@blogic-cz/agent-tools 1.5.11 → 1.6.0

package/README.md

@@ -648,6 +648,8 @@ That's it. The hook reads tool input from stdin, runs the guard, and exits with
 
 The guard permits static `printenv` reads and simple `echo`/`printf` expansions only for exact names in `credentialGuard.allowedEnvironmentVariables`. The default list is empty. Multiple names are allowed only when each name is approved. Approved environment values may be displayed, but redirecting their pipeline or passing them to an executor stays blocked.
 
+Python inline programs and quoted stdin heredocs can also display approved values through `os.getenv("NAME")`, `os.environ.get("NAME", "default")`, or `os.environ["NAME"]`. The complete program must be `import os` followed by `print(...)` statements using these reads and plain string labels or defaults. Dynamic names, aliases, escaped or interpolated strings, additional statements, and whole-environment output remain unsupported. The same redirection and pipeline restrictions apply.
+
 Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, the adjacent `cd PATH && T=LITERAL && git add -- "$T/file"` form, and `rg -n PATTERN src/{a,b}` with a single literal path-brace component. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
 
 Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" status --short` do not need display permission. This does not authorize printing those values, using them as code/options, or reading unknown file paths. In `printf`, approved values belong in data arguments after a fixed nonmutating format, for example `printf -- '%s' "$WORKSPACE_LABEL"`.
@@ -656,6 +658,8 @@ The guard recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes
 
 Paths are checked against sensitive filename patterns and configured path rules. Supported proofs apply those checks to their expanded operands. Ordinary parent-directory and absolute paths may be allowed; the guard does not resolve filesystem paths or symlinks, or enforce repository confinement.
 
+Recognized Linux process-environment paths such as `/proc/self/environ`, `/proc/thread-self/environ`, and PID/task variants are blocked before configured path exceptions.
+
 Single literal `echo`/`printf` writes with output redirection and single `cat`/`tee` heredoc writes are allowed. Heredoc braces are data. Use a quoted delimiter for literal code; unquoted heredocs containing `$`, backticks, or backslashes do not receive the literal-write exception. The exception permits only supported combinations with navigation or selected inspections; unsupported following commands remain outside it. Supported complete Python stdin heredocs are checked as inline programs, with the normal runtime-argument, path, execution, and environment checks.
 
 Python JSON parsing, dictionary iteration, and printing are not themselves evidence of credential access. They follow the same access and execution rules as other supported inline programs. This intentionally permits ordinary JSON output that older versions refused. Unknown secrets in ordinary files can therefore reach arbitrary shell output; wrapper content checks do not protect that output. A refusal caused by unsupported syntax means the guard could not establish its policy conditions, not that it observed a secret being read.

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAg7DF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAiTrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA3wED,SAAS,UAAU,UAAU,KAAK,IA2wEM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA7wEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA6wEjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA/wEE,MAAM,KAAK,OA+wEgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAjxEE,MAAM,KAAK,OAixEgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAnxEC,MAAM,KAAK,OAmxE0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YArxEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAqxEf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAvxEC,MAAM,KAAK,OAuxEsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAzxEC,MAAM,KAAK,MAAM,GAAG,IAyxEa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAimEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAv8ED,SAAS,UAAU,UAAU,KAAK,IAu8EM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAz8EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAy8EjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA38EE,MAAM,KAAK,OA28EgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA78EE,MAAM,KAAK,OA68EgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA/8EC,MAAM,KAAK,OA+8E0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAj9EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAi9Ef,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAn9EC,MAAM,KAAK,OAm9EsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAr9EC,MAAM,KAAK,MAAM,GAAG,IAq9Ea,CAAC"}

package/dist/gh-tool/pr/commands.d.ts

@@ -228,6 +228,11 @@ export declare const prReadyCommand: Command.Command<"ready", {
     readonly pr: Option.Option<number>;
     readonly repo: Option.Option<string>;
 }, {}, import("#gh/service").GhError, GitHubService>;
+export declare const prDraftCommand: Command.Command<"draft", {
+    readonly format: "json" | "toon";
+    readonly pr: Option.Option<number>;
+    readonly repo: Option.Option<string>;
+}, {}, import("#gh/service").GhError, GitHubService>;
 export declare const prChecksCommand: Command.Command<"checks", {
     readonly failFast: boolean;
     readonly format: "json" | "toon";

