@blogic-cz/agent-tools 1.7.5 → 1.9.0

package/src/api-tool/proxy-entry.ts

@@ -3,7 +3,9 @@ import { startProxy } from "./server";
 import { readPrivateFile } from "./store";
 import { safeError } from "./errors";
 
-if (Bun.argv.length !== 4 || Bun.argv[2] !== "--config") {
+if (Bun.argv.length === 3 && (Bun.argv[2] === "--help" || Bun.argv[2] === "-h")) {
+  process.stdout.write("Usage: api-proxy --config /operator/private/operator.json\n");
+} else if (Bun.argv.length !== 4 || Bun.argv[2] !== "--config") {
   process.stderr.write("Usage: api-proxy --config /operator/private/operator.json\n");
   process.exitCode = 1;
 } else {

package/src/config/loader.ts

@@ -11,6 +11,7 @@ const CliToolOverrideSchema = Schema.Struct({
 });
 
 const CredentialGuardConfigSchema = Schema.Struct({
+  chainCopyDestinations: Schema.optionalKey(Schema.Array(Schema.String)),
   allowedEnvironmentVariables: Schema.optionalKey(Schema.Array(Schema.String)),
   additionalBlockedPaths: Schema.optionalKey(Schema.Array(Schema.String)),
   additionalAllowedPaths: Schema.optionalKey(Schema.Array(Schema.String)),

package/src/config/types.ts

@@ -187,6 +187,7 @@ export type CliToolOverride = {
 export type CredentialGuardConfig = {
   /** Exact, case-sensitive names approved for static printenv reads. Empty by default. */
   allowedEnvironmentVariables?: string[];
+  chainCopyDestinations?: string[];
   additionalBlockedPaths?: string[];
   additionalAllowedPaths?: string[];
   additionalBlockedCliTools?: CliToolOverride[];

package/src/credential-guard/index.ts

@@ -18,6 +18,7 @@ import type { CliToolOverride, CredentialGuardConfig } from "#config/types";
 import { redactSensitiveText } from "#shared/content-security";
 import { SECRET_PATTERNS } from "#shared/credential-patterns";
 import { posix } from "node:path";
+import { lstatSync, realpathSync } from "node:fs";
 import { passiveJqProgramIndex } from "./passive-jq";
 
 export { findSecretMatches } from "#shared/credential-patterns";
@@ -2558,6 +2559,131 @@ function hasStaticEnvironmentRead(
   );
 }
 
+function commandChainSources(command: string): string[] | undefined {
+  const parts: string[] = [];
+  let start = 0;
+  let quote: "'" | '"' | "`" | undefined;
+  let depth = 0;
+  for (let index = 0; index < command.length; index++) {
+    const char = command[index];
+    if (char === "\\" && quote !== "'") {
+      index++;
+    } else if (quote) {
+      if (char === quote) quote = undefined;
+    } else if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+    } else if (char === "#") {
+      return undefined;
+    } else if (char === "(") {
+      depth++;
+    } else if (char === ")") {
+      if (--depth < 0) return undefined;
+    } else if (!depth && (char === ";" || command.startsWith("&&", index))) {
+      const part = command.slice(start, index).trim();
+      if (!part || parts.length >= 31) return undefined;
+      parts.push(part);
+      if (char === "&") index++;
+      start = index + 1;
+    }
+  }
+  const last = command.slice(start).trim();
+  return !quote && !depth && last && parts.length ? [...parts, last] : undefined;
+}
+
+type LiteralChainPart = { source: string; argv: string[]; redirects: boolean };
+
+function literalCommandChain(command: string): LiteralChainPart[] | undefined {
+  const literal = literalBindingText(command, "", "");
+  if (!literal || /[|&\r\n]/.test(literal.syntax.replaceAll("&&", ""))) return undefined;
+  const