@blogic-cz/agent-tools 1.5.0 → 1.5.1

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAwYF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAqNrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAvoBD,SAAS,UAAU,UAAU,KAAK,IAuoBM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAzoBC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAyoBjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA3oBE,MAAM,KAAK,OA2oBgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA7oBE,MAAM,KAAK,OA6oBgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA/oBC,MAAM,KAAK,OA+oB0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAjpBC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAipBf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAnpBC,MAAM,KAAK,OAmpBsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YArpBC,MAAM,KAAK,MAAM,GAAG,IAqpBa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA+aF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAqNrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA9qBD,SAAS,UAAU,UAAU,KAAK,IA8qBM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAhrBC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAgrBjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAlrBE,MAAM,KAAK,OAkrBgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAprBE,MAAM,KAAK,OAorBgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAtrBC,MAAM,KAAK,OAsrB0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAxrBC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAwrBf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA1rBC,MAAM,KAAK,OA0rBsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA5rBC,MAAM,KAAK,MAAM,GAAG,IA4rBa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -312,13 +312,57 @@ function parseStaticShellCommands(
 }
 
 function mentionsEnvironmentRead(text: string): boolean {
-  return /printenv|\benv\b/i.test(text.replace(/['"\\]/g, ""));
+  // `--env dev` is a flag of another command, not the env command.
+  return /printenv|(?<!--)\benv\b/i.test(text.replace(/['"\\]/g, ""));
 }
 
 function hasBraceExpansion(text: string): boolean {
   return /\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(text);
 }
 
+/**
+ * The command without quoted regex quantifiers such as `{0,80}`. Many commands re-parse quoted
+ * text as shell code, so every other quoted brace stays. When both sides are digits, the expansion
+ * cannot spell a command name. An empty side is not safe: `e{,}nv` and `e{0,}nv` expand to `env`.
+ * An unclosed quote keeps the raw command.
+ */
+function withoutQuotedQuantifiers(command: string): string {
+  let text = "";
+  let quote: "'" | '"' | "$'" | undefined;
+  for (let i = 0; i < command.length; i++) {
+    const char = command.charAt(i);
+    const quantifier = quote ? /^\{\d+,\d+\}/.exec(command.slice(i))?.[0] : undefined;
+    if (quantifier) {
+      i += quantifier.length - 1;
+      continue;
+    }
+    text += char;
+    if (quote === "'") {
+      if (char === "'") quote = undefined;
+    } else if (char === "\\") {
+      text += command[++i] ?? "";
+    } else if (quote) {
+      if (char === quote.at(-1)) quote = undefined;
+    } else if (char === "$" && command[i + 1] === "'") {
+      quote = "$'";
+      text += command[++i];
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    }
+  }
+  return quote ? command : text;
+}
+
+/** Braces in static words, except `{m,n}` with digits on both sides (see above). */
+function hasArgumentBraceExpansion(text: string): boolean {
+  return hasBraceExpansion(text.replace(/\{\d+,\d+\}/g, ""));
+}
+
+/** echo and printf print their arguments; grep -o, rg and git grep print matched pattern text. */
+function isLiteralTextProducer(argv: string[]): boolean {
+  return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
+}
+
 function unwrapStaticCommand(words: string[]): string[] {
   const argv = [...words];
   const executable = () => argv[0]?.split("/").at(-1);
@@ -369,17 +413,10 @@ function hasStaticEnvironmentRead(argv: string[], allowedNames: Set<string>): bo
   if (name === "printenv") return !isAllowedEnvironmentRead(argv, allowedNames);
   if (name === "env") return true;
   if (isPassiveTextCommand(argv)) return false;
-  if (
-    argv.some((arg) =>
-      ["sh", "bash", "zsh", "dash", "ksh", "fish", "csh", "tcsh", "eval"].includes(
-        arg.split("/").at(-1) ?? "",
-      ),
-    ) &&
-    hasBraceExpansion(argv.slice(1).join(" "))
-  ) {
-    return true;
-  }
-  return mentionsEnvironmentRead(argv.join(" "));
+  // Any command may re-parse an argument as shell code (trap, find -exec, awk system()).
+  return (
+    hasArgumentBraceExpansion(argv.slice(1).join(" ")) || mentionsEnvironmentRead(argv.join(" "))
+  );
 }
 
 function hasEnvironmentRead(command: string, allowedNames: Set<string>): boolean {
@@ -387,7 +424,9 @@ function hasEnvironmentRead(command: string, allowedNames: Set<string>): boolean
   // ponytail: complex shell syntax stays conservative; use a shell AST if more exceptions are needed.
   const parsed = parseStaticShellCommands(command);
   if (parsed === "brace-expansion") return true;
-  if (!parsed) return mentionsEnvironmentRead(command) || hasBraceExpansion(command);
+  if (!parsed) {
+    return mentionsEnvironmentRead(command) || hasBraceExpansion(withoutQuotedQuantifiers(command));
+  }
   const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
   const unwrapped = pipelines.flat();
   if (unwrapped.some((argv) => hasStaticEnvironmentRead(argv, allowedNames))) return true;
@@ -399,8 +438,8 @@ function hasEnvironmentRead(command: string, allowedNames: Set<string>): boolean
       pipeline.some(
         (argv) =>
           isAllowedEnvironmentRead(argv, allowedNames) ||
-          (isPassiveTextCommand(argv) &&
-            (mentionsEnvironmentRead(argv.join(" ")) || hasBraceExpansion(argv.join(" ")))),
+          (isLiteralTextProducer(argv) &&
+            (mentionsEnvironmentRead(argv.join(" ")) || hasArgumentBraceExpansion(argv.join(" ")))),
       ) &&
       pipeline.some(
         (argv) => !isPassiveTextCommand(argv) && !isAllowedEnvironmentRead(argv, allowedNames),