package/dist/gh-tool/pr/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAW,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAgGhD,eAAO,MAAM,cAAc,cAAe,MAAM,4FAM/C,CAAC;AAiCF,eAAO,MAAM,aAAa,OAAQ,MAAM,aAAa,MAAM;;;;;;gDA6BvD,CAAC;AAEL,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACtB,mBAAmB,UACpB,SAAS,WAAW,EAAE,KAC7B,0BAQF,CAAC;AAIF,eAAO,MAAM,cAAc,UAClB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,kBAAkB,CAkBrD,CAAC;AA8BF,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,kBACD,OAAO,mBACN,OAAO,oGAMgB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI,SAAS,MAAM,GAAG,IAAI,qGAIjC,CAAC;AAE5C,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,UACT,MAAM,GAAG,IAAI,gBACP,MAAM,GAAG,IAAI,SACpB,MAAM,GAAG,IAAI,yGAMoB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI;;;;;gDAIX,CAAC;AAK5C,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MACgB,CAAC;AAE9D,eAAO,MAAM,gBAAgB,YAC3B,KAAK,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjG,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,iBAAiB,YAC9C,CAAC,WACF;IACP,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;CACpB;IAyCC,MAAM;IACN,OAAO;QACL,OAAO;QACP,OAAO;QACP,cAAc;QACd,aAAa;;IAEf,OAAO;gBAxEiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;IAyEpF,OAAO;mBAvEI,MAAM;cACX,MAAM;wBACI,MAAM;uBACP,OAAO;yBACL,OAAO;;IAoExB,cAAc;YAjEV,MAAM;qBACG,MAAM,GAAG,IAAI;gBAClB,MAAM;cACR,MAAM;wBACI,MAAM;;IA8DtB,aAAa;gBA5DiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;CA8D7F,CAAC;AAQF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkExB,OAAO;;;;;QACP,cAAc;;;;;QACd,OAAO;;;;;;gDAGX,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;oDAkCzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;sGAa3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA2CzB,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDA4BlC,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;oDAsD+C,CAAC;AAE5E,eAAO,MAAM,aAAa;;;;;;;;;oDA0C6D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;oDAwC4D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;4FAkCiE,CAAC;AAE7F,eAAO,MAAM,cAAc;;;;oDAsB1B,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;2HAqE3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAyBqC,CAAC;AAExE,eAAO,MAAM,cAAc;;;;;;;gEAkC6D,CAAC;AAEzF,eAAO,MAAM,oBAAoB;;;;;;;oDAoChC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;oDA+BlC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;oDAiC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;oDAwBkE,CAAC;AAEjG,eAAO,MAAM,0BAA0B;;;;oDAsBtC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;oDAyC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;oDAgD7B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;oDAwCqD,CAAC;AAEzF,eAAO,MAAM,4BAA4B;;;;;;oDA8BoC,CAAC;AAE9E,eAAO,MAAM,gBAAgB;;;;;;oDAmC0C,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;oDAqBtC,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;oDAiCyC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;oDAiByC,CAAC;AAYvE,eAAO,MAAM,eAAe;;;;;;;;;oDAkD3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;oDAsDjC,CAAC;AAEF,eAAO,MAAM,yBAAyB,YACpC,SAAS,EACT,gBAAgB,EAChB,mBAAmB,CACX,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAC1D,CAAC,QACH,aAAa,CAAC,MAAM,CAAC;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAgCjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDAiBsD,CAAC;AAE1F,eAAO,MAAM,0BAA0B;;;;oDAuBtC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;oDAgDpC,CAAC;AA2EF,eAAO,MAAM,cAAc,6HAG1B,CAAC"