@blogic-cz/agent-tools 1.5.6 → 1.5.8

package/src/credential-guard/index.ts

@@ -15,6 +15,11 @@
  */
 
 import type { CliToolOverride, CredentialGuardConfig } from "#config/types";
+import { redactSensitiveText } from "#shared/content-security";
+import { SECRET_PATTERNS } from "#shared/credential-patterns";
+
+export { findSecretMatches } from "#shared/credential-patterns";
+export { redactSensitiveText } from "#shared/content-security";
 
 // ============================================================================
 // TYPES
@@ -84,61 +89,6 @@ const DEFAULT_ALLOWED_PATH_PATTERNS: RegExp[] = [
   /\.env\.sample$/,
 ];
 
-/** Patterns to detect secrets in content. */
-const SECRET_PATTERNS = [
-  {
-    name: "AWS Access Key",
-    pattern: /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/,
-  },
-  {
-    name: "GitHub Token",
-    pattern: /gh[ps]_[A-Za-z0-9]{36}/,
-  },
-  {
-    name: "GitHub PAT",
-    pattern: /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/,
-  },
-  { name: "OpenAI Key", pattern: /sk-[A-Za-z0-9]{48}/ },
-  {
-    name: "Generic API Key",
-    pattern: /(?:api[_-]?key|apikey)["\s:=]+["']?([A-Za-z0-9_-]{20,})["']?/i,
-  },
-  {
-    name: "Generic Secret",
-    pattern:
-      /(?:secret|token|password|passwd|pwd)["  \t:=]+["']?(?!\$\{|process\.env|z\.|generate|create|read|get|fetch|import|export|const|function|return|Schema)[^\s"']{32,}["']?/i,
-  },
-  {
-    // eslint-disable-next-line eslint/no-useless-concat -- intentionally split to avoid credential guard self-detection
-    name: "Priv" + "ate Key",
-    pattern: new RegExp("-----BEGIN.*PRIVATE KEY-----"),
-  },
-  {
-    name: "JWT Token",
-    pattern: /(?:["'=:\s]|^)eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
-  },
-  {
-    name: "Azure SAS Token",
-    pattern: /[?&]sig=[A-Za-z0-9%+/=]{20,}/,
-  },
-  {
-    name: "GCP Service Account Key",
-    pattern: /"type"\s*:\s*"service_account"/,
-  },
-  {
-    name: "Slack Webhook URL",
-    pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,
-  },
-  {
-    name: "Discord Webhook URL",
-    pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,
-  },
-  {
-    name: "Database URL",
-    pattern: /(?:postgres(?:ql)?|mysql|mongodb):\/\/(?!\$\{)[^:]+:(?!\$\{)[^@]+@/,
-  },
-];
-
 /**
  * CLI tools that must use wrapper tools for security and audit.
  */
@@ -547,17 +497,38 @@ function isLiteralTextProducer(argv: string[]): boolean {
   return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
 }
 
+function awkProgramIndex(argv: string[]): number | undefined {
+  if (argv[0]?.split("/").at(-1) !== "awk") return undefined;
+  let index = 1;
+  while (index < argv.length) {
+    const arg = argv[index] ?? "";
+    if (arg === "--") return index + 1 < argv.length ? index + 1 : undefined;
+    if (arg === "-F") {
+      if (argv[index + 1] === undefined) return undefined;
+      index += 2;
+      continue;
+    }
+    if (arg.startsWith("-F") && arg.length > 2) {
+      index++;
+      continue;
+    }
+    if (arg.startsWith("-")) return undefined;
+    return index;
+  }
+  return undefined;
+}
+
 function isAwkExecution(argv: string[]): boolean {
   if (argv[0]?.split("/").at(-1) !== "awk") return false;
-  // Only a literal inline program establishes passive behavior. File/unknown options do not.
-  const program = argv[1];
+  // Only a literal inline program with known-safe options establishes passive behavior.
+  const index = awkProgramIndex(argv);
+  const program = index === undefined ? undefined : argv[index];
   return (
     !program ||
-    program.startsWith("-") ||
     /\b(?:system|getline|ENVIRON)\b|\||\b(?:print|printf)\b[^\n]*>|@(?:include|load)/.test(
       program,
     ) ||
-    argv.slice(2).some((arg) => arg.startsWith("-"))
+    argv.slice((index ?? -1) + 1).some((arg) => arg.startsWith("-"))
   );
 }
 
