@blogic-cz/agent-tools 1.5.9 → 1.5.11

package/README.md

@@ -612,6 +612,10 @@ The guard blocks agents from accessing sensitive files, leaking secrets, and run
 
 GitHub text and file publication, database queries, Azure and Kubernetes command arguments, and observability requests are checked before execution. GitHub file uploads use snapshots of the inspected bytes. Generated release notes and existing pending reviews or draft releases are inspected before publication. Authentication headers and connection credentials remain inside the tools.
 
+GitHub API requests validate the serialized body that will be sent, including JSON keys and decoded string values. Serialization happens once, before authentication lookup or network access. File publication checks both the supplied path and its resolved target against known credential locations before reading content. This includes SSH, AWS, Kubernetes, Azure, and common CLI credential stores. An unknown filename can still contain credentials, so content checks also apply.
+
+The two direct GitHub CLI launch paths receive an explicit environment containing supported GitHub authentication, host/configuration, proxy/CA, and platform variables. Unrelated parent variables and runtime loader settings are not inherited. Other tools retain their own environment contracts; this does not isolate the parent agent or prevent GitHub CLI access to its configured credential files.
+
 Results retain their JSON or TOON structure, with detected credentials replaced by `[REDACTED]`. Audit records are sanitized before storage; reading older records also sanitizes the returned content but does not rewrite the database.
 
 These checks apply to these wrappers. They do not intercept arbitrary shell programs or other agent tools. GitHub does not offer an atomic content-version condition for submitting pending reviews or publishing existing drafts, so a concurrent remote edit between inspection and publication remains possible.
@@ -654,6 +658,8 @@ Paths are checked against sensitive filename patterns and configured path rules.
 
 Single literal `echo`/`printf` writes with output redirection and single `cat`/`tee` heredoc writes are allowed. Heredoc braces are data. Use a quoted delimiter for literal code; unquoted heredocs containing `$`, backticks, or backslashes do not receive the literal-write exception. The exception permits only supported combinations with navigation or selected inspections; unsupported following commands remain outside it. Supported complete Python stdin heredocs are checked as inline programs, with the normal runtime-argument, path, execution, and environment checks.
 
+Python JSON parsing, dictionary iteration, and printing are not themselves evidence of credential access. They follow the same access and execution rules as other supported inline programs. This intentionally permits ordinary JSON output that older versions refused. Unknown secrets in ordinary files can therefore reach arbitrary shell output; wrapper content checks do not protect that output. A refusal caused by unsupported syntax means the guard could not establish its policy conditions, not that it observed a secret being read.
+
 A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
 
 ### Setup for OpenCode

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA07DF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAiTrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UArxED,SAAS,UAAU,UAAU,KAAK,IAqxEM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAvxEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAuxEjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAzxEE,MAAM,KAAK,OAyxEgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA3xEE,MAAM,KAAK,OA2xEgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA7xEC,MAAM,KAAK,OA6xE0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA/xEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA+xEf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAjyEC,MAAM,KAAK,OAiyEsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAnyEC,MAAM,KAAK,MAAM,GAAG,IAmyEa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAg7DF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAiTrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA3wED,SAAS,UAAU,UAAU,KAAK,IA2wEM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA7wEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA6wEjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA/wEE,MAAM,KAAK,OA+wEgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAjxEE,MAAM,KAAK,OAixEgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAnxEC,MAAM,KAAK,OAmxE0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YArxEC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAqxEf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAvxEC,MAAM,KAAK,OAuxEsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAzxEC,MAAM,KAAK,MAAM,GAAG,IAyxEa,CAAC"}

package/dist/gh-tool/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/gh-tool/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,EAAE,eAAe,EAA2C,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAU/C,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;CACT,CAAC;AAYF,eAAO,MAAM,kBAAkB,qDA4B7B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AA4FF,eAAO,MAAM,SAAS,GAAI,CAAC,QACnB,gBAAgB,KACrB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,cAAc,CAQjD,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/gh-tool/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,OAAO,EAAE,eAAe,EAA2C,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAW/C,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,CAAC;CACT,CAAC;AAYF,eAAO,MAAM,kBAAkB,qDA6B7B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAuFF,eAAO,MAAM,SAAS,GAAI,CAAC,QACnB,gBAAgB,KACrB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,cAAc,CAqCjD,CAAC"}

