@blogic-cz/agent-tools 1.14.0 → 1.14.1

package/dist/credential-guard/location-operands.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=location-operands.test.d.ts.map

package/dist/credential-guard/location-operands.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"location-operands.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/location-operands.test.ts"],"names":[],"mappings":""}

package/dist/credential-guard/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EAi0FjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AAy0CD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EAs5FjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AAy0CD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/location-operands.test.ts

@@ -0,0 +1,78 @@
+/* eslint-disable eslint/no-template-curly-in-string -- Shell parameter syntax is literal test input. */
+import { expect, it } from "vitest";
+import { createCredentialGuard } from "./index";
+
+const guard = createCredentialGuard();
+const check = (command: string): void =>
+  guard.handleToolExecuteBefore({ tool: "Bash" }, { args: { command } });
+
+it.each([
+  "tmutil isexcluded ~/op",
+  "tmutil addexclusion ~/op/worktrees",
+  "tmutil",
+  "tmutil version",
+  "tmutil help",
+  "tmutil listbackups",
+  "tmutil latestbackup",
+  "tmutil destinationinfo",
+  "tmutil status",
+  "tmutil currentphase",
+  "tmutil startbackup",
+  "tmutil unknown-subcommand public",
+  "sudo tmutil listbackups",
+  "tmutil listbackups | head",
+  'mdfind -onlyin "$HOME/o""p" -count x',
+  'for p in ~/projects ~/op; do tmutil isexcluded "$p"; done',
+])("accepts declared location operands: %s", (command) => {
+  expect(() => check(command)).not.toThrow();
+});
+
+it("keeps secret-source basenames as locations in declared path roles", () => {
+  for (const name of ["op", "bw", "pass", "security", "printenv"]) {
+    for (const command of [
+      `tmutil isexcluded ~/projects/${name}`,
+      `tmutil addexclusion -p ~/projects/${name}`,
+      `tmutil removeexclusion -v ~/projects/${name}`,
+      `tmutil compare -D 2 -I op ~/projects/${name} ~/other/${name}`,
+      `tmutil uniquesize ~/projects/${name}`,
+      `tmutil calculatedrift ~/projects/${name}`,
+      `mdfind -onlyin ~/projects/${name} -count x`,
+    ]) {
+      expect(() => check(command)).not.toThrow();
+    }
+  }
+});
+
+it.each([
+  "mdfind -onlyin ~/op -count x",
+  "mdfind op",
+  "mdfind -name .env -attr password -0 -live -literal -interpret op",
+])("keeps Spotlight query and attribute text as data: %s", (command) => {
+  expect(() => check(command)).not.toThrow();
+});
+
+it.each([
+  ["unknown-cli op read x", "secret-source"],
+  ["unknown-cli /usr/local/bin/op read op://a/b", "secret-source"],
+  ["unknown-cli ~/bin/op --account a item get x", "secret-source"],
+  ["unknown-cli -e ~/op read x", "secret-source"],
+  ["unknown-cli op", "secret-source"],
+  ["op item get x", "secret-source"],
+  ["op read op://a/b", "secret-source"],
+  ["launchctl asuser 501 /usr/bin/printenv", "secret-source"],
+  ["launchctl asuser 501 /usr/bin/security dump-keychain", "secret-source"],
+  ["tmutil unknown-subcommand ~/op", "secret-source"],
+  ["tmutil restore ~/.ssh/id_rsa /tmp/x", "sensitive-path"],
+  ["tmutil isexcluded ~/.ssh/id_rsa", "sensitive-path"],
+  ["tmutil addexclusion -p .env", "sensitive-path"],
+  ["tmutil compare .env public", "sensitive-path"],
+  ["tmutil isexcluded $(op read op://a/b)", "secret-source"],
+  ['tmutil isexcluded "$UNKNOWN"', "opaque-path"],
+  ["mdfind -onlyin ~/.ssh op", "sensitive-path"],
+  ['mdfind -onlyin "$UNKNOWN" x', "opaque-path"],
+  ["mdfind -onlyin", "opaque-path"],
+  ["mdfind -onlyin ~/.ssh x", "sensitive-path"],
+  ['mdfind "$(cat ~/.ssh/id_rsa)"', "sensitive-path"],
+] as const)("refuses with the expected rule for %s", (command, rule) => {
+  expect(() => check(command)).toThrow(rule);
+});

package/src/credential-guard/registry.ts

@@ -1906,6 +1906,91 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
     semantics: "listing",
   },
   { name: "basename", aliases: ["dirname"], operands: [data] },
+  {
+    name: "tmutil",
+    operands: [path],
+    subcommands: {
+      ...Object.fromEntries(
+        [
+          "setdestination",
+          "destinationinfo",
+          "setquota",
+          "removedestination",
+          "enable",
+          "disable",
+          "startbackup",
+          "stopbackup",
+          "verifychecksums",
+          "restore",
+          "delete",
+          "deleteinprogress",
+          "latestbackup",
+          "listbackups",
+          "machinedirectory",
+          "inheritbackup",
+          "associatedisk",
+          "localsnapshot",
+          "listlocalsnapshots",
+          "listlocalsnapshotdates",
+          "deletelocalsnapshots",
+          "thinlocalsnapshots",
+          "help",
+          "version",
+          "status",
+          "currentphase",
+        ].map((name) => [
+          name,
+          {
+            operands: [path],
+            effect:
+              name === "restore" ? unknown("unmodeled Time Machine restore operation") : "none",
+          } satisfies Omit<ExecutableEntry, "name">,
+        ]),
+      ),
+      isexcluded: { operands: [path], options: flags("-X"), effect: "none" },
+      addexclusion: { operands: [path], options: flags("-p", "-v"), effect: "none" },
+      removeexclusion: { operands: [path], options: flags("-p", "-v"), effect: "none" },
+      compare: {
+        operands: [path],
+        options: {
+          ...flags(
+            "-@",
+            "-a",
+            "-c",
+            "-d",
+            "-e",
+            "-f",
+            "-g",
+            "-h",
+            "-l",
+            "-m",
+            "-n",
+            "-s",
+            "-t",
+            "-u",
+            "-E",
+            "-U",
+            "-X",
+          ),
+          "-D": arg(data),
+          "-I": arg(data),
+        },
+        effect: "none",
+      },
+      uniquesize: { operands: [path], effect: "none" },
+      calculatedrift: { operands: [path], effect: "none" },
+    },
+  },
+  {
+    name: "mdfind",
+    operands: [data],
+    options: {
+      "-onlyin": arg(path),
+      "-name": arg(data),
+      "-attr": arg(data),
+      ...flags("-count", "-0", "-live", "-literal", "-interpret"),
+    },
+  },
   {
     name: "ls",
     options: {