@blogic-cz/agent-tools 1.6.2 → 1.6.3

package/README.md

@@ -656,6 +656,8 @@ Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" s
 
 Literal `herdr agent prompt` commands can be composed with independent `cat` readers and passive text pipelines. Prompt text stays data; command substitutions, environment mutation, unknown consumers, and executable pipelines cannot establish the proof. All reader operands and redirects still receive the ordinary sensitive-path checks. Literal loops also support `herdr pane read ID --source recent-unwrapped --lines N`, with the binder restricted to `ID`, and `2>&1` file-descriptor duplication. A bounded Python stdin processor supports only `import json,sys; d=json.load(sys.stdin); print(d["result"].get("text","") if isinstance(d.get("result"),dict) else d)`, including insignificant spacing and single lowercase-letter local renaming. Extra imports, statements, calls, runtime options, arguments, and other Python programs cannot establish this loop proof. The existing loop size and command limits apply.
 
+Prompt composition also supports one `cd [--] PATH` with a literal relative or absolute directory at the start of the final `&&` chain. All subsequent inspection must remain in that chain, so a failed `cd` cannot reach its readers. Directory names may contain quoted spaces. Multiple `cd` commands, later `;` or newline boundaries, tilde or variable expansion, other `cd` options, background jobs, `||`, and navigation in pipelines remain unproved. Supported Git inspection can use literal `-C PATH` prefixes with `grep`, `status`, `rev-parse`, or `rev-list`; execution and startup options remain unsupported. Navigation composition refuses relative file redirects, including redirects on `cd` and Git commands, because those use the shell directory before the command runs. Absolute redirects still receive ordinary path checks. Named directories receive sensitive-path checks with directory-prefix semantics. Only a proved `cd` chain qualifies relative reader operands with that directory; Git `-C` qualifies that command's file operands without changing shell state. Git grep uses the shared grep pattern-versus-file checks. This checks textual operands and does not resolve aliases, symlinks, ambient directories, or command lookup.
+
 The guard recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes and checks commands in pipelines and chains. Quoted filenames, comments, and redirects retain sensitive-path checks. Jq object selectors and inline awk programs qualify only when their actual program and options establish passive behavior. Literal environment-command text in `rg`, `grep`, `git grep`, `echo`, and `printf` is allowed only with supported command roles and passive pipeline consumers. Environment-source evidence and startup identity checks also apply to the complete original invocation. Custom dangerous-command patterns apply to both the original input and proved expansions.
 
 Paths are checked against sensitive filename patterns and configured path rules. Supported proofs apply those checks to their expanded operands. Ordinary parent-directory and absolute paths may be allowed; the guard does not resolve filesystem paths or symlinks, or enforce repository confinement.

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6tEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAnkFD,SAAS,UAAU,UAAU,KAAK,IAmkFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YArkFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAqkFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAvkFE,MAAM,KAAK,OAukFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAzkFE,MAAM,KAAK,OAykFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA3kFC,MAAM,KAAK,OA2kF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA7kFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA6kFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA/kFC,MAAM,KAAK,OA+kFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAjlFC,MAAM,KAAK,MAAM,GAAG,IAilFa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAgzEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAtpFD,SAAS,UAAU,UAAU,KAAK,IAspFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAxpFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAwpFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA1pFE,MAAM,KAAK,OA0pFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA5pFE,MAAM,KAAK,OA4pFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA9pFC,MAAM,KAAK,OA8pF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAhqFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAgqFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAlqFC,MAAM,KAAK,OAkqFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YApqFC,MAAM,KAAK,MAAM,GAAG,IAoqFa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -1548,6 +1548,56 @@ function isNavigationOperand(argv: string[], marker: string): boolean {
   );
 }
 
+/** Literal directory operands only; navigation is never a pipeline consumer. */
+function isStaticNavigationCommand(argv: string[]): boolean {
+  const path = (value: string | undefined) => /^[A-Za-z0-9_./][A-Za-z0-9_./ -]*$/.test(value ?? "");
+  if (argv[0] === "cd")
+    return isNavigationOperand(argv, "\0") && path(argv[argv[1] === "--" ? 2 : 1]);
+  if (argv[0] !== "git") return false;
+  let index = 1;
+  while (argv[index] === "-C") {
+    if (!path(argv[index + 1])) return false;
+    index += 2;
+  }
+  return (
+    isNavigationOperand(argv, "\0") ||
+    (index > 1 && isPassiveTextCommand(["git", ...argv.slice(index)]))
+  );
+}
+
+/** Prove a single cd whose uses are gated on success, without simulating shell state. */
+function hasProvedNavigationSequence(command: string): boolean {
+  const literal = literalBindingText(command, "", "");
+  const parsed = parseStaticShellCommands(command);
+  if (!literal || !parsed || typeof parsed === "string") return false;
+  const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
+  const changesDirectory = commands.filter((argv) => argv?.[0] === "cd");
+  if (
+    !commands.some((argv) => argv && (argv[0] === "cd" || (argv[0] === "git" && argv[1] === "-C")))
+  )
+    return true;
+  if (
+    /\|\||(^|[^&])&(?!&)/.test(literal.syntax.replace(/[<>]&[0-9-]+/g, "")) ||
+    parsed.redirects.some(({ target }) => !target.startsWith("/")) ||
+    changesDirectory.length > 1
+  )
+    return false;
+  if (!changesDirectory.length) return true;
+  // Only the final AND list can use this directory. A failing cd never reaches its readers.
+  const syntax = literal.syntax.replace(/[ \t\n]+$/g, "");
+  const boundary = Math.max(syntax.lastIndexOf(";"), syntax.lastIndexOf("\n"));
+  const tail = parseStaticShellCommands(command.slice(boundary + 1, syntax.length));
+  if (!tail || typeof tail === "string" || tail.pipelines.length < 2) return false;
+  const first = tail.pipelines[0];
+  const argv = unwrapProofCommand(first?.[0] ?? [], "\0");
+  return (
+    first?.length === 1 &&
+    argv?.[0] === "cd" &&
+    isStaticNavigationCommand(argv) &&
+    syntax.slice(boundary + 1).match(/&&|[;&|\n]/)?.[0] === "&&"
+  );
+}
+
 function isPassiveTextCommand(argv: string[]): boolean {
   const name = argv[0]?.split("/").at(-1) ?? "";
   const args = argv.slice(1);
@@ -1627,13 +1677,15 @@ function hasStaticEnvironmentRead(
 
