bx", "*.bxm", "*.bxs"],
+  "brotli": ["*.br"],
+  "buildstream": ["*.bst"],
+  "bzip2": ["*.bz2", "*.tbz2"],
+  "c": ["*.[chH]", "*.[chH].in", "*.cats"],
+  "cabal": ["*.cabal"],
+  "candid": ["*.did"],
+  "carp": ["*.carp"],
+  "cbor": ["*.cbor"],
+  "ceylon": ["*.ceylon"],
+  "cfml": ["*.cfc", "*.cfm"],
+  "clojure": ["*.clj", "*.cljc", "*.cljs", "*.cljx"],
+  "cmake": ["*.cmake", "CMakeLists.txt"],
+  "cmd": ["*.bat", "*.cmd"],
+  "cml": ["*.cml"],
+  "coffeescript": ["*.coffee"],
+  "config": ["*.cfg", "*.conf", "*.config", "*.ini"],
+  "container": ["*Containerfile*", "*Dockerfile*"],
+  "coq": ["*.v"],
+  "cpp": [
+    "*.[ChH]",
+    "*.[ChH].in",
+    "*.[ch]pp",
+    "*.[ch]pp.in",
+    "*.[ch]xx",
+    "*.[ch]xx.in",
+    "*.cc",
+    "*.cc.in",
+    "*.hh",
+    "*.hh.in",
+    "*.inl"
+  ],
+  "creole": ["*.creole"],
+  "crystal": ["*.cr", "*.ecr", "Projectfile", "shard.yml"],
+  "cs": ["*.cs"],
+  "csharp": ["*.cs"],
+  "cshtml": ["*.cshtml"],
+  "csproj": ["*.csproj"],
+  "css": ["*.css", "*.scss"],
+  "csv": ["*.csv"],
+  "cuda": ["*.cu", "*.cuh"],
+  "cython": ["*.pxd", "*.pxi", "*.pyx"],
+  "d": ["*.d"],
+  "dart": ["*.dart"],
+  "devicetree": ["*.dts", "*.dtsi", "*.dtso"],
+  "dhall": ["*.dhall"],
+  "diff": ["*.diff", "*.patch"],
+  "dita": ["*.dita", "*.ditamap", "*.ditaval"],
+  "docker": ["*Dockerfile*"],
+  "dockercompose": ["docker-compose.*.yml", "docker-compose.yml"],
+  "dts": ["*.dts", "*.dtsi"],
+  "dvc": ["*.dvc", "Dvcfile"],
+  "ebuild": ["*.ebuild", "*.eclass"],
+  "edn": ["*.edn"],
+  "elisp": ["*.el"],
+  "elixir": ["*.eex", "*.ex", "*.exs", "*.heex", "*.leex", "*.livemd"],
+  "elm": ["*.elm"],
+  "erb": ["*.erb"],
+  "erlang": ["*.erl", "*.hrl"],
+  "fennel": ["*.fnl"],
+  "fidl": ["*.fidl"],
+  "fish": ["*.fish"],
+  "flatbuffers": ["*.fbs"],
+  "fortran": ["*.F", "*.F77", "*.F90", "*.F95", "*.f", "*.f77", "*.f90", "*.f95", "*.pfo"],
+  "fsharp": ["*.fs", "*.fsi", "*.fsx"],
+  "fut": ["*.fut"],
+  "gap": ["*.g", "*.gap", "*.gd", "*.gi", "*.tst"],
+  "gdscript": ["*.gd"],
+  "gleam": ["*.gleam"],
+  "gn": ["*.gn", "*.gni"],
+  "go": ["*.go"],
+  "gprbuild": ["*.gpr"],
+  "gradle": [
+    "*.gradle",
+    "*.gradle.kts",
+    "gradle-wrapper.*",
+    "gradle.properties",
+    "gradlew",
+    "gradlew.bat"
+  ],
+  "graphql": ["*.graphql", "*.graphqls"],
+  "groovy": ["*.gradle", "*.groovy"],
+  "gzip": ["*.gz", "*.tgz"],