@@ -1404,6 +1375,25 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
   }
 
   function handleToolExecuteBefore(input: HookInput, output: HookOutput): void {
+    try {
+      enforceToolExecuteBefore(input, output);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const sanitized = redactSensitiveText(message);
+      if (error instanceof Error) {
+        if (sanitized !== message) {
+          error.message = sanitized;
+          if (error.stack) error.stack = error.stack.replace(message, sanitized);
+        }
+        throw error;
+      }
+      // Do not preserve an unsanitized non-Error value as the new error's cause.
+      // eslint-disable-next-line eslint/preserve-caught-error
+      throw new Error(sanitized);
+    }
+  }
+
+  function enforceToolExecuteBefore(input: HookInput, output: HookOutput): void {
     // Normalize tool name across platforms:
     // - AI coding agents pass capitalized: "Bash", "Read", "Write", "Edit"
     // - OpenCode MCP tools pass prefixed: "mcp_bash", "mcp_read", "mcp_write", "mcp_edit"
@@ -1432,7 +1422,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
           if (detected) {
             throw new Error(
               `\u{1F6AB} Secret detected: Potential ${detected.name} found in content.\n\n` +
-                `Matched: ${detected.match}\n\n` +
+                `Matched: [REDACTED]\n\n` +
                 `Never commit secrets to code. Use environment variables or secret managers.\n\n` +
                 `Think this is a false positive? Review the project repository, fix the pattern, and submit a PR.`,
             );

package/src/db-tool/main.ts

@@ -14,6 +14,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
 import { DbConfigService, makeDbConfigLayer } from "./config-service";
 import { DbConnectionError } from "./errors";
@@ -238,6 +239,7 @@ const mainCommand = Command.make("db-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
 const dbConfigLayer = makeDbConfigLayer(profileArg);
@@ -252,7 +254,7 @@ const MainLayer = DbService.layer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("db", cli).pipe(
+const program = withRedactedOutput(withAudit("db", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/db-tool/service.ts

@@ -6,6 +6,7 @@ import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./t
 import { ConfigService } from "#config";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { resolveEnvTemplate } from "#shared/env-template";
+import { unsafeOutboundTextReason } from "#shared/content-security";
 import { resolveEnvironmentScopedPrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
@@ -501,8 +502,18 @@ export class DbService extends Context.Service<
           readOnly: isFullyReadOnly(config),
         });
 
-        const runSql = (config: DbConfig, password: string, sql: string) =>
-          sqlClient.run(toConnection(config, password), sql);
+        const unsafeSqlError = (reason: string) =>
+          new DbQueryError({
+            message: `Refusing to send SQL containing ${reason}.`,
+            sql: "[redacted]",
+          });
+
+        const runSql = (config: DbConfig, password: string, sql: string) => {
+          const unsafeReason = unsafeOutboundTextReason(sql);
+          return unsafeReason === null
+            ? sqlClient.run(toConnection(config, password), sql)
+            : Effect.fail(unsafeSqlError(unsafeReason));
+        };
 
         const fetchSingleColumn = (config: DbConfig, password: string, sql: string) =>
           runSql(config, password, sql).pipe(
@@ -772,6 +783,11 @@ export class DbService extends Context.Service<
           sql: string,
           limit?: number,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(sql);
+          if (unsafeReason !== null) {
+            return yield* unsafeSqlError(unsafeReason);
+          }
+
           const config = yield* getConfigForEnv(env);
           const startTimeMs = yield* Clock.currentTimeMillis;
           const resolvedConfig = yield* resolveDbConfig(config, env);
@@ -827,6 +843,13 @@ export class DbService extends Context.Service<
           mode: SchemaMode,
           table?: string,
         ) {
+          if (table !== undefined) {
+            const unsafeReason = unsafeOutboundTextReason(table);
+            if (unsafeReason !== null) {
+              return yield* unsafeSqlError(unsafeReason);
+            }
+          }
+
           const config = yield* getConfigForEnv(env);
           const startTimeMs = yield* Clock.currentTimeMillis;
           const resolvedConfig = yield* resolveDbConfig(config, env);

package/src/gh-tool/gist.ts

@@ -1,9 +1,15 @@
 import { Command, Flag } from "effect/unstable/cli";
 import { Effect, Option } from "effect";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 
 import { formatOption, logFormatted } from "#shared";
-import { isSensitivePath, resolveOptionalTextInput, validateOutboundFile } from "#gh/text-input";
+import {
+  isSensitivePath,
+  readValidatedOutboundFile,
+  resolveOptionalTextInput,
+} from "#gh/text-input";
 import { GitHubCommandError } from "./errors";
 import { GitHubService } from "./service";
 
