@blogic-cz/agent-tools 1.6.4 → 1.6.5

package/README.md

@@ -672,6 +672,8 @@ The bounded Python subprocess proof supports one immutable literal argv binding
 
 Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with the existing literal agent-get and pane-read forms and passive consumers. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
 
+Literal shell bodies receive recursive shared policy replay under exact `sh -c`/`bash -c` and `zsh -f -c` invocations, using only these bare executable names or their `/bin/` and `/usr/bin/` paths and known RTK/command wrappers. Both protected paths and blocked CLIs remain enforced inside the body, along with environment and custom-command policies. A conventional shell-family name or numeric version in an unproved executing operand/control position refuses; proved literal text, reader and file-metadata operands remain data. Only the listed sh/bash/zsh identities receive body replay; rbash/rksh/ksh93 and versioned names refuse, and arbitrary renamed executables are outside this identity proof. Replay permits only existing closed body roles/materializations, at most eight shell levels and 64 KiB per invocation. Unproved options, environment prefixes, active exec/nohup/sudo wrappers, positional/script/stdin forms, executable binders, control flow and outer directory changes around a wrapper refuse. A body-internal proved cd affects body readers; outer redirects retain the outer shell directory. This is a textual body proof, not verification of native binaries or all host startup code. In particular, zsh -f still sources the global zshenv file. For unsupported executable inventories, use separate literal metadata requests and literal candidate invocations; no program name or --version flag receives a special exception.
+
 A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
 
 ### Setup for OpenCode

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAwhFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA93FD,SAAS,UAAU,UAAU,KAAK,IA83FM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAh4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAg4FjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAl4FE,MAAM,KAAK,OAk4FgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAp4FE,MAAM,KAAK,OAo4FgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAt4FC,MAAM,KAAK,OAs4F0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAx4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAw4Ff,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA14FC,MAAM,KAAK,OA04FsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA54FC,MAAM,KAAK,MAAM,GAAG,IA44Fa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA2oFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4VrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAjhGD,SAAS,UAAU,UAAU,KAAK,IAihGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAnhGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAmhGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aArhGE,MAAM,KAAK,OAqhGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAvhGE,MAAM,KAAK,OAuhGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAzhGC,MAAM,KAAK,OAyhG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA3hGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA2hGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA7hGC,MAAM,KAAK,OA6hGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/hGC,MAAM,KAAK,MAAM,GAAG,IA+hGa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -530,6 +530,114 @@ function isLiteralHerdrRead(argv: string[]): boolean {
   );
 }
 
+/** Conventional platform shell names and numeric versions; not arbitrary renamed executables. */
+function isShellWord(word: string): boolean {
+  return /^(?:sh|bash|rbash|zsh|dash|ash|ksh|rksh|csh|tcsh|fish)(?:[.-]?[0-9]+(?:[.][0-9]+)*)?$/.test(
+    word.split("/").at(-1) ?? "",
+  );
+}
+
+/** Shell-named operands are data only under an existing non-executing argument role. */
+function hasProvedShellDataOperands(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (isPassiveTextCommand(argv) || isLiteralHerdrRead(argv) || isStaticNavigationCommand(argv))
+    return true;
+  if (["cat", "ls", "uniq", "cut"].includes(name)) return true;
+  if (["find", "wc", "sort"].includes(name)) return isProvedCwdSubprocessRole(argv);
+  return name === "test" && argv.length === 3 && argv[1] === "-e" && !/[$`]/.test(argv[2] ?? "");
+}
+
+const SHELL_IDENTITIES = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "/bin/sh",
+  "/usr/bin/sh",
+  "/bin/bash",
+  "/usr/bin/bash",
+  "/bin/zsh",
+  "/usr/bin/zsh",
+]);
+
+/** Literal argv only. Undefined means a shell was found without a complete invocation proof. */
+function literalShellBodies(command: string): string[] | undefined {
+  const parsed = parseStaticShellCommands(command);
+  const operands = parsed ?? parseStaticShellCommands(command, true);
+  if (!operands || typeof operands === "string") return [];
+  const commands = operands.pipelines.flat();
+  if (
+    commands.some((words) =>
+      ["exec", "nohup", "sudo"].includes(unwrapStaticCommand(words)[0]?.split("/").at(-1) ?? ""),
+    )
+  )
+    return undefined;
+  for (const words of commands) {
+    const argv = unwrapStaticCommand(words);
+    if (
+      !isShellWord(argv[0] ?? "") &&
+      argv.some(
+        (word, index) =>
+          index !== inlineProgramIndex(argv) &&
+          (isShellWord(word) ||
+            (/^--?[A-Za-z0-9-]+=/.test(word) && isShellWord(word.slice(word.indexOf("=") + 1)))),
+      ) &&
+      !hasProvedShellDataOperands(argv) &&
+      !isStaticHerdrPrompt(command)
+    )
+      return undefined;
+  }
+  const shells = commands.filter((words) => isShellWord(unwrapStaticCommand(words)[0] ?? ""));
+  if (!shells.length) return [];
+  if (
+    !parsed ||
+    typeof parsed === "string" ||
+    !literalBindingText(command, "", "") ||
+    new TextEncoder().encode(command).byteLength > 65_536 ||
+    commands.some((words) => unwrapStaticCommand(words)[0]?.split("/").at(-1) === "cd")
+  )
+    return undefined;
+  const bodies: string[] = [];
+  for (const words of shells) {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv || !SHELL_IDENTITIES.has(argv[0] ?? "")) return undefined;
+    const name = argv[0]?.split("/").at(-1);
+    if (argv.length === 2 && ["--version", "--help"].includes(argv[1] ?? "")) continue;
+    const index = name === "zsh" && argv[1] === "-f" ? 2 : 1;
+    if ((name === "zsh" && index !== 2) || argv[index] !== "-c" || argv.length !== index + 2)
+      return undefined;
+    bodies.push(argv[index + 1] ?? "");
+  }
+  return bodies;
+}
+
+function isProvedLiteralShellBody(body: string): boolean {
+  if (!body.trim()) return true;
+  const materialized = materializeLiteralShell(body)?.command ?? body;
+  const parsed = parseStaticShellCommands(materialized);
+  if (!parsed || typeof parsed === "string" || !hasProvedNavigationSequence(materialized))
+    return false;
+  if (isStaticHerdrPrompt(materialized)) return true;
+  return parsed.pipelines.flat().every((words) => {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv) return false;
+    if (argv[0]?.split("/").at(-1) === "env") return false;
+    const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
+    if (isShellWord(name))
+      return (
+        literalShellBodies(
+          words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
+        ) !== undefined
+      );
+    return (
+      isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
+      (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
+      isStaticNavigationCommand(argv) ||
+      isLiteralHerdrRead(argv) ||
+      (argv.length === 1 && ["true", "false", "pwd"].includes(name))
+    );
+  });
+}
+
 /** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
 function isLiteralStdinJsonDisplay(argv: string[]): boolean {
   if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
@@ -1858,6 +1966,7 @@ function hasEnvironmentRead(
   command: string,
   allowedNames: Set<string>,
   allowInventory = hasProvedPackageInventoryInvocation(command),
+  replayedShellBodies: string[] = [],
 ): boolean {
   if (isStaticHerdrPrompt(command)) return false;
   if (isHerdrPrompt(command)) return true;
@@ -1926,7 +2035,13 @@ function hasEnvironmentRead(
   ) {
     return true;
   }
-  if (unwrapped.some((argv) => hasStaticEnvironmentRead(argv, allowedNames, allowInventory))) {
+  if (
+    unwrapped.some(
+      (argv) =>
+        !(SHELL_IDENTITIES.has(argv[0] ?? "") && replayedShellBodies.includes(argv.at(-1) ?? "")) &&
+        hasStaticEnvironmentRead(argv, allowedNames, allowInventory),
+    )
+  ) {
     return true;
   }
 