+  "h": ["*.h", "*.hh", "*.hpp"],
+  "haml": ["*.haml"],
+  "hare": ["*.ha"],
+  "haskell": ["*.c2hs", "*.cpphs", "*.hs", "*.hsc", "*.lhs"],
+  "hbs": ["*.hbs"],
+  "hs": ["*.hs", "*.lhs"],
+  "html": ["*.ejs", "*.htm", "*.html"],
+  "hurl": ["*.hurl"],
+  "hy": ["*.hy"],
+  "idris": ["*.idr", "*.lidr"],
+  "janet": ["*.janet"],
+  "java": ["*.java", "*.jsp", "*.jspx", "*.properties"],
+  "jinja": ["*.j2", "*.jinja", "*.jinja2"],
+  "jl": ["*.jl"],
+  "js": ["*.cjs", "*.js", "*.jsx", "*.mjs", "*.vue"],
+  "json": ["*.json", "*.sarif", "composer.lock"],
+  "jsonl": ["*.jsonl"],
+  "julia": ["*.jl"],
+  "jupyter": ["*.ipynb", "*.jpynb"],
+  "k": ["*.k"],
+  "kconfig": ["Kconfig", "Kconfig.*"],
+  "kotlin": ["*.kt", "*.kts"],
+  "lean": ["*.lean"],
+  "less": ["*.less"],
+  "license": [
+    "*[.-]LICEN[CS]E*",
+    "AGPL-*[0-9]*",
+    "APACHE-*[0-9]*",
+    "BSD-*[0-9]*",
+    "CC-BY-*",
+    "COPYING",
+    "COPYING[.-]*",
+    "COPYRIGHT",
+    "COPYRIGHT[.-]*",
+    "EULA",
+    "EULA[.-]*",
+    "GFDL-*[0-9]*",
+    "GNU-*[0-9]*",
+    "GPL-*[0-9]*",
+    "LGPL-*[0-9]*",
+    "LICEN[CS]E",
+    "LICEN[CS]E[.-]*",
+    "MIT-*[0-9]*",
+    "MPL-*[0-9]*",
+    "NOTICE",
+    "NOTICE[.-]*",
+    "OFL-*[0-9]*",
+    "PATENTS",
+    "PATENTS[.-]*",
+    "UNLICEN[CS]E",
+    "UNLICEN[CS]E[.-]*",
+    "agpl[.-]*",
+    "gpl[.-]*",
+    "lgpl[.-]*",
+    "licen[cs]e",
+    "licen[cs]e.*"
+  ],
+  "lilypond": ["*.ily", "*.ly"],
+  "lisp": ["*.el", "*.jl", "*.lisp", "*.lsp", "*.sc", "*.scm"],
+  "llvm": ["*.ll"],
+  "lock": ["*.lock", "package-lock.json"],
+  "log": ["*.log"],
+  "lua": ["*.lua"],
+  "lz4": ["*.lz4"],
+  "lzma": ["*.lzma"],
+  "m4": ["*.ac", "*.m4"],
+  "make": [
+    "*.mak",
+    "*.mk",
+    "Makefile.*",
+    "[Gg][Nn][Uu]makefile",
+    "[Gg][Nn][Uu]makefile.am",
+    "[Gg][Nn][Uu]makefile.in",
+    "[Mm]akefile",
+    "[Mm]akefile.am",
+    "[Mm]akefile.in"
+  ],
+  "mako": ["*.mako", "*.mao"],
+  "man": ["*.[0-9][cEFMmpSx]", "*.[0-9lnpx]"],
+  "markdown": ["*.markdown", "*.md", "*.mdown", "*.mdwn", "*.mdx", "*.mkd", "*.mkdn"],
+  "matlab": ["*.m"],
+  "md": ["*.markdown", "*.md", "*.mdown", "*.mdwn", "*.mdx", "*.mkd", "*.mkdn"],
+  "meson": ["meson.build", "meson.options", "meson_options.txt"],
+  "minified": ["*.min.css", "*.min.html", "*.min.js"],
+  "mint": ["*.mint"],
+  "mk": ["mkfile"],
+  "ml": ["*.ml"],