@@ -118,29 +124,13 @@ const validateFilePath = (path: string, command: string) =>
 // `gh gist create/edit` read content from files only; inline --body is staged in a temp file
 // whose basename becomes the gist filename.
 const stageBody = Effect.fn("gist.stageBody")(function* (opts: {
-  body: string;
+  body: string | Uint8Array;
   filename: string;
   command: string;
 }) {
   const directory = yield* Effect.acquireRelease(
     Effect.tryPromise({
-      try: async () => {
-        const proc = Bun.spawn(
-          ["mktemp", "-d", join(process.env.TMPDIR ?? "/tmp", "gh-tool-gist-XXXXXX")],
-          { stdout: "pipe", stderr: "pipe" },
-        );
-        const [exitCode, stdout, stderr] = await Promise.all([
-          proc.exited,
-          new Response(proc.stdout).text(),
-          new Response(proc.stderr).text(),
-        ]);
-
-        if (exitCode !== 0) {
-          throw new Error(stderr.trim() || `mktemp exited with code ${exitCode}`);
-        }
-
-        return stdout.trim();
-      },
+      try: () => mkdtemp(join(process.env.TMPDIR ?? tmpdir(), "gh-tool-gist-")),
       catch: (error) =>
         inputError(
           `Failed to stage gist content: ${error instanceof Error ? error.message : String(error)}`,
@@ -149,20 +139,14 @@ const stageBody = Effect.fn("gist.stageBody")(function* (opts: {
     }),
     (tempDirectory) =>
       Effect.tryPromise({
-        try: async () => {
-          const proc = Bun.spawn(["rm", "-rf", tempDirectory], {
-            stdout: "ignore",
-            stderr: "ignore",
-          });
-          await proc.exited;
-        },
+        try: () => rm(tempDirectory, { recursive: true, force: true }),
         catch: () => undefined,
       }).pipe(Effect.ignore),
   );
   const path = join(directory, opts.filename);
 
   yield* Effect.tryPromise({
-    try: () => Bun.write(path, opts.body),
+    try: () => writeFile(path, opts.body),
     catch: (error) =>
       inputError(
         `Failed to stage gist content: ${error instanceof Error ? error.message : String(error)}`,
@@ -293,45 +277,55 @@ export const createGist = Effect.fn("gist.createGist")(function* (opts: {
   public: boolean;
 }) {
   const gh = yield* GitHubService;
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const snapshots: string[] = [];
+      for (const path of opts.paths) {
+        const validated = yield* readValidatedOutboundFile(path, "gh-tool gist create");
+        const filename = path.split(/[\\/]/).at(-1) ?? path;
+        snapshots.push(
+          yield* stageBody({ body: validated.bytes, filename, command: "gh-tool gist create" }),
+        );
+      }
 
-  for (const path of opts.paths) yield* validateOutboundFile(path, "gh-tool gist create");
-
-  const args = ["gist", "create", ...opts.paths];
+      const args = ["gist", "create", ...snapshots];
 
-  if (opts.description !== null) {
-    args.push("--desc", opts.description);
-  }
+      if (opts.description !== null) {
+        args.push("--desc", opts.description);
+      }
 
-  if (opts.public) {
-    args.push("--public");
-  }
+      if (opts.public) {
+        args.push("--public");
+      }
 
-  const result = yield* gh.runGh(args);
-  const url =
-    result.stdout
-      .trim()
-      .split("\n")
-      .map((line) => line.trim())
-      .findLast((line) => line.startsWith("https://")) ?? "";
-
-  if (url === "") {
-    return yield* Effect.fail(
-      inputError("gh gist create did not return a gist URL", "gh-tool gist create"),
-    );
-  }
+      const result = yield* gh.runGh(args);
+      const url =
+        result.stdout
+          .trim()
+          .split("\n")
+          .map((line) => line.trim())
+          .findLast((line) => line.startsWith("https://")) ?? "";
+
+      if (url === "") {
+        return yield* Effect.fail(
+          inputError("gh gist create did not return a gist URL", "gh-tool gist create"),
+        );
+      }
 
-  const created: GistCreateResult = {
-    created: true,
-    id: url.split("/").at(-1) ?? "",
-    url,
-    public: opts.public,
-    files: opts.paths.map((path) => path.split("/").at(-1) ?? path),
-  };
+      const created: GistCreateResult = {
+        created: true,
+        id: url.split("/").at(-1) ?? "",
+        url,
+        public: opts.public,
+        files: opts.paths.map((path) => path.split(/[\\/]/).at(-1) ?? path),
+      };
 