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAW,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,WAAW,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAiGhD,eAAO,MAAM,cAAc,cAAe,MAAM,4FAM/C,CAAC;AAiCF,eAAO,MAAM,aAAa,OAAQ,MAAM,aAAa,MAAM;;;;;;gDA6BvD,CAAC;AAEL,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;CAC/C,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,YACtB,mBAAmB,UACpB,SAAS,WAAW,EAAE,KAC7B,0BAQF,CAAC;AAIF,eAAO,MAAM,cAAc,UAClB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,kBAAkB,CAkBrD,CAAC;AA8BF,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,kBACD,OAAO,mBACN,OAAO,oGAMgB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI,SAAS,MAAM,GAAG,IAAI,qGAIjC,CAAC;AAE5C,eAAO,MAAM,mBAAmB,OAC1B,MAAM,GAAG,IAAI,UACT,MAAM,GAAG,IAAI,gBACP,MAAM,GAAG,IAAI,SACpB,MAAM,GAAG,IAAI,yGAMoB,CAAC;AAE3C,eAAO,MAAM,oBAAoB,OAAQ,MAAM,GAAG,IAAI;;;;;gDAIX,CAAC;AAK5C,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MACgB,CAAC;AAE9D,eAAO,MAAM,gBAAgB,YAC3B,KAAK,EACL,cAAc,EACd,mBAAmB,EACnB,cAAc,CACN,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjG,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,iBAAiB,YAC9C,CAAC,WACF;IACP,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;CACpB;IAyCC,MAAM;IACN,OAAO;QACL,OAAO;QACP,OAAO;QACP,cAAc;QACd,aAAa;;IAEf,OAAO;gBAxEiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;IAyEpF,OAAO;mBAvEI,MAAM;cACX,MAAM;wBACI,MAAM;uBACP,OAAO;yBACL,OAAO;;IAoExB,cAAc;YAjEV,MAAM;qBACG,MAAM,GAAG,IAAI;gBAClB,MAAM;cACR,MAAM;wBACI,MAAM;;IA8DtB,aAAa;gBA5DiC,MAAM;cAAQ,MAAM;wBAAkB,MAAM;;CA8D7F,CAAC;AAQF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkExB,OAAO;;;;;QACP,cAAc;;;;;QACd,OAAO;;;;;;gDAGX,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;oDAkCzB,CAAC;AAEF,eAAO,MAAM,eAAe;;;sGAa3B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;oDA2CzB,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDA4BlC,CAAC;AAEF,eAAO,MAAM,eAAe;;;;;;;;;;oDAsD+C,CAAC;AAE5E,eAAO,MAAM,aAAa;;;;;;;;;oDA0C6D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;oDAwC4D,CAAC;AAExF,eAAO,MAAM,cAAc;;;;;;;4FAkCiE,CAAC;AAE7F,eAAO,MAAM,cAAc;;;;oDAsB1B,CAAC;AAEF,eAAO,MAAM,cAAc;;;;oDAkBmE,CAAC;AAE/F,eAAO,MAAM,eAAe;;;;;;;;2HAqE3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAyBqC,CAAC;AAExE,eAAO,MAAM,cAAc;;;;;;;gEAkC6D,CAAC;AAEzF,eAAO,MAAM,oBAAoB;;;;;;;oDAoChC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;oDA+BlC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;oDAiC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;oDAwBkE,CAAC;AAEjG,eAAO,MAAM,0BAA0B;;;;oDAsBtC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;oDAyC5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;oDAgD7B,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;oDAwCqD,CAAC;AAEzF,eAAO,MAAM,4BAA4B;;;;;;oDA8BoC,CAAC;AAE9E,eAAO,MAAM,gBAAgB;;;;;;oDAmC0C,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;oDAqBtC,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;oDAiCyC,CAAC;AAErE,eAAO,MAAM,gBAAgB;;;;oDAiByC,CAAC;AAYvE,eAAO,MAAM,eAAe;;;;;;;;;oDAkD3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;oDAsDjC,CAAC;AAEF,eAAO,MAAM,yBAAyB,YACpC,SAAS,EACT,gBAAgB,EAChB,mBAAmB,CACX,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UAC1D,CAAC,QACH,aAAa,CAAC,MAAM,CAAC;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;oDAgCjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;oDAiBsD,CAAC;AAE1F,eAAO,MAAM,0BAA0B;;;;oDAuBtC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;oDAgDpC,CAAC;AA2EF,eAAO,MAAM,cAAc,6HAG1B,CAAC"}