+  "mojo": ["*.mojo"],
+  "motoko": ["*.mo"],
+  "msbuild": [
+    "*.csproj",
+    "*.fsproj",
+    "*.proj",
+    "*.props",
+    "*.sln",
+    "*.slnf",
+    "*.targets",
+    "*.vcxproj"
+  ],
+  "nim": ["*.nim", "*.nimble", "*.nimf", "*.nims"],
+  "nix": ["*.nix"],
+  "objc": ["*.h", "*.m"],
+  "objcpp": ["*.h", "*.mm"],
+  "ocaml": ["*.ml", "*.mli", "*.mll", "*.mly"],
+  "org": ["*.org", "*.org_archive"],
+  "pants": ["BUILD"],
+  "pascal": ["*.dpr", "*.inc", "*.lpr", "*.pas", "*.pp"],
+  "pdf": ["*.pdf"],
+  "perl": ["*.PL", "*.perl", "*.pl", "*.plh", "*.plx", "*.pm", "*.t"],
+  "php": ["*.php", "*.php3", "*.php4", "*.php5", "*.php7", "*.php8", "*.pht", "*.phtml"],
+  "pkgbuild": ["PKGBUILD"],
+  "po": ["*.po"],
+  "pod": ["*.pod"],
+  "postscript": ["*.eps", "*.ps"],
+  "prolog": ["*.P", "*.pl", "*.pro", "*.prolog"],
+  "proto": ["*.proto"],
+  "protobuf": ["*.proto"],
+  "ps": ["*.cdxml", "*.ps1", "*.ps1xml", "*.psd1", "*.psm1"],
+  "puppet": ["*.epp", "*.erb", "*.pp", "*.rb"],
+  "purs": ["*.purs"],
+  "py": ["*.py", "*.pyi"],
+  "python": ["*.py", "*.pyi"],
+  "qmake": ["*.prf", "*.pri", "*.pro"],
+  "qml": ["*.qml"],
+  "qrc": ["*.qrc"],
+  "qui": ["*.ui"],
+  "r": ["*.R", "*.Rmd", "*.Rnw", "*.r", "*.rmd", "*.rnw"],
+  "racket": ["*.rkt"],
+  "raku": ["*.p6", "*.pl6", "*.pm6", "*.raku", "*.rakudoc", "*.rakumod", "*.rakutest"],
+  "rdoc": ["*.rdoc"],
+  "readme": ["*README", "README*"],
+  "reasonml": ["*.re", "*.rei"],
+  "red": ["*.r", "*.red", "*.reds"],
+  "rescript": ["*.res", "*.resi"],
+  "robot": ["*.robot"],
+  "rocq": ["*.v"],
+  "rst": ["*.rst"],
+  "ruby": ["*.gemspec", "*.rake", "*.rb", "*.rbw", ".irbrc", "Gemfile", "Rakefile", "config.ru"],
+  "rust": ["*.rs"],
+  "sass": ["*.sass", "*.scss"],
+  "scala": ["*.sbt", "*.scala"],
+  "scdoc": ["*.scd", "*.scdoc"],
+  "seed7": ["*.s7i", "*.sd7"],
+  "sh": [
+    "*.bash",
+    "*.bashrc",
+    "*.csh",
+    "*.cshrc",
+    "*.env",
+    "*.ksh",
+    "*.kshrc",
+    "*.sh",
+    "*.tcsh",
+    "*.zsh",
+    ".bash_login",
+    ".bash_logout",
+    ".bash_profile",
+    ".bashrc",
+    ".cshrc",
+    ".env",
+    ".kshrc",
+    ".login",
+    ".logout",
+    ".profile",
+    ".tcshrc",
+    ".zlogin",
+    ".zlogout",
+    ".zprofile",
+    ".zshenv",
+    ".zshrc",
+    "bash_login",
+    "bash_logout",
+    "bash_profile",
+    "bashrc",
+    "profile",
+    "zlogin",
+    "zlogout",
