@blogic-cz/agent-tools 1.5.7 → 1.5.9

package/src/gh-tool/release.ts

@@ -2,7 +2,8 @@ import { Command, Flag } from "effect/unstable/cli";
 import { Effect, Option } from "effect";
 
 import { formatOption, logFormatted } from "#shared";
-import { resolveOptionalTextInput } from "#gh/text-input";
+import { resolveOptionalTextInput, validateOutboundText } from "#gh/text-input";
+import { GitHubCommandError } from "#gh/errors";
 import { GitHubService } from "./service";
 
 type ReleaseListItem = {
@@ -129,11 +130,36 @@ const viewRelease = Effect.fn("release.viewRelease")(function* (opts: {
   return yield* gh.runGhJson<ReleaseDetail>(args);
 });
 
-const createRelease = Effect.fn("release.createRelease")(function* (opts: {
+export const resolveCreateNotes = (opts: {
+  body: string | null;
+  bodyFile: string | null;
+  notesFile: string | null;
+}) => {
+  if (opts.bodyFile !== null && opts.notesFile !== null) {
+    return Effect.fail(
+      new GitHubCommandError({
+        command: "gh-tool release create",
+        exitCode: 1,
+        message: "Provide only one of --body-file or --notes-file",
+        stderr: "Provide only one of --body-file or --notes-file",
+      }),
+    );
+  }
+
+  return resolveOptionalTextInput({
+    command: "gh-tool release create",
+    value: opts.body,
+    fileValue: opts.bodyFile ?? opts.notesFile,
+    valueFlag: "--body",
+    fileFlag: opts.notesFile === null ? "--body-file" : "--notes-file",
+    label: "body",
+  });
+};
+
+export const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   tag: string;
   title: string | null;
   body: string | null;
-  notesFile: string | null;
   draft: boolean;
   prerelease: boolean;
   generateNotes: boolean;
@@ -145,18 +171,59 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
-  const args = ["release", "create", opts.tag];
-
   if (opts.title !== null) {
-    args.push("--title", opts.title);
+    yield* validateOutboundText(opts.title, "gh-tool release create");
   }
 
-  if (opts.body !== null) {
-    args.push("--notes", opts.body);
+  let body = opts.body;
+  let title = opts.title;
+  if (opts.generateNotes) {
+    const generated = yield* gh.withRepoTarget(
+      opts.repo,
+      Effect.gen(function* () {
+        const repo = yield* gh.getRepoInfo();
+        const args = [
+          "api",
+          "--hostname",
+          new URL(repo.url).hostname,
+          "--method",
+          "POST",
+          `repos/${repo.owner}/${repo.name}/releases/generate-notes`,
+          "-f",
+          `tag_name=${opts.tag}`,
+        ];
+        if (opts.target !== null) args.push("-f", `target_commitish=${opts.target}`);
+        if (opts.notesStartTag !== null) args.push("-f", `previous_tag_name=${opts.notesStartTag}`);
+        return yield* gh.runGhJson<{ name: string; body: string }>(args);
+      }),
+    );
+    if (typeof generated?.body !== "string" || typeof generated.name !== "string") {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool release create",
+          exitCode: 1,
+          message: "Could not inspect generated release notes; refusing to create release",
+          stderr: "GitHub returned incomplete generated release notes",
+        }),
+      );
+    }
+    yield* validateOutboundText(generated.body, "gh-tool release create");
+    if (title === null || title === "") {
+      yield* validateOutboundText(generated.name, "gh-tool release create");
+      title = generated.name;
+    }
+    body = opts.body ? `${opts.body}\n${generated.body}` : generated.body;
+    yield* validateOutboundText(body, "gh-tool release create");
+  }
+
+  const args = ["release", "create", opts.tag];
+
+  if (title !== null) {
+    args.push("--title", title);
   }
 
-  if (opts.notesFile !== null) {
-    args.push("--notes-file", opts.notesFile);
+  if (body !== null) {
+    args.push("--notes", body);
   }
 
   if (opts.draft) {
@@ -167,14 +234,6 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
     args.push("--prerelease");
   }
 