package/dist/gh-tool/pr/core.d.ts

@@ -149,6 +149,29 @@ export declare const readyPR: (opts: {
     baseSha: string | null;
     wasAlreadyReady: boolean;
 }, import("#gh/service").GhError, GitHubService>;
+export declare const draftPR: (opts: {
+    pr: number | null;
+}) => Effect.Effect<{
+    number: number;
+    url: string;
+    title: string;
+    headRefName: string;
+    baseRefName: string;
+    state: string;
+    isDraft: boolean;
+    mergeable: "MERGEABLE" | "CONFLICTING" | "UNKNOWN";
+    body: string;
+    author: {
+        login: string;
+        is_bot: boolean;
+    };
+    reviewDecision: "APPROVED" | "CHANGES_REQUESTED" | "REVIEW_REQUIRED" | "";
+    reviewRequests: import("#gh/types").ReviewRequest[];
+    headRefOid?: string;
+    headSha: string | null;
+    baseSha: string | null;
+    wasAlreadyDraft: boolean;
+}, import("#gh/service").GhError, GitHubService>;
 export declare const editPR: (opts: {
     pr: number;
     title: string | null;

package/dist/gh-tool/pr/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAE1E,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,MAAM,EAGN,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA4O5C,eAAO,MAAM,qBAAqB,QAAwB,CAAC;AAS3D,eAAO,MAAM,iBAAiB,gIAiB5B,CAAC;AA8IH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;iBAYuC,MAAM;;;gDAMnE,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;iBAR4C,MAAM;;;gDAuBnE,CAAC;AAEH,eAAO,MAAM,cAAc;UAiBf,MAAM;cACI,cAAc,EAAE;;;;;UAkI1B,QAAQ;QACK,MAAM;;;;;UAKrB,UAAU;;kGAGlB,CAAC;AAEH,eAAO,MAAM,OAAO;WACX,MAAM;WACN,MAAM;YACL,MAAM,GAAG,IAAI;UACf,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;YACX,MAAM,GAAG,IAAI;2EAkBrB,CAAC;AAMH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAtNkC,MAAM;;;gDAqPnE,CAAC;AAEH,eAAO,MAAM,QAAQ;UACb,MAAM,GAAG,IAAI;WACZ,MAAM;UACP,MAAM;WACL,OAAO;UACR,MAAM,GAAG,IAAI;yEA8FnB,CAAC;AAkFH,eAAO,MAAM,OAAO;QACd,MAAM;cACA,aAAa;kBACT,OAAO;aACZ,OAAO;iGAyThB,CAAC;AAEH,eAAO,MAAM,OAAO;QACd,MAAM;aACD,MAAM,GAAG,IAAI;kBACR,OAAO;;;;;;;;;;;;;;;;;iBA9uBwC,MAAM;;;gDA+vBnE,CAAC;AAEH,eAAO,MAAM,OAAO;QAAkD,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAjwBpB,MAAM;;;;gDAgxBnE,CAAC;AAEH,eAAO,MAAM,MAAM;QACb,MAAM;WACH,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAtxB0C,MAAM;;;gDAg1BnE,CAAC;AAEH,eAAO,MAAM,WAAW,wMA+FtB,CAAC;AAIH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;gDA2DxB,CAAC;AAEH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAChD,CAAC,WACD,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,WACtC,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,aACpC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,KAC1C,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAU5D,CAAC;AAEL,eAAO,MAAM,iBAAiB;;iBAtpCJ,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;gDAqjCV,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBArrCR,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;6EAulCV,CAAC;AAqBH,eAAO,MAAM,QAAQ;qBAES,MAAM;oBAAkB,MAAM;YAAU,UAAU;iBAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uFAwM7D,CAAC;AAmEH,eAAO,MAAM,WAAW;YAGH,OAAO;qBAAmB,MAAM;gGAwLnD,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAE1E,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,MAAM,EAGN,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA4O5C,eAAO,MAAM,qBAAqB,QAAwB,CAAC;AAS3D,eAAO,MAAM,iBAAiB,gIAiB5B,CAAC;AA8IH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;iBAYuC,MAAM;;;gDAMnE,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;iBAR4C,MAAM;;;gDAuBnE,CAAC;AAEH,eAAO,MAAM,cAAc;UAiBf,MAAM;cACI,cAAc,EAAE;;;;;UAkI1B,QAAQ;QACK,MAAM;;;;;UAKrB,UAAU;;kGAGlB,CAAC;AAEH,eAAO,MAAM,OAAO;WACX,MAAM;WACN,MAAM;YACL,MAAM,GAAG,IAAI;UACf,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;YACX,MAAM,GAAG,IAAI;2EAkBrB,CAAC;AAMH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAtNkC,MAAM;;;gDAqPnE,CAAC;AAEH,eAAO,MAAM,QAAQ;UACb,MAAM,GAAG,IAAI;WACZ,MAAM;UACP,MAAM;WACL,OAAO;UACR,MAAM,GAAG,IAAI;yEA8FnB,CAAC;AAkFH,eAAO,MAAM,OAAO;QACd,MAAM;cACA,aAAa;kBACT,OAAO;aACZ,OAAO;iGAyThB,CAAC;AAEH,eAAO,MAAM,OAAO;QACd,MAAM;aACD,MAAM,GAAG,IAAI;kBACR,OAAO;;;;;;;;;;;;;;;;;iBA9uBwC,MAAM;;;gDA+vBnE,CAAC;AAEH,eAAO,MAAM,OAAO;QAAkD,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAjwBpB,MAAM;;;;gDAgxBnE,CAAC;AAEH,eAAO,MAAM,OAAO;QAAkD,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAlxBpB,MAAM;;;;gDA+xBnE,CAAC;AAEH,eAAO,MAAM,MAAM;QACb,MAAM;WACH,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAryB0C,MAAM;;;gDA+1BnE,CAAC;AAEH,eAAO,MAAM,WAAW,wMA+FtB,CAAC;AAIH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;gDA2DxB,CAAC;AAEH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAChD,CAAC,WACD,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,WACtC,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,aACpC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,KAC1C,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAU5D,CAAC;AAEL,eAAO,MAAM,iBAAiB;;iBArqCJ,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;gDAokCV,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBApsCR,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;6EAsmCV,CAAC;AAqBH,eAAO,MAAM,QAAQ;qBAES,MAAM;oBAAkB,MAAM;YAAU,UAAU;iBAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uFAwM7D,CAAC;AAmEH,eAAO,MAAM,WAAW;YAGH,OAAO;qBAAmB,MAAM;gGAwLnD,CAAC"}