+    "zprofile",
+    "zshenv",
+    "zshrc"
+  ],
+  "slim": ["*.skim", "*.slim", "*.slime"],
+  "smarty": ["*.tpl"],
+  "sml": ["*.sig", "*.sml"],
+  "solidity": ["*.sol"],
+  "soy": ["*.soy"],
+  "spark": ["*.spark"],
+  "spec": ["*.spec"],
+  "sql": ["*.psql", "*.sql"],
+  "ssa": ["*.ssa"],
+  "stylus": ["*.styl"],
+  "sv": ["*.h", "*.sv", "*.svh", "*.v", "*.vg"],
+  "svelte": ["*.svelte", "*.svelte.ts"],
+  "svg": ["*.svg"],
+  "swift": ["*.swift"],
+  "swig": ["*.def", "*.i"],
+  "systemd": [
+    "*.automount",
+    "*.conf",
+    "*.device",
+    "*.link",
+    "*.mount",
+    "*.path",
+    "*.scope",
+    "*.service",
+    "*.slice",
+    "*.socket",
+    "*.swap",
+    "*.target",
+    "*.timer"
+  ],
+  "taskpaper": ["*.taskpaper"],
+  "tcl": ["*.tcl"],
+  "tex": ["*.bib", "*.cls", "*.dtx", "*.ins", "*.ltx", "*.sty", "*.tex"],
+  "texinfo": ["*.texi"],
+  "textile": ["*.textile"],
+  "tf": [
+    "*.terraform.lock.hcl",
+    "*.terraformrc",
+    "*.tf",
+    "*.tf.json",
+    "*.tfrc",
+    "*.tfvars",
+    "*.tfvars.json",
+    "terraform.rc"
+  ],
+  "thrift": ["*.thrift"],
+  "toml": ["*.toml", "Cargo.lock"],
+  "ts": ["*.cts", "*.mts", "*.ts", "*.tsx"],
+  "twig": ["*.twig"],
+  "txt": ["*.txt"],
+  "typescript": ["*.cts", "*.mts", "*.ts", "*.tsx"],
+  "typoscript": ["*.ts", "*.typoscript"],
+  "typst": ["*.typ"],
+  "usd": ["*.usd", "*.usda", "*.usdc"],
+  "v": ["*.v", "*.vsh"],
+  "vala": ["*.vala"],
+  "vb": ["*.vb"],
+  "vcl": ["*.vcl"],
+  "verilog": ["*.sv", "*.svh", "*.v", "*.vh"],
+  "vhdl": ["*.vhd", "*.vhdl"],
+  "vim": ["*.vim", ".gvimrc", ".vimrc", "_gvimrc", "_vimrc", "gvimrc", "vimrc"],
+  "vimscript": ["*.vim", ".gvimrc", ".vimrc", "_gvimrc", "_vimrc", "gvimrc", "vimrc"],
+  "vue": ["*.vue"],
+  "webidl": ["*.idl", "*.webidl", "*.widl"],
+  "wgsl": ["*.wgsl"],
+  "wiki": ["*.mediawiki", "*.wiki"],
+  "xml": [
+    "*.dtd",
+    "*.rng",
+    "*.sch",
+    "*.xhtml",
+    "*.xjb",
+    "*.xml",
+    "*.xml.dist",
+    "*.xsd",
+    "*.xsl",
+    "*.xslt"
+  ],
+  "xz": ["*.txz", "*.xz"],
+  "yacc": ["*.y"],
+  "yaml": ["*.yaml", "*.yml"],
+  "yang": ["*.yang"],
+  "z": ["*.Z"],
+  "zig": ["*.zig"],
+  "zsh": [
+    "*.zsh",
+    ".zlogin",
+    ".zlogout",
+    ".zprofile",
+    ".zshenv",
+    ".zshrc",
+    "zlogin",
+    "zlogout",
+    "zprofile",
+    "zshenv",
+    "zshrc"
+  ],
+  "zstd": ["*.zst", "*.zstd"]
+}