package/dist/gh-tool/environment.d.ts

@@ -0,0 +1,2 @@
+export declare const ghEnvironment: (environment?: Record<string, string | undefined>) => Record<string, string>;
+//# sourceMappingURL=environment.d.ts.map

package/dist/gh-tool/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/gh-tool/environment.ts"],"names":[],"mappings":"AAyCA,eAAO,MAAM,aAAa,iBACX,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAMrB,CAAC"}

package/dist/gh-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/gh-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,aAAa,EAA4C,MAAM,SAAS,CAAC;AA4DlF,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,kBAAkB,GAAG,eAAe,GAAG,mBAAmB,CAAC;;oBAK7D,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC/C,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;yBACf,CAAC,CAAC,EACrB,IAAI,EAAE,gBAAgB,KACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;4BACzB,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,CAAC;0BAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;6BACnC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,CAAC;;AAjBpD,qBAAa,aAAc,SAAQ,kBAmBF;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,6FAyRnB;CACH"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/gh-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,aAAa,EAA4C,MAAM,SAAS,CAAC;AA4DlF,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,kBAAkB,GAAG,eAAe,GAAG,mBAAmB,CAAC;;oBAK7D,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC/C,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;yBACf,CAAC,CAAC,EACrB,IAAI,EAAE,gBAAgB,KACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;4BACzB,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,CAAC;0BAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;6BACnC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,CAAC;;AAjBpD,qBAAa,aAAc,SAAQ,kBAmBF;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,6FA0RnB;CACH"}

package/dist/gh-tool/text-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text-input.d.ts","sourceRoot":"","sources":["../../src/gh-tool/text-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AASpE,QAAA,MAAM,WAAW,wDAAgD,CAAC;AAIlE,eAAO,MAAM,eAAe,aAAc,MAAM,YACmB,CAAC;AAEpE,eAAO,MAAM,oBAAoB,SAAU,MAAM,WAAW,MAAM,0FAYjE,CAAC;AAEF,eAAO,MAAM,yBAAyB,aAAc,MAAM,WAAW,MAAM;;;6BAUH,CAAC;AAEzE,eAAO,MAAM,oBAAoB,aAAc,MAAM,WAAW,MAAM,mDACJ,CAAC;AAuBnE,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAwFF,eAAO,MAAM,wBAAwB,YAC1B,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,KACrE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAIuD,CAAC;AAEnG,eAAO,MAAM,wBAAwB,YAC1B,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,KACrE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,kBAAkB,CAI9C,CAAC;AAEL,eAAO,MAAM,uBAAuB,YACzB,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,GAAG;IACvE,YAAY,EAAE,MAAM,CAAC;CACtB,KACA,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAKsD,CAAC"}
+{"version":3,"file":"text-input.d.ts","sourceRoot":"","sources":["../../src/gh-tool/text-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAepE,QAAA,MAAM,WAAW,wDAAgD,CAAC;AAIlE,eAAO,MAAM,eAAe,aAAc,MAAM,YACyC,CAAC;AAE1F,eAAO,MAAM,oBAAoB,SAAU,MAAM,WAAW,MAAM,0FAYjE,CAAC;AAEF,eAAO,MAAM,yBAAyB,aAAc,MAAM,WAAW,MAAM;;;6BAUH,CAAC;AAEzE,eAAO,MAAM,oBAAoB,aAAc,MAAM,WAAW,MAAM,mDACJ,CAAC;AAuBnE,KAAK,uBAAuB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAwFF,eAAO,MAAM,wBAAwB,YAC1B,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,KACrE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAIuD,CAAC;AAEnG,eAAO,MAAM,wBAAwB,YAC1B,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,KACrE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,kBAAkB,CAI9C,CAAC;AAEL,eAAO,MAAM,uBAAuB,YACzB,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,cAAc,CAAC,GAAG;IACvE,YAAY,EAAE,MAAM,CAAC;CACtB,KACA,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAKsD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.5.9",
+  "version": "1.5.11",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -478,7 +478,7 @@ function unwrapProofCommand(words: string[], marker: string): string[] | undefin
 function isLiteralLoopCommand(words: string[], marker: string, value: string): boolean {
   const marked = unwrapProofCommand(words, marker);
   if (!marked) return false;
-  const argv = marked.map((word) => word.replaceAll(marker, value));
+  const argv = marked.map((word) => word.replaceAll(marker, () => value));
   const name = argv[0];
   const uses = marked.flatMap((word, index) => (word.includes(marker) ? [index] : []));
   if (name === "cat")
@@ -579,7 +579,7 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
     );
     if (size > 65_536) return undefined;
     return {
-      command: values.map((value) => marked.text.replaceAll(marker, value)).join(";\n"),
+      command: values.map((value) => marked.text.replaceAll(marker, () => value)).join(";\n"),
       paths: [],
     };
   }
@@ -621,8 +621,11 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
       (assignment[1]?.length ?? 0) +
       7;
     if (size > 65_536) return undefined;
-    const paths = argv.slice(3).map((word) => word.replaceAll(marker, value));
-    return { command: `cd ${assignment[1]} && ${use.replaceAll(marker, value)}${suffix}`, paths };
+    const paths = argv.slice(3).map((word) => word.replaceAll(marker, () => value));
+    return {
+      command: `cd ${assignment[1]} && ${use.replaceAll(marker, () => value)}${suffix}`,
+      paths,
+    };
   }
   // Only the observed rg -n PATTERN PATH form; marker position proves a real file operand.
   const brace =
@@ -662,7 +665,7 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
     new TextEncoder().encode(command.slice(0, start)).byteLength +
     values.reduce((total, value) => total + path.length - members[0].length + value.length + 1, -1);
   if (size > 65_536) return undefined;
-  const paths = values.map((member) => path.replace(members[0], member));
+  const paths = values.map((member) => path.replace(members[0], () => member));
   return { command: command.slice(0, start) + paths.join(" "), paths };
 }
 