package/dist/gh-tool/pr/index.d.ts

@@ -1,2 +1,2 @@
-export { prChecksCommand, prChecksFailedCommand, prCloseCommand, prCommentCommand, prCommentsCommand, prCreateCommand, prDiscussionSummaryCommand, prEditCommand, prFeedbackCommand, prIssueCommentsCommand, prIssueCommentsLatestCommand, prLastHumanReviewerCommand, prListCommand, prMergeCommand, prReadyCommand, prStackCommand, prRequestReviewCommand, prReplyCommand, prRerunChecksCommand, prReplyAndResolveCommand, prResolveCommand, prReviewCommand, prReviewsCommand, prStatusCommand, prSubmitReviewCommand, prThreadsCommand, prTriggerChecksCommand, prWaitMergeableCommand, prReviewTriageCommand, prReviewTriageBatchCommand, prViewCommand, prWatchCommand, } from "./commands";
+export { prChecksCommand, prChecksFailedCommand, prCloseCommand, prCommentCommand, prCommentsCommand, prCreateCommand, prDiscussionSummaryCommand, prDraftCommand, prEditCommand, prFeedbackCommand, prIssueCommentsCommand, prIssueCommentsLatestCommand, prLastHumanReviewerCommand, prListCommand, prMergeCommand, prReadyCommand, prStackCommand, prRequestReviewCommand, prReplyCommand, prRerunChecksCommand, prReplyAndResolveCommand, prResolveCommand, prReviewCommand, prReviewsCommand, prStatusCommand, prSubmitReviewCommand, prThreadsCommand, prTriggerChecksCommand, prWaitMergeableCommand, prReviewTriageCommand, prReviewTriageBatchCommand, prViewCommand, prWatchCommand, } from "./commands";
 //# sourceMappingURL=index.d.ts.map

package/dist/gh-tool/pr/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.5.11",
+  "version": "1.6.0",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -17,6 +17,7 @@
 import type { CliToolOverride, CredentialGuardConfig } from "#config/types";
 import { redactSensitiveText } from "#shared/content-security";
 import { SECRET_PATTERNS } from "#shared/credential-patterns";
+import { posix } from "node:path";
 
 export { findSecretMatches } from "#shared/credential-patterns";
 export { redactSensitiveText } from "#shared/content-security";
@@ -89,6 +90,9 @@ const DEFAULT_ALLOWED_PATH_PATTERNS: RegExp[] = [
   /\.env\.sample$/,
 ];
 
+const PROCESS_ENVIRONMENT_PATH =
+  /^(?:\/|(?:\.\.\/)*)proc\/(?:self|thread-self|[0-9]+|\$\$|\$\{\$\})(?:\/task\/(?:[0-9]+|\$\$|\$\{\$\}))?\/environ$/;
+
 /**
  * CLI tools that must use wrapper tools for security and audit.
  */
@@ -1263,12 +1267,144 @@ function unwrapStaticCommand(words: string[]): string[] {
 }
 
 function isAllowedEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
+  if (isAllowedPythonEnvironmentRead(argv, allowedNames)) return true;
   if (argv[0]?.split("/").at(-1) !== "printenv") return false;
   const args = argv.slice(1);
   if (args[0] === "--") args.shift();
   return args.length > 0 && args.every((name) => allowedNames.has(name));
 }
 