 function isStaticHerdrPrompt(command: string): boolean {
   // Preserve shell word boundaries and executable identity before proving composition.
-  if (!literalBindingText(command, "", "")) return false;
+  const literal = literalBindingText(command, "", "");
+  if (!literal) return false;
   const parsed = parseStaticShellCommands(command);
   if (!parsed || typeof parsed === "string") return false;
   const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
   const prompts = commands.filter(
     (argv) => argv?.[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt",
   );
+  if (!hasProvedNavigationSequence(command)) return false;
   return (
     prompts.length > 0 &&
     parsed.pipelines.every((pipeline) =>
@@ -1649,7 +1701,10 @@ function isStaticHerdrPrompt(command: string): boolean {
             argv.length > 1 &&
             argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))
           );
-        return isPassiveTextCommand(argv);
+        if (isPassiveTextCommand(argv)) return true;
+        if (isStaticNavigationCommand(argv))
+          return index === 0 && (argv[0] !== "cd" || pipeline.length === 1);
+        return false;
       }),
     )
   );
@@ -1836,13 +1891,41 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   const readers =
     /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find|shasum|sha1sum|sha256sum|sha512sum|md5sum|cksum)\b/i;
   if (parsed && parsed !== "brace-expansion") {
+    let directory = "";
+    const trackDirectory = hasProvedNavigationSequence(command);
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);
       const inspectedArgv =
         argv[0]?.split("/").at(-1) === "env" ? unwrapEnvironmentCommand(argv) : argv;
       if (inspectedArgv === null) return false;
-      const inspected = unwrapStaticCommand(inspectedArgv);
-      const name = inspected[0]?.split("/").at(-1) ?? "";
+      let inspected = unwrapStaticCommand(inspectedArgv);
+      let name = inspected[0]?.split("/").at(-1) ?? "";
+      let commandDirectory = directory;
+      const inDirectory = (path: string) =>
+        path.startsWith("/") ? posix.normalize(path) : posix.join(commandDirectory, path);
+      const blockedOperand = (path: string) =>
+        [path, inDirectory(path)].some((value) => isPathBlocked(value) || isSensitivePath(value));
+      const blockedDirectory = (path: string) => blockedOperand(path) || blockedOperand(path + "/");
+      if (name === "cd") {
+        const path = inspected[inspected[1] === "--" ? 2 : 1];
+        if (path === undefined) return false;
+        if (blockedDirectory(path)) return true;
+        if (trackDirectory && isStaticNavigationCommand(inspected)) directory = inDirectory(path);
+        return false;
+      }
+      if (name === "git") {
+        let index = 1;
+        while (inspected[index] === "-C" && inspected[index + 1]) {
+          if (blockedDirectory(inspected[index + 1] ?? "")) return true;
+          commandDirectory = inDirectory(inspected[index + 1] ?? "");
+          index += 2;
+        }
+        // Git grep has the same pattern-versus-file roles as grep below.
+        if (inspected[index] === "grep") {
+          inspected = ["grep", ...inspected.slice(index + 1)];
+          name = "grep";
+        }
+      }
       if (name === "bun" && inspected[1] === "run" && inspected[2] === "gh-tool") {
         return inspected.some((arg, index) => {
           const path =
@@ -1982,10 +2065,10 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
           }
           paths.push(arg);
         }
-        return paths.some((path) => isPathBlocked(path) || isSensitivePath(path));
+        return paths.some(blockedOperand);
       }
       const paths = name === "jq" ? jqFileArguments(inspected) : inspected.slice(1);
-      return paths.some((path) => isPathBlocked(path) || isSensitivePath(path));
+      return paths.some(blockedOperand);
     });
   }
   const operands = parseStaticShellCommands(command, true);