@@ -770,7 +773,7 @@ function normalizeProgramHeredocs(command: string): string {
   if (!/-\s*$/.test(heredoc.header)) return command;
   const quoted = "'" + heredoc.body.replaceAll("'", "'\"'\"'") + "'";
   return (
-    heredoc.header.replace(/-\s*$/, "-c " + quoted) +
+    heredoc.header.replace(/-\s*$/, () => "-c " + quoted) +
     "\n" +
     normalizeProgramHeredocs(heredoc.following)
   );
@@ -987,7 +990,7 @@ function inlinePackageCommands(command: string, allowInventory: boolean): string
             position === 2
               ? program.replace(
                   /\brequire\s*\(\s*(["'])\.\/\1\s*\+\s*[a-z]\s*\)/,
-                  `require(${JSON.stringify(path)})`,
+                  () => `require(${JSON.stringify(path)})`,
                 )
               : word;
           return "'" + materialized.replaceAll("'", "'\"'\"'") + "'";
@@ -997,18 +1000,6 @@ function inlinePackageCommands(command: string, allowInventory: boolean): string
   });
 }
 
-/** JSON values selected by arbitrary keys or printed wholesale have no metadata proof. */
-function hasUnverifiedJsonValueOutput(code: string): boolean {
-  if (!/\bjson\.loads?\s*\(/.test(code) || !/\bprint\s*\(/.test(code)) return false;
-  if (/\.items\s*\(/.test(code) || /\bprint\s*\(\s*json\.loads?\s*\(/.test(code)) return true;
-  const names = [...code.matchAll(/\b([A-Za-z_]\w*)\s*=\s*json\.loads?\s*\(/g)].map(
-    (match) => match[1] ?? "",
-  );
-  return names.some((name) =>
-    new RegExp(`\\bprint\\s*\\(\\s*(?:json\\.dumps\\s*\\(\\s*)?${name}\\s*[,)]`).test(code),
-  );
-}
-
 function hasInlineProgramExecution(
   program: string,
   python: boolean,
@@ -1016,7 +1007,6 @@ function hasInlineProgramExecution(
 ): boolean {
   const parts = programParts(program, python);
   if (!parts) return true;
-  if (python && hasUnverifiedJsonValueOutput(parts.code)) return true;
   if (parts.loadedModules.some((name) => /^(?:node:)?vm$/.test(name))) return true;
   // Dynamic loading and reflective access cannot establish a non-executing code operand.
   if (
@@ -1842,7 +1832,7 @@ function hasEnvironmentVariableExpansionRead(
   if (invalidExpansion) return true;
 