-  if (opts.generateNotes) {
-    args.push("--generate-notes");
-  }
-
-  if (opts.notesStartTag !== null) {
-    args.push("--notes-start-tag", opts.notesStartTag);
-  }
-
   if (opts.target !== null) {
     args.push("--target", opts.target);
   }
@@ -203,7 +262,7 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   const created: ReleaseCreateResult = {
     created: true,
     tagName: opts.tag,
-    name: opts.title ?? opts.tag,
+    name: title ?? opts.tag,
     url,
     isDraft: opts.draft,
     isPrerelease: opts.prerelease,
@@ -212,7 +271,7 @@ const createRelease = Effect.fn("release.createRelease")(function* (opts: {
   return created;
 });
 
-const editRelease = Effect.fn("release.editRelease")(function* (opts: {
+export const editRelease = Effect.fn("release.editRelease")(function* (opts: {
   tag: string;
   title: string | null;
   body: string | null;
@@ -223,6 +282,26 @@ const editRelease = Effect.fn("release.editRelease")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
+  if (opts.title !== null) {
+    yield* validateOutboundText(opts.title, "gh-tool release edit");
+  }
+
+  if (opts.draft === false) {
+    const current = yield* viewRelease({ tag: opts.tag, repo: opts.repo });
+    if (typeof current.name !== "string" || typeof current.body !== "string") {
+      return yield* Effect.fail(
+        new GitHubCommandError({
+          command: "gh-tool release edit",
+          exitCode: 1,
+          message: "Could not inspect release content; refusing to publish",
+          stderr: "GitHub returned incomplete release content",
+        }),
+      );
+    }
+    yield* validateOutboundText(opts.title ?? current.name, "gh-tool release edit");
+    yield* validateOutboundText(opts.body ?? current.body, "gh-tool release edit");
+  }
+
   const args = ["release", "edit", opts.tag];
 
   if (opts.title !== null) {
@@ -370,7 +449,7 @@ export const releaseCreateCommand = Command.make(
       Flag.optional,
     ),
     notesFile: Flag.String("notes-file").pipe(
-      Flag.withDescription("Path to release notes file (passed to gh --notes-file)"),
+      Flag.withDescription("Read release notes from a file path or '-' for stdin"),
       Flag.optional,
     ),
     notesStartTag: Flag.String("notes-start-tag").pipe(
@@ -416,20 +495,16 @@ export const releaseCreateCommand = Command.make(
     verifyTag,
   }) =>
     Effect.gen(function* () {
-      const resolvedBody = yield* resolveOptionalTextInput({
-        command: "gh-tool release create",
-        value: Option.getOrNull(body),
-        fileValue: Option.getOrNull(bodyFile),
-        valueFlag: "--body",
-        fileFlag: "--body-file",
-        label: "body",
+      const resolvedBody = yield* resolveCreateNotes({
+        body: Option.getOrNull(body),
+        bodyFile: Option.getOrNull(bodyFile),
+        notesFile: Option.getOrNull(notesFile),
       });
 
       const result = yield* createRelease({
         tag,
         title: Option.getOrNull(title),
         body: resolvedBody,
-        notesFile: Option.getOrNull(notesFile),
         draft,
         prerelease,
         generateNotes,

package/src/gh-tool/text-input.ts

@@ -1,7 +1,10 @@
 import { Effect, Schema } from "effect";
+import { realpath } from "node:fs/promises";
 
 import { GitHubCommandError } from "#gh/errors";
-import { detectSecrets } from "#guard";
+import { unsafeOutboundTextReason } from "#shared/content-security";
+
+export { unsafeOutboundTextReason } from "#shared/content-security";
 
 const STDIN_SENTINEL = "-";
 const SENSITIVE_PATH_PATTERNS = [
@@ -17,33 +20,6 @@ const readTextFromStdin = () => Bun.stdin.text();
 export const isSensitivePath = (filePath: string) =>
   SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(filePath));
 
-/** Inspect the final text, after shell expansion and after reading files or stdin. */
-export function unsafeOutboundTextReason(
-  text: string,
-  environment: Record<string, string | undefined> = process.env,
-): string | null {
-  if (detectSecrets(text)) return "a credential pattern";
-
-  const sensitiveName =
-    /(?:KEY|TOKEN|SECRET|PASS(?:WORD)?|PWD|CREDENTIAL|AUTH|COOKIE|SESSION|PSK)/i;
-  const isSensitiveName = (name: string) =>
-    name !== "PWD" && name !== "OLDPWD" && sensitiveName.test(name);
-  for (const [name, value] of Object.entries(environment)) {
-    if (isSensitiveName(name) && value && value.length >= 8 && text.includes(value)) {
-      return "a credential from the process environment";
-    }
-  }
-
-  const assignments = text.match(/^[A-Za-z_][A-Za-z0-9_]*=.*$/gm) ?? [];
-  if (
-    assignments.length >= 5 &&
-    assignments.some((line) => isSensitiveName(line.split("=", 1)[0] ?? ""))
-  ) {
-    return "an environment dump";
-  }
-  return null;
-}
-
 export const validateOutboundText = (text: string, command: string) => {
   const reason = unsafeOutboundTextReason(text);
   return reason === null
@@ -58,9 +34,9 @@ export const validateOutboundText = (text: string, command: string) => {
       );
 };
 
