@blogic-cz/agent-tools 1.6.14 → 1.6.16

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA66FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA+XrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAt1GD,SAAS,UAAU,UAAU,KAAK,IAs1GM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAx1GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAw1GjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA11GE,MAAM,KAAK,OA01GgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA51GE,MAAM,KAAK,OA41GgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA91GC,MAAM,KAAK,OA81G0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAh2GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAg2Gf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAl2GC,MAAM,KAAK,OAk2GsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAp2GC,MAAM,KAAK,MAAM,GAAG,IAo2Ga,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA4+FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA+XrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAr5GD,SAAS,UAAU,UAAU,KAAK,IAq5GM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAv5GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAu5GjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAz5GE,MAAM,KAAK,OAy5GgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA35GE,MAAM,KAAK,OA25GgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA75GC,MAAM,KAAK,OA65G0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA/5GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA+5Gf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAj6GC,MAAM,KAAK,OAi6GsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAn6GC,MAAM,KAAK,MAAM,GAAG,IAm6Ga,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.14",
+  "version": "1.6.16",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -475,7 +475,9 @@ function unwrapProofCommand(words: string[], marker: string): string[] | undefin
   let index = 0;
   while (words[index] === "rtk" || words[index] === "command") {
     if (words[index++] === "rtk") {
-      if (words[index++] !== "proxy") return undefined;
+      if (words[index] === "proxy") index++;
+      // RTK forwards this verified external binary without changing its argv roles.
+      else if (words[index] !== "herdr") return undefined;
     } else if (words[index] === "--") index++;
   }
   if (words.slice(0, index + 1).some((word) => word.includes(marker))) return undefined;
@@ -1512,6 +1514,20 @@ function isJqObjectConstruction(argv: string[]): boolean {
   if (argv[index] === "--") index++;
   const filter = argv[index] ?? "";
   if (argv.slice(index + 1).some((arg) => arg.startsWith("-"))) return false;
+  // ponytail: one object-map level and one literal contains selector; no jq evaluator.
+  const field = String.raw`\.[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*`;
+  const key = String.raw`[A-Za-z_][A-Za-z0-9_]*`;
+  const flatEntry = String.raw`${key}(?:\s*:\s*${field})?`;
+  const flatObject = String.raw`\{\s*${flatEntry}(?:\s*,\s*${flatEntry})*\s*\}`;
+  const mapped = String.raw`${field}\s*\|\s*map\(\s*${flatObject}\s*\)`;
+  const value = String.raw`(?:${field}|${mapped}|\(\s*${mapped}\s*\))`;
+  const entry = String.raw`${key}(?:\s*:\s*${value})?`;
+  const object = String.raw`\{\s*${entry}(?:\s*,\s*${entry})*\s*\}`;
+  // JSON string escapes exclude jq interpolation, which starts with \(.
+  const string = String.raw`"(?:[^"\\\x00-\x1f]|\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4}))*"`;
+  const selector = String.raw`select\(\s*${field}\s*\|\s*contains\(\s*${string}\s*\)\s*\)`;
+  const traversal = String.raw`${field}(?:\[\])?\s*\|\s*(?:${selector}\s*\|\s*)?`;
+  if (new RegExp(String.raw`^(?:${traversal})?${object}$`).test(filter)) return true;
   const expression = filter
     .replace(/\.[A-Za-z_][A-Za-z0-9_.-]*/g, "FIELD")
     .replace(/\b[A-Za-z_][A-Za-z0-9_-]*\s*:/g, ":");
@@ -2004,6 +2020,51 @@ function isPassiveTextCommand(argv: string[]): boolean {
   );
 }
 
+/** Native data consumers only; ordinary path, expansion and redirect checks still apply. */
+function isReadonlyJqConsumer(argv: string[]): boolean {
+  if (isPassiveTextCommand(argv)) return true;
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (name === "sort")
+    return argv
+      .slice(1)
+      .every(
+        (arg) =>
+          !arg.startsWith("-") || arg === "-" || arg === "--" || /^-[bdfgMhnRruVszcC]+$/.test(arg),
+      );
+  if (name === "uniq") return isReadonlyUniqConsumer(argv);
+  if (["cat", "wc"].includes(name)) return isProvedCwdSubprocessRole(argv);
+  return name === "tr";
+}
+
+/** uniq INPUT is a read; uniq INPUT OUTPUT is a write and cannot acquire this proof. */
+function isReadonlyUniqConsumer(argv: string[]): boolean {
+  let operands = 0;
+  let options = true;
+  for (let index = 1; index < argv.length; index++) {
+    const arg = argv[index] ?? "";
+    if (options && arg === "--") {
+      options = false;
+      continue;
+    }
+    if (options) {
+      if (/^-[cduiz]+$|^--(?:count|repeated|unique|ignore-case|zero-terminated)$/.test(arg))
+        continue;
+      const short = /^-[fsw]([0-9]*)$/.exec(arg);
+      const long = /^--(?:skip-fields|skip-chars|check-chars)(?:=(.*))?$/.exec(arg);
+      if (short || long) {
+        const attached = short ? short[1] || undefined : long?.[1];
+        const value = attached === undefined ? argv[++index] : attached;
+        if (!/^[0-9]+$/.test(value ?? "")) return false;
+        continue;
+      }
+      if (arg.startsWith("-") && arg !== "-") return false;
+    }
+    options = false;
+    if (++operands > 1) return false;
+  }
+  return true;
+}
+
 /** One print program with optional numeric or escaped-regex addresses; no callbacks. */
 function isReadonlySedPrint(argv: string[]): boolean {
   if (argv[0]?.split("/").at(-1) !== "sed") return false;
@@ -2178,8 +2239,10 @@ function hasEnvironmentRead(
     pipelines.some((pipeline) =>
       pipeline.some(
         (argv, index) =>
-          literalSqlArgumentIndex(argv) !== undefined &&
-          pipeline.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer)),
+          (literalSqlArgumentIndex(argv) !== undefined &&
+            pipeline.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer))) ||
+          (isJqObjectConstruction(argv) &&
+            pipeline.slice(index + 1).some((consumer) => !isReadonlyJqConsumer(consumer))),
       ),
     )
   )