   const localMaterialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, value),
+    (text, [marker, value]) => text.replaceAll(marker, () => value),
     normalized,
   );
   // Options must be checked after local literals become actual argv, never as placeholders.
@@ -1900,7 +1890,7 @@ function hasEnvironmentVariableExpansionRead(
     }
   }
   const materialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, value),
+    (text, [marker, value]) => text.replaceAll(marker, () => value),
     normalized.replaceAll("ENVVALUE", "SAFEENVVALUE"),
   );
   return hasSensitiveFileRead(materialized, isPathBlocked);
@@ -2137,7 +2127,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     const rawEnvironmentSource =
       mentionsEnvironmentSource(command) && mentionsInlineRuntime(command);
     if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
-      return "reads process environment after an unproved environment mutation";
+      return "blocked by the environment/execution policy after an unproved environment mutation";
     command = normalizeProgramHeredocs(command);
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
@@ -2158,19 +2148,19 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     if (
       hasSensitiveFileRead(command, isPathBlocked) ||
       hasSensitivePathRedirect(command, isPathBlocked)
-    ) {
-      return "accesses a sensitive file path";
-    }
+    )
+      return "blocked by the file-access policy; a sensitive path matched or this command form could not be verified";
     if (
       !isLiteralTextWrite(command) &&
       hasEnvironmentVariableExpansionRead(command, allowedEnvironmentVariables, isPathBlocked)
     ) {
       return "expands an unapproved or executable environment variable value";
     }
-    if (hasEnvironmentSourceAccess(command, rawEnvironmentSource))
-      return "reads process environment from a script";
-    if (hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)) {
-      return "reads environment variables or passes them to an executor";
+    if (
+      hasEnvironmentSourceAccess(command, rawEnvironmentSource) ||
+      hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)
+    ) {
+      return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";
     }
     if (
       dangerousBashPatterns.some(
@@ -2263,7 +2253,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
       if (error instanceof Error) {
         if (sanitized !== message) {
           error.message = sanitized;
-          if (error.stack) error.stack = error.stack.replace(message, sanitized);
+          if (error.stack) error.stack = error.stack.replace(message, () => sanitized);
         }
         throw error;
       }
@@ -2319,7 +2309,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
         throw new Error(
           `\u{1F6AB} Command blocked: ${dangerousReason}; this command might expose secrets.\n\n` +
             `Command: ${command}\n\n` +
-            `If you need environment info, ask the user directly.\n\n` +
+            `Use a supported command form or the appropriate wrapper tool.\n\n` +
             `Think this is wrong? Review the project repository, adjust the patterns, and submit a PR.`,
         );
       }

package/src/gh-tool/api.ts

@@ -4,6 +4,7 @@ import { retryTransient } from "#shared/retry-transient";
 
 import { GitHubAuthError, GitHubCommandError, GitHubNotFoundError } from "./errors";
 import type { GitHubApiError } from "./errors";
+import { ghEnvironment } from "./environment";
 import { validateOutboundText } from "./text-input";
 
 // Direct HTTP, not `gh api`: the CLI collapses every failure into a non-zero exit and
@@ -44,6 +45,7 @@ export const resolveGitHubToken = Effect.fn("gh.resolveGitHubToken")(function* (
       const proc = Bun.spawn(["gh", "auth", "token", "--hostname", "github.com"], {
         stdout: "pipe",
         stderr: "ignore",
+        env: ghEnvironment(),
       });
       const stdout = await new Response(proc.stdout).text();
       const exitCode = await proc.exited;
@@ -67,27 +69,22 @@ export type GitHubApiRequest = {
 
 const MAX_API_RETRIES = 2;
 