@@ -2743,7 +2858,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     return getDangerousBashReason(command) !== null;
   }
 
-  function getDangerousBashReason(command: string): string | null {
+  function getDangerousBashReason(command: string, shellDepth = 0): string | null {
     const originalCommand = command;
     const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
     const rawEnvironmentSource =
@@ -2757,20 +2872,30 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
       return "blocked by the environment/execution policy after an unproved environment mutation";
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (!shellBodies || (shellBodies.length && shellDepth >= 8))
+      return "cannot prove a bounded literal shell invocation";
+    for (const body of shellBodies) {
+      const reason = getDangerousBashReason(body, shellDepth + 1);
+      if (reason || getBlockedCliTool(body, true, shellDepth + 1))
+        return reason ?? "invokes a blocked CLI from a shell body";
+      if (!isProvedLiteralShellBody(body)) return "cannot prove a closed literal shell body";
+    }
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
     if (proof) {
       if (proof.paths.some((path) => hasSensitiveFileRead("cat " + path, isPathBlocked)))
         return "accesses a sensitive file path";
       command = proof.command;
-      if (getBlockedCliTool(command)) return "invokes a blocked CLI from a literal expansion";
+      if (getBlockedCliTool(command, true, shellDepth))
+        return "invokes a blocked CLI from a literal expansion";
     }
     for (const nested of [
       ...inlineSubprocessCommands(command),
       ...inlinePackageCommands(command, allowPackageInventory),
     ]) {
-      const reason = getDangerousBashReason(nested);
-      if (reason || getBlockedCliTool(nested))
+      const reason = getDangerousBashReason(nested, shellDepth);
+      if (reason || getBlockedCliTool(nested, true, shellDepth))
         return reason ?? "invokes a blocked CLI from a script";
     }
     if (
@@ -2786,7 +2911,21 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     }
     if (
       hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
-      hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)
+      hasEnvironmentRead(
+        command,
+        allowedEnvironmentVariables,
+        allowPackageInventory,
+        shellBodies.filter((body) => {
+          const parsed = parseStaticShellCommands(body);
+          return (
+            parsed &&
+            typeof parsed !== "string" &&
+            parsed.pipelines
+              .flat()
+              .every((words) => isPassiveTextCommand(unwrapStaticCommand(words)))
+          );
+        }),
+      )
     ) {
       return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";
     }
@@ -2828,16 +2967,24 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
   function getBlockedCliTool(
     command: string,
     expand = true,
+    shellDepth = 0,
   ): { name: string; wrapper: string } | null {
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (shellBodies && shellDepth < 8) {
+      for (const body of shellBodies) {
+        const blocked = getBlockedCliTool(body, true, shellDepth + 1);
+        if (blocked) return blocked;
+      }
+    }
     const proof = expand ? materializeLiteralShell(command) : undefined;
     if (proof) {
-      const originalBlocked = getBlockedCliTool(command, false);
+      const originalBlocked = getBlockedCliTool(command, false, shellDepth);
       if (originalBlocked) return originalBlocked;
       command = proof.command;
     }
     for (const nested of inlineSubprocessCommands(command)) {
-      const blocked = getBlockedCliTool(nested);
+      const blocked = getBlockedCliTool(nested, true, shellDepth);
       if (blocked) return blocked;
     }
     const staticCommands = parseStaticShellCommands(command);