-export const validateOutboundFile = (filePath: string, command: string) =>
+export const readValidatedOutboundFile = (filePath: string, command: string) =>
   Effect.tryPromise({
-    try: () => readTextFile(filePath),
+    try: () => readAllowedFile(filePath),
     catch: () =>
       new GitHubCommandError({
         command,
@@ -68,17 +44,22 @@ export const validateOutboundFile = (filePath: string, command: string) =>
         stderr: `Refusing to publish unreadable or sensitive file: ${filePath}`,
         message: `Refusing to publish unreadable or sensitive file: ${filePath}`,
       }),
-  }).pipe(
-    Effect.flatMap((text) => validateOutboundText(text, command)),
-    Effect.asVoid,
-  );
+  }).pipe(Effect.tap(({ text }) => validateOutboundText(text, command)));
+
+export const validateOutboundFile = (filePath: string, command: string) =>
+  readValidatedOutboundFile(filePath, command).pipe(Effect.asVoid);
 
 const readTextFile = (filePath: string) => {
-  if (isSensitivePath(filePath)) {
-    return Promise.reject(new Error(`Refusing to read sensitive file: ${filePath}`));
-  }
+  return readAllowedFile(filePath).then(({ text }) => text);
+};
 
-  return Bun.file(filePath).text();
+const readAllowedFile = async (filePath: string) => {
+  if (isSensitivePath(filePath)) throw new Error(`Refusing to read sensitive file: ${filePath}`);
+  const resolvedPath = await realpath(filePath);
+  if (isSensitivePath(resolvedPath))
+    throw new Error(`Refusing to read sensitive file: ${resolvedPath}`);
+  const bytes = await Bun.file(resolvedPath).bytes();
+  return { bytes, text: new TextDecoder("utf-8", { fatal: true }).decode(bytes) };
 };
 
 const ensureResolvedText = (resolvedValue: string | null, context: string) => {

package/src/k8s-tool/main.ts

@@ -14,6 +14,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { K8sService, K8sServiceLayer } from "./service";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment, getToolConfig } from "#config";
 import type { K8sConfig } from "#config";
@@ -471,6 +472,7 @@ const mainCommand = Command.make("k8s-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
 const MainLayer = K8sServiceLayer.pipe(
@@ -479,7 +481,7 @@ const MainLayer = K8sServiceLayer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("k8s", cli).pipe(
+const program = withRedactedOutput(withAudit("k8s", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/k8s-tool/service.ts

@@ -22,6 +22,7 @@ import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
 import { parseKubeConfigView, selectKubeContext } from "./context";
+import { unsafeOutboundTextReason } from "#shared/content-security";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -248,6 +249,14 @@ export class K8sService extends Context.Service<
           argv: readonly string[],
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(argv.join(" "));
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           const k8sConfig = yield* requireK8sConfig(profile);
           const timeoutMs = k8sConfig.timeoutMs ?? 60000;
           const apiProbeTimeoutMs = k8sConfig.apiProbeTimeoutMs ?? 2000;
@@ -338,6 +347,14 @@ export class K8sService extends Context.Service<
           _env: Environment,
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(cmd);
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           // Security: block dangerous commands before execution
           const securityCheck = isKubectlCommandAllowed(cmd);
           if (!securityCheck.allowed || !securityCheck.argv) {
@@ -369,6 +386,14 @@ export class K8sService extends Context.Service<
           dryRun: boolean,
           profile?: string,
         ) {
+          const unsafeReason = unsafeOutboundTextReason(cmd);
+          if (unsafeReason !== null) {
+            return yield* new K8sDangerousCommandError({
+              message: `Refusing to send command containing ${unsafeReason}.`,
+              command: "[redacted]",
+            });
+          }
+
           // Security: block dangerous commands before execution (even dry-run)
           const securityCheck = isKubectlCommandAllowed(cmd);
           if (!securityCheck.allowed || !securityCheck.argv) {