-const outboundBodyText = (value: unknown): string => {
+// Traverse only parsed JSON, never the caller's getters or toJSON hooks.
+const decodedBodyText = (value: unknown): string => {
   if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value.map(outboundBodyText).join("\n");
+  if (Array.isArray(value)) return value.map(decodedBodyText).join("\n");
   if (value !== null && typeof value === "object")
-    return Object.values(value).map(outboundBodyText).join("\n");
+    return Object.entries(value)
+      .map(([key, item]) => `${key}\n${decodedBodyText(item)}`)
+      .join("\n");
   return "";
 };
 
-const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(opts: GitHubApiRequest) {
+const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(
+  opts: GitHubApiRequest,
+  serializedBody: string | undefined,
+) {
   const method = opts.method ?? "GET";
-  const bodyText = yield* Effect.try({
-    try: () => outboundBodyText(opts.body),
-    catch: () =>
-      new GitHubCommandError({
-        command: `gh-tool ${method} ${opts.path}`,
-        exitCode: 1,
-        stderr: "Refusing to publish an invalid request body",
-        message: "Refusing to publish an invalid request body",
-      }),
-  });
-  yield* validateOutboundText(`${opts.path}\n${bodyText}`, `gh-tool ${method} ${opts.path}`);
   const token = yield* resolveGitHubToken();
   const url = `${GITHUB_API_ROOT}/${opts.path.replace(/^\//, "")}`;
 
@@ -99,9 +96,9 @@ const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(opts: Gi
           Accept: GITHUB_ACCEPT,
           Authorization: `Bearer ${token}`,
           "X-GitHub-Api-Version": GITHUB_API_VERSION,
-          ...(opts.body === undefined ? {} : { "Content-Type": "application/json" }),
+          ...(serializedBody === undefined ? {} : { "Content-Type": "application/json" }),
         },
-        ...(opts.body === undefined ? {} : { body: JSON.stringify(opts.body) }),
+        ...(serializedBody === undefined ? {} : { body: serializedBody }),
       }),
     catch: (cause) =>
       new GitHubCommandError({
@@ -158,13 +155,42 @@ const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(opts: Gi
 export const githubApi = <T>(
   opts: GitHubApiRequest,
 ): Effect.Effect<GitHubApiResponse<T>, GitHubApiError> =>
-  retryTransient({
-    attempt: () => githubApiAttempt<T>(opts),
-    isTransient: (error) =>
-      error._tag === "GitHubCommandError" &&
-      error.retryable === true &&
-      (opts.method ?? "GET") === "GET",
-    maxRetries: MAX_API_RETRIES,
+  Effect.gen(function* () {
+    const snapshot = yield* Effect.try({
+      try: () => {
+        const path = opts.path;
+        const method = opts.method ?? "GET";
+        const alsoAcceptStatus = opts.alsoAcceptStatus;
+        const request = {
+          path,
+          method,
+          ...(alsoAcceptStatus === undefined ? {} : { alsoAcceptStatus: [...alsoAcceptStatus] }),
+        };
+        const body = opts.body;
+        if (body === undefined) return { request, serialized: undefined, decoded: "" };
+        const serialized = JSON.stringify(body);
+        if (serialized === undefined) throw new Error("Body is not JSON serializable");
+        return { request, serialized, decoded: decodedBodyText(JSON.parse(serialized)) };
+      },
+      catch: () =>
+        new GitHubCommandError({
+          command: "gh-tool API",
+          exitCode: 1,
+          stderr: "Refusing to publish an invalid request body",
+          message: "Refusing to publish an invalid request body",
+        }),
+    });
+    const { request } = snapshot;
+    yield* validateOutboundText(
+      `${request.path}\n${snapshot.serialized ?? ""}\n${snapshot.decoded}`,
+      `gh-tool ${request.method} ${request.path}`,
+    );
+    return yield* retryTransient({
+      attempt: () => githubApiAttempt<T>(request, snapshot.serialized),
+      isTransient: (error) =>
+        error._tag === "GitHubCommandError" && error.retryable === true && request.method === "GET",
+      maxRetries: MAX_API_RETRIES,
+    });
   });
 