+/** Prove the complete, print-only Python program before treating its reads as approved. */
+function isAllowedPythonEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
+  const index = inlineProgramIndex(argv);
+  if (inlineRuntimeKind(argv[0]) !== "python" || index === undefined || argv.length !== index + 1)
+    return false;
+
+  const program = argv[index] ?? "";
+  let position = 0;
+  let foundRead = false;
+  const skipInlineWhitespace = () => {
+    while (/[\t ]/.test(program[position] ?? "")) position++;
+  };
+  const take = (value: string): boolean => {
+    if (!program.startsWith(value, position)) return false;
+    position += value.length;
+    return true;
+  };
+  const takeIdentifier = (value: string): boolean => {
+    if (!take(value) || /[A-Za-z0-9_]/.test(program[position] ?? "")) return false;
+    return true;
+  };
+  const takeString = (): string | undefined => {
+    skipInlineWhitespace();
+    const quote = program[position];
+    if ((quote !== "'" && quote !== '"') || program.startsWith(quote.repeat(3), position))
+      return undefined;
+    position++;
+    const start = position;
+    while (position < program.length && program[position] !== quote) {
+      if (/[\\\r\n]/.test(program[position] ?? "")) return undefined;
+      position++;
+    }
+    if (program[position] !== quote) return undefined;
+    const value = program.slice(start, position);
+    position++;
+    return value;
+  };
+  const takeEnvironmentRead = (): boolean => {
+    skipInlineWhitespace();
+    const start = position;
+    if (!takeIdentifier("os")) return false;
+    if (!take(".")) {
+      position = start;
+      return false;
+    }
+    if (takeIdentifier("getenv")) {
+      if (!take("(")) return false;
+      const name = takeString();
+      if (name === undefined || !allowedNames.has(name)) return false;
+      skipInlineWhitespace();
+      if (take(",")) {
+        if (takeString() === undefined) return false;
+        skipInlineWhitespace();
+      }
+      if (!take(")")) return false;
+      foundRead = true;
+      return true;
+    }
+    if (!takeIdentifier("environ")) return false;
+    if (take(".")) {
+      if (!takeIdentifier("get") || !take("(")) return false;
+      const name = takeString();
+      if (name === undefined || !allowedNames.has(name)) return false;
+      skipInlineWhitespace();
+      if (take(",")) {
+        if (takeString() === undefined) return false;
+        skipInlineWhitespace();
+      }
+      if (!take(")")) return false;
+      foundRead = true;
+      return true;
+    }
+    if (!take("[")) return false;
+    const name = takeString();
+    if (name === undefined || !allowedNames.has(name)) return false;
+    skipInlineWhitespace();
+    if (!take("]")) return false;
+    foundRead = true;
+    return true;
+  };
+  const takeExpression = (): boolean => {
+    const takeTerm = (): boolean => takeString() !== undefined || takeEnvironmentRead();
+    if (!takeTerm()) return false;
+    skipInlineWhitespace();
+    while (take("+")) {
+      if (!takeTerm()) return false;
+      skipInlineWhitespace();
+    }
+    return true;
+  };
+  const takePrint = (): boolean => {
+    skipInlineWhitespace();
+    if (!takeIdentifier("print")) return false;
+    skipInlineWhitespace();
+    if (!take("(")) return false;
+    skipInlineWhitespace();
+    if (take(")")) return true;
+    while (true) {
+      if (!takeExpression()) return false;
+      skipInlineWhitespace();
+      if (take(")")) return true;
+      if (!take(",")) return false;
+      skipInlineWhitespace();
+      if (take(")")) return true;
+    }
+  };
+  const skipSeparators = (): void => {
+    while (true) {
+      skipInlineWhitespace();
+      if (take(";") || take("\n") || take("\r\n")) continue;
+      break;
+    }
+  };
+
+  skipInlineWhitespace();
+  if (!takeIdentifier("import")) return false;
+  skipInlineWhitespace();
+  if (!takeIdentifier("os")) return false;
+  skipInlineWhitespace();
+  if (!(take(";") || take("\n") || take("\r\n"))) return false;
+  skipSeparators();
+  while (position < program.length) {
+    if (!takePrint()) return false;
+    skipInlineWhitespace();
+    if (position === program.length) break;
+    if (!(take(";") || take("\n") || take("\r\n"))) return false;
+    skipSeparators();
+  }
+  return foundRead;
+}
+
 function hasExecutionOption(args: string[], longOptions: string[], shortOption?: string): boolean {
   return args.some((arg) => {
     const flag = arg.split("=", 1)[0] ?? "";
@@ -1431,13 +1567,13 @@ function hasEnvironmentRead(
   const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
   const unwrapped = pipelines.flat();
   if (
-    command.includes(">") &&
+    parsed.redirects.length > 0 &&
     unwrapped.some((argv) => isAllowedEnvironmentRead(argv, allowedNames))
   ) {
     return true;
   }
   if (
-    command.includes(">") &&
+    parsed.redirects.length > 0 &&
     pipelines.some((pipeline) =>
       pipeline.some(
         (argv) => isLiteralTextProducer(argv) && mentionsEnvironmentRead(argv.join(" ")),
@@ -1963,6 +2099,28 @@ function isLiteralInlineWriter(argv: string[]): boolean {
   return take(/^\s*\)\s*;?\s*$/) && position === program.length;
 }
 