-  return created;
+      return created;
+    }),
+  );
 });
 
-const editGist = Effect.fn("gist.editGist")(function* (opts: {
+export const editGist = Effect.fn("gist.editGist")(function* (opts: {
   id: string;
   description: string | null;
   add: string | null;
@@ -341,15 +335,13 @@ const editGist = Effect.fn("gist.editGist")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
-  for (const path of [opts.sourcePath, opts.add]) {
-    if (path !== null) yield* validateOutboundFile(path, "gh-tool gist edit");
-  }
-
   const args = ["gist", "edit", opts.id];
   const changes: string[] = [];
 
   if (opts.sourcePath !== null) {
-    args.push(opts.sourcePath);
+    const validated = yield* readValidatedOutboundFile(opts.sourcePath, "gh-tool gist edit");
+    const filename = opts.filename ?? opts.sourcePath.split(/[\\/]/).at(-1) ?? "";
+    args.push(yield* stageBody({ body: validated.bytes, filename, command: "gh-tool gist edit" }));
     changes.push(`content:${opts.filename ?? opts.sourcePath.split("/").at(-1)}`);
   }
 
@@ -359,7 +351,14 @@ const editGist = Effect.fn("gist.editGist")(function* (opts: {
   }
 
   if (opts.add !== null) {
-    args.push("--add", opts.add);
+    const validated = yield* readValidatedOutboundFile(opts.add, "gh-tool gist edit");
+    const filename = opts.add.split(/[\\/]/).at(-1) ?? opts.add;
+    const snapshot = yield* stageBody({
+      body: validated.bytes,
+      filename,
+      command: "gh-tool gist edit",
+    });
+    args.push("--add", snapshot);
     changes.push(`add:${opts.add.split("/").at(-1)}`);
   }
 

package/src/gh-tool/main.ts

@@ -5,6 +5,7 @@ import { Effect, Layer } from "effect";
 
 import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigServiceLayer } from "#config";
 import {
   issueCloseCommand,
@@ -240,6 +241,7 @@ WORKFLOW FOR AI AGENTS:
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
 const MainLayer = GitHubService.layer.pipe(
@@ -248,7 +250,7 @@ const MainLayer = GitHubService.layer.pipe(
   Layer.provideMerge(ConfigServiceLayer),
 );
 
-const program = withAudit("gh", cli).pipe(
+const program = withRedactedOutput(withAudit("gh", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/gh-tool/pr/core.ts

@@ -21,6 +21,7 @@ import { GitHubCommandError, GitHubMergeError } from "#gh/errors";
 import { GitHubService } from "#gh/service";
 import type { GhResult } from "#gh/service";
 import { logText } from "#shared";
+import { redactSensitiveText } from "#shared/content-security";
 
 import type { ButStatusJson, PRViewJsonResult } from "./helpers";
 import { pollUntilResolved } from "#shared/poll-until-resolved";
@@ -114,14 +115,18 @@ const resolveMergeSha = Effect.fn("pr.resolveMergeSha")(function* (
     Effect.map((sha) => ({ sha, failed: false as const })),
     Effect.catch((error) =>
       Console.error(
-        `Warning: PR #${pr} was merged, but its merge commit SHA could not be read: ${error.message}`,
+        redactSensitiveText(
+          `Warning: PR #${pr} was merged, but its merge commit SHA could not be read: ${error.message}`,
+        ),
       ).pipe(Effect.as({ sha: null, failed: true as const })),
     ),
   );
 
   if (result.sha === null && !result.failed) {
     yield* Console.error(
-      `Warning: PR #${pr} was merged, but its merge commit SHA is still unknown after ${MERGE_SHA_WAIT_SECONDS}s.`,
+      redactSensitiveText(
+        `Warning: PR #${pr} was merged, but its merge commit SHA is still unknown after ${MERGE_SHA_WAIT_SECONDS}s.`,
+      ),
     );
   }
 
@@ -1088,7 +1093,9 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
                   if (error._tag !== "GitHubCommandError") {
                     return rollbackNote === ""
                       ? Effect.fail(error)
-                      : Console.error(rollbackNote.trim()).pipe(Effect.andThen(Effect.fail(error)));
+                      : Console.error(redactSensitiveText(rollbackNote.trim())).pipe(
+                          Effect.andThen(Effect.fail(error)),
+                        );
                   }
 
                   const stderr = error.stderr.toLowerCase();