 const safeJsonParse = (text: string): unknown => {

package/src/gh-tool/environment.ts

@@ -0,0 +1,50 @@
+// Exact names only: GH children need their own auth/config, not unrelated credentials
+// or executable-loader, editor, and pager settings from the parent process.
+const GH_ENVIRONMENT_NAMES = [
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "APPDATA",
+  "AppData",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "SYSTEMROOT",
+  "SystemRoot",
+  "WINDIR",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "XDG_CONFIG_HOME",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "GH_CONFIG_DIR",
+  "GH_HOST",
+  "GH_REPO",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "GITHUB_ENTERPRISE_TOKEN",
+  "HTTP_PROXY",
+  "http_proxy",
+  "HTTPS_PROXY",
+  "https_proxy",
+  "ALL_PROXY",
+  "all_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+] as const;
+
+export const ghEnvironment = (
+  environment: Record<string, string | undefined> = process.env,
+): Record<string, string> =>
+  Object.fromEntries(
+    GH_ENVIRONMENT_NAMES.flatMap((name) => {
+      const value = environment[name];
+      return value === undefined ? [] : [[name, value]];
+    }),
+  );

package/src/gh-tool/service.ts

@@ -5,6 +5,7 @@ import type { GitHubRepoConfig } from "#config";
 import type { RepoInfo } from "./types";
 
 import { GH_BINARY } from "./config";
+import { ghEnvironment } from "./environment";
 import { GitHubAuthError, GitHubCommandError, GitHubNotFoundError } from "./errors";
 import { retryTransient } from "#shared/retry-transient";
 import { githubApi } from "./api";
@@ -165,7 +166,8 @@ export class GitHubService extends Context.Service<
               const command = ChildProcess.make(GH_BINARY, args, {
                 stdout: "pipe",
                 stderr: "pipe",
-                ...(ghRepo ? { env: { GH_REPO: ghRepo }, extendEnv: true } : {}),
+                env: { ...ghEnvironment(), ...(ghRepo ? { GH_REPO: ghRepo } : {}) },
+                extendEnv: false,
               });
 
               const proc = yield* executor.spawn(command);

package/src/gh-tool/text-input.ts

@@ -12,13 +12,19 @@ const SENSITIVE_PATH_PATTERNS = [
   /\.envrc$/,
   /\.(pem|key|p12|pfx|cer|crt)$/i,
   /(?:^|[\\/])(credentials?|passwd|shadow)$/i,
+  /(?:^|\/)(?:\.ssh|\.aws|\.kube|\.azure|secrets?|credentials?)(?:\/|$)/i,
+  /(?:^|\/)(?:\.npmrc|\.netrc|\.git-credentials|\.sentryclirc|\.pypirc|\.pgpass)$/i,
+  /(?:^|\/)\.docker\/config\.json$/i,
+  /(?:^|\/)\.config\/gh\/hosts\.yml$/i,
+  /(?:^|\/)GitHub CLI\/hosts\.yml$/i,
+  /(?:^|\/)(?:kubeconfig(?:[.-].+)?|[^/]+\.kubeconfig)$/i,
 ];
 const MissingMode = Schema.Literals(["error", "null", "default"]);
 
 const readTextFromStdin = () => Bun.stdin.text();
 
 export const isSensitivePath = (filePath: string) =>
-  SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(filePath));
+  SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(filePath.replaceAll("\\", "/")));
 
 export const validateOutboundText = (text: string, command: string) => {
   const reason = unsafeOutboundTextReason(text);

package/src/shared/bun.ts

@@ -6,7 +6,7 @@ export function expandPath(path: string): string {
     if (!home || home.trim() === "") {
       throw new Error("HOME environment variable not set");
     }
-    return path.replace("~", home);
+    return home + path.slice(1);
   }
   return path;
 }