+/** Literal inline output can accompany a proved environment display; file writers cannot. */
+function isLiteralInlineDisplay(argv: string[]): boolean {
+  const index = inlineProgramIndex(argv);
+  if (index === undefined || !isLiteralInlineWriter(argv)) return false;
+  const kind = inlineRuntimeKind(argv[0]);
+  const program = argv[index] ?? "";
+  return (
+    (kind === "python" && /^\s*print\s*\(/.test(program)) ||
+    (kind === "node" && /^\s*console\s*\.\s*log\s*\(/.test(program))
+  );
+}
+
+/** Parse approved Python readers from the original shell shape, including quoted stdin heredocs. */
+function hasApprovedPythonEnvironmentRead(command: string, allowedNames: Set<string>): boolean {
+  const normalized = normalizeProgramHeredocs(command);
+  const parsed = parseStaticShellCommands(normalized);
+  if (!parsed || typeof parsed === "string") return false;
+  return parsed.pipelines
+    .flat()
+    .some((words) => isAllowedPythonEnvironmentRead(unwrapStaticCommand(words), allowedNames));
+}
+
 /** Inert command identity is unproved after an explicit environment mutation. */
 function hasEnvironmentMutationPrefix(command: string): boolean {
   const heredoc = boundedHeredoc(command);
@@ -1991,10 +2149,27 @@ function hasEnvironmentMutationPrefix(command: string): boolean {
   });
 }
 
-function hasEnvironmentSourceAccess(command: string, rawTrigger: boolean): boolean {
+function hasEnvironmentSourceAccess(
+  command: string,
+  rawTrigger: boolean,
+  allowedNames: Set<string>,
+): boolean {
   if (rawTrigger && hasEnvironmentMutationPrefix(command)) return true;
-  if (isLiteralTextWrite(command) || isStaticHerdrPrompt(command)) return false;
   const parsed = parseStaticShellCommands(command);
+  if (parsed && typeof parsed !== "string") {
+    const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
+    if (commands.some((argv) => isAllowedPythonEnvironmentRead(argv, allowedNames))) {
+      if (hasEnvironmentMutationPrefix(command)) return true;
+      return !commands.every(
+        (argv) =>
+          argv[0]?.split("/").at(-1) === "cat" ||
+          isPassiveTextCommand(argv) ||
+          isAllowedPythonEnvironmentRead(argv, allowedNames) ||
+          isLiteralInlineDisplay(argv),
+      );
+    }
+  }
+  if (isLiteralTextWrite(command) || isStaticHerdrPrompt(command)) return false;
   if (!parsed || typeof parsed === "string") return rawTrigger;
   const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
   if (rawTrigger) {
@@ -2007,12 +2182,15 @@ function hasEnvironmentSourceAccess(command: string, rawTrigger: boolean): boole
     );
   }
   return commands.some((argv) => {
+    if (isAllowedPythonEnvironmentRead(argv, allowedNames)) return false;
     const index = inlineProgramIndex(argv);
     if (index === undefined) return false;
-    const parts = programParts(argv[index] ?? "", inlineRuntimeKind(argv[0]) === "python");
+    const python = inlineRuntimeKind(argv[0]) === "python";
+    const parts = programParts(argv[index] ?? "", python);
     if (!parts) return true;
     return (
       mentionsEnvironmentSource(parts.code) ||
+      (python && /\b(?:environ|getenv)\b/.test(parts.code)) ||
       (/\b(?:os|process)\s*\[/.test(parts.code) &&
         parts.literals.some((value) => /^(?:env|environ|getenv)$/.test(value)))
     );
@@ -2085,12 +2263,17 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
 
   function isPathAllowed(filePath: string): boolean {
     const normalizedPath = filePath.replace(/\\/g, "/");
-    return allowedPathPatterns.some((pattern) => pattern.test(normalizedPath));
+    return (
+      !PROCESS_ENVIRONMENT_PATH.test(posix.normalize(normalizedPath)) &&
+      allowedPathPatterns.some((pattern) => pattern.test(normalizedPath))
+    );
   }
 
   function isPathBlocked(filePath: string): boolean {
     const normalizedPath = filePath.replace(/\\/g, "/");
 
+    if (PROCESS_ENVIRONMENT_PATH.test(posix.normalize(normalizedPath))) return true;
+
     for (const pattern of allowedPathPatterns) {
       if (pattern.test(normalizedPath)) {
         return false;
@@ -2126,6 +2309,12 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
     const rawEnvironmentSource =
       mentionsEnvironmentSource(command) && mentionsInlineRuntime(command);
+    if (
+      hasApprovedPythonEnvironmentRead(originalCommand, allowedEnvironmentVariables) &&
+      hasEnvironmentMutationPrefix(normalizeProgramHeredocs(originalCommand))
+    ) {
+      return "blocked by the environment/execution policy after an unproved environment mutation";
+    }
     if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
       return "blocked by the environment/execution policy after an unproved environment mutation";
     command = normalizeProgramHeredocs(command);
@@ -2157,7 +2346,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
       return "expands an unapproved or executable environment variable value";
     }
     if (
-      hasEnvironmentSourceAccess(command, rawEnvironmentSource) ||
+      hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
       hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)
     ) {
       return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";

package/src/gh-tool/main.ts

@@ -28,6 +28,7 @@ import {
   prEditCommand,
   prMergeCommand,
   prReadyCommand,
+  prDraftCommand,
   prStackCommand,
   prRequestReviewCommand,
   prThreadsCommand,
@@ -95,6 +96,7 @@ const prCommand = Command.make("pr", {}).pipe(
     prEditCommand,
     prMergeCommand,
     prReadyCommand,
+    prDraftCommand,
     prStackCommand,
     prRequestReviewCommand,
     prWaitMergeableCommand,

package/src/gh-tool/pr/commands.ts

@@ -34,6 +34,7 @@ import {
   closePR,
   collectWithStableState,
   createPR,
+  draftPR,
   detectPRStatus,
   editPR,
   fetchPRView,
@@ -784,6 +785,26 @@ export const prReadyCommand = Command.make(
   ),
 );
 
+export const prDraftCommand = Command.make(
+  "draft",
+  {
+    format: formatOption,
+    pr: Flag.Int("pr").pipe(
+      Flag.withDescription("PR number (default: current branch PR)"),
+      Flag.optional,
+    ),
+    repo: repoOption,
+  },
+  ({ format, pr, repo }) =>
+    withRepo(
+      repo,
+      Effect.gen(function* () {
+        const result = yield* draftPR({ pr: Option.getOrNull(pr) });
+        yield* logFormatted(result, format);
+      }),
+    ),
+).pipe(Command.withDescription("Convert an open PR to draft (no-op if it's already a draft)"));
+
 export const prChecksCommand = Command.make(
   "checks",
   {

package/src/gh-tool/pr/core.ts

@@ -1220,6 +1220,21 @@ export const readyPR = Effect.fn("pr.readyPR")(function* (opts: { pr: number | n
   return { ...updated, wasAlreadyReady: false };
 });
 
+export const draftPR = Effect.fn("pr.draftPR")(function* (opts: { pr: number | null }) {
+  const gh = yield* GitHubService;
+
+  const info = yield* viewPR(opts.pr);
+
+  if (info.isDraft) {
+    return { ...info, wasAlreadyDraft: true };
+  }
+
+  yield* gh.runGh(["pr", "ready", String(info.number), "--undo"]);
+
+  const updated = yield* viewPR(info.number);
+  return { ...updated, wasAlreadyDraft: false };
+});
+
 export const editPR = Effect.fn("pr.editPR")(function* (opts: {
   pr: number;
   title: string | null;

package/src/gh-tool/pr/index.ts

@@ -6,6 +6,7 @@ export {
   prCommentsCommand,
   prCreateCommand,
   prDiscussionSummaryCommand,
+  prDraftCommand,
   prEditCommand,
   prFeedbackCommand,
   prIssueCommentsCommand,