@blogic-cz/agent-tools 1.5.5 → 1.5.7

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6nCF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAoPrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA35CD,SAAS,UAAU,UAAU,KAAK,IA25CM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA75CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA65CjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA/5CE,MAAM,KAAK,OA+5CgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAj6CE,MAAM,KAAK,OAi6CgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAn6CC,MAAM,KAAK,OAm6C0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAr6CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAq6Cf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAv6CC,MAAM,KAAK,OAu6CsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAz6CC,MAAM,KAAK,MAAM,GAAG,IAy6Ca,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA2qCF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAoPrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAz8CD,SAAS,UAAU,UAAU,KAAK,IAy8CM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA38CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA28CjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA78CE,MAAM,KAAK,OA68CgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA/8CE,MAAM,KAAK,OA+8CgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAj9CC,MAAM,KAAK,OAi9C0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAn9CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAm9Cf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAr9CC,MAAM,KAAK,OAq9CsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAv9CC,MAAM,KAAK,MAAM,GAAG,IAu9Ca,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -249,6 +249,26 @@ function getLeadingLiteralAssignments(
   return assignments;
 }
 
+function isSafeHerdrTabCreate(argv: string[]): boolean {
+  if (argv[0] !== "herdr" || argv[1] !== "tab" || argv[2] !== "create") return false;
+  const seen = new Set<string>();
+  for (let index = 3; index < argv.length; index++) {
+    const arg = argv[index] ?? "";
+    const [option, ...attached] = arg.split("=");
+    if (option === "--focus" || option === "--no-focus") {
+      if (attached.length || seen.has("focus")) return false;
+      seen.add("focus");
+      continue;
+    }
+    if (!["--workspace", "--cwd", "--label"].includes(option ?? "") || seen.has(option ?? ""))
+      return false;
+    const value = attached.length ? attached.join("=") : argv[++index];
+    if (!value || (!attached.length && value.startsWith("--"))) return false;
+    seen.add(option ?? "");
+  }
+  return true;
+}
+
 function hasSafeLocalAssignmentCommands(
   command: string,
   assignments: Map<string, { value: string; end: number }>,
@@ -259,9 +279,14 @@ function hasSafeLocalAssignmentCommands(
   return parsed.pipelines.flat().every((words) => {
     const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)$/.exec(words[0] ?? "");
     if (assignment) {
-      return words.length === 1 && assignments.get(assignment[1] ?? "")?.value === assignment[2];
+      return (
+        words.length === 1 &&
+        assignment[1] !== "IFS" &&
+        assignments.get(assignment[1] ?? "")?.value === assignment[2]
+      );
     }
     const argv = unwrapStaticCommand(words);
+    if (isSafeHerdrTabCreate(argv)) return true;
     const name = argv[0]?.split("/").at(-1) ?? "";
     if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
     if (name === "git") {
@@ -522,17 +547,38 @@ function isLiteralTextProducer(argv: string[]): boolean {
   return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
 }
 
+function awkProgramIndex(argv: string[]): number | undefined {
+  if (argv[0]?.split("/").at(-1) !== "awk") return undefined;
+  let index = 1;
+  while (index < argv.length) {
+    const arg = argv[index] ?? "";
+    if (arg === "--") return index + 1 < argv.length ? index + 1 : undefined;
+    if (arg === "-F") {
+      if (argv[index + 1] === undefined) return undefined;
+      index += 2;
+      continue;
+    }
+    if (arg.startsWith("-F") && arg.length > 2) {
+      index++;
+      continue;
+    }
+    if (arg.startsWith("-")) return undefined;
+    return index;
+  }
+  return undefined;
+}
+
 function isAwkExecution(argv: string[]): boolean {
   if (argv[0]?.split("/").at(-1) !== "awk") return false;
-  // Only a literal inline program establishes passive behavior. File/unknown options do not.
-  const program = argv[1];
+  // Only a literal inline program with known-safe options establishes passive behavior.
+  const index = awkProgramIndex(argv);
+  const program = index === undefined ? undefined : argv[index];
   return (
     !program ||
-    program.startsWith("-") ||
     /\b(?:system|getline|ENVIRON)\b|\||\b(?:print|printf)\b[^\n]*>|@(?:include|load)/.test(
       program,
     ) ||
-    argv.slice(2).some((arg) => arg.startsWith("-"))
+    argv.slice((index ?? -1) + 1).some((arg) => arg.startsWith("-"))
   );
 }