package/src/logs-tool/main.ts

@@ -29,6 +29,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
 import { LogsConfigError, LogsNotFoundError, LogsReadError, LogsTimeoutError } from "./errors";
 import { LogsService, LogsServiceLayer } from "./service";
@@ -227,11 +228,15 @@ const mainCommand = Command.make("logs-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
-export const run = Command.runWith(mainCommand, {
+const runWithErrorsDisabled = Command.runWith(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
+export const run = (args: ReadonlyArray<string>) =>
+  withRedactedOutput(runWithErrorsDisabled(args)).pipe(Effect.tapCause(renderCauseToStderr));
 
 const MainLayer = LogsServiceLayer.pipe(
   Layer.provideMerge(ConfigServiceLayer),
@@ -239,7 +244,7 @@ const MainLayer = LogsServiceLayer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("logs", cli).pipe(
+const program = withRedactedOutput(withAudit("logs", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/observability-tool/main.ts

@@ -1,20 +1,18 @@
 #!/usr/bin/env bun
 
 import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Console, Effect, Layer } from "effect";
-import type { Cause } from "effect";
+import { Effect, Layer } from "effect";
 import { Command } from "effect/unstable/cli";
 
 import { ConfigServiceLayer } from "#config";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
-import { makeSchemaCommand, VERSION } from "#shared";
+import { withRedactedOutput } from "#shared/output-boundary";
+import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 
 import { metricsCommand } from "./metrics";
 import { logsCommand } from "./logs";
 import { traceCommand } from "./trace";
 
-const renderCauseToStderr = (cause: Cause.Cause<unknown>) => Console.error(cause.toString());
-
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
 const mainCommand = Command.make("observability-tool", {}).pipe(
@@ -24,11 +22,11 @@ const mainCommand = Command.make("observability-tool", {}).pipe(
   Command.withSubcommands([traceCommand, metricsCommand, logsCommand, commandsCommand]),
 );
 
-const cli = Command.run(mainCommand, { version: VERSION });
+const cli = Command.run(mainCommand, { version: VERSION, renderErrors: false });
 
 const MainLayer = Layer.mergeAll(BunServices.layer, ConfigServiceLayer, AuditServiceLayer);
 
-const program = withAudit("observability", cli).pipe(
+const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.provide(MainLayer),
   Effect.tapCause(renderCauseToStderr),
 );

package/src/observability-tool/shared.ts

@@ -5,6 +5,7 @@ import { ConfigService, getToolConfig } from "#config";
 import type { ObservabilityConfig } from "#config";
 
 import { ObservabilityToolError } from "./errors";
+import { unsafeOutboundTextReason } from "#shared/content-security";
 import type {
   DsQueryOpts,
   DsQueryResponse,
@@ -200,6 +201,45 @@ export function observabilityFetch<T>(
   path: string,
   init?: RequestInit,
 ): Effect.Effect<T, ObservabilityToolError> {
+  const rawBody = typeof init?.body === "string" ? init.body : "";
+  const url = `${config.url}${path}`;
+  let decodedUrl: string;
+  try {
+    decodedUrl = decodeURIComponent(url);
+  } catch {
+    return Effect.fail(
+      new ObservabilityToolError({
+        cause: new Error("Refusing malformed observability URL encoding."),
+      }),
+    );
+  }
+  const bodyText = [rawBody];
+  const appendJsonText = (value: unknown): void => {
+    if (typeof value === "string") {
+      bodyText.push(value);
+    } else if (Array.isArray(value)) {
+      value.forEach(appendJsonText);
+    } else if (typeof value === "object" && value !== null) {
+      for (const [key, nested] of Object.entries(value)) {
+        bodyText.push(key);
+        appendJsonText(nested);
+      }
+    }
+  };
+  try {
+    appendJsonText(JSON.parse(rawBody) as unknown);
+  } catch {
+    // Non-JSON request bodies are still checked as supplied above.
+  }
+  const unsafeReason = unsafeOutboundTextReason([url, decodedUrl, ...bodyText].join("\n"));
+  if (unsafeReason !== null) {
+    return Effect.fail(
+      new ObservabilityToolError({
+        cause: new Error(`Refusing to send observability request containing ${unsafeReason}.`),
+      }),
+    );
+  }
+
   return Effect.tryPromise({
     try: async () => {
       const headers = buildHeaders(config.token);
@@ -210,7 +250,7 @@ export function observabilityFetch<T>(
         });
       }
 
-      const response = await fetch(`${config.url}${path}`, {
+      const response = await fetch(url, {
         ...init,
         headers,
       });

package/src/session-tool/main.ts

@@ -15,8 +15,16 @@ import type { MessageSummary, SessionResult, SessionSource } from "./types";
 
 import { ALL_SESSION_SOURCES } from "./types";
 
-import { makeSchemaCommand, formatOption, formatOutput, logText, VERSION } from "#shared";
+import {
+  makeSchemaCommand,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { withRedactedOutput } from "#shared/output-boundary";
 import { ResolvedPaths, ResolvedPathsLayer } from "./config";
 import { SessionStorageNotFoundError } from "./errors";
 import { formatDate, SessionService, SessionServiceLayer } from "./service";
@@ -321,18 +329,25 @@ const mainCommand = Command.make("session-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
 
-export const run = Command.runWith(mainCommand, {
+const runWithErrorsDisabled = Command.runWith(mainCommand, {
   version: VERSION,
+  renderErrors: false,
 });
+export const run = (args: ReadonlyArray<string>) =>
+  withRedactedOutput(runWithErrorsDisabled(args)).pipe(Effect.tapCause(renderCauseToStderr));
 
 const MainLayer = AppLayer.pipe(
   Layer.provideMerge(BunServices.layer),
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withAudit("session", cli).pipe(Effect.provide(MainLayer));
+const program = withRedactedOutput(withAudit("session", cli)).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
 
 BunRuntime.runMain(program, {
   disableErrorReporting: true,

package/src/shared/audit.ts

@@ -6,6 +6,7 @@ import { basename, dirname, join } from "node:path";
 import { Cause, Context, Effect, Layer } from "effect";
 
 import { loadConfig } from "#config";
+import { redactSensitiveText } from "./content-security";
 
 const DEFAULT_AUDIT_RETENTION_DAYS = 90;
 const IN_MEMORY_DB_PATH = ":memory:";
@@ -80,12 +81,12 @@ const isInMemoryDatabase = (dbPath: string): boolean =>
 const toAuditEntry = (row: AuditRow): AuditLogEntry => ({
   id: row.id,
   ts: row.ts,
-  tool: row.tool,
-  project: row.project,
-  args: row.args,
+  tool: redactSensitiveText(row.tool),
+  project: redactSensitiveText(row.project),
+  args: redactSensitiveText(row.args),
   duration: row.duration,
   success: row.success === 1,
-  error: row.error,
+  error: row.error === null ? null : redactSensitiveText(row.error),
   exitCode: row.exit_code,
 });
 
@@ -246,12 +247,12 @@ const createAuditService = (dbPath: string, db: Database | null): AuditServiceSh
           db.run(
             "INSERT INTO audit_log (tool, project, args, duration, success, error, exit_code) VALUES (?, ?, ?, ?, ?, ?, ?)",
             [
-              safeToolName(entry.tool),
-              entry.project,
-              entry.args,
+              redactSensitiveText(safeToolName(entry.tool)),
+              redactSensitiveText(entry.project),
+              redactSensitiveText(entry.args),
               entry.duration,
               entry.success ? 1 : 0,
-              entry.error ?? null,
+              entry.error === undefined ? null : redactSensitiveText(entry.error),
               entry.exitCode ?? null,
             ],
           );
@@ -317,7 +318,7 @@ export const withAudit = <A, E, R>(
   Effect.suspend(() => {
     const startedAt = Date.now();
     const project = process.cwd();
-    const args = process.argv.slice(2).join(" ");
+    const args = redactSensitiveText(process.argv.slice(2).join(" "));
     const tool = safeToolName(toolName || deriveToolNameFromArgv());
 
     return Effect.matchCauseEffect(program, {
@@ -332,7 +333,7 @@ export const withAudit = <A, E, R>(
             args,
             duration: Date.now() - startedAt,
             success: pureHelp,
-            error: pureHelp ? undefined : formatCause(cause),
+            error: pureHelp ? undefined : redactSensitiveText(formatCause(cause)),
             exitCode: pureHelp ? 0 : extractExitCode(cause),
           }),
           () => Effect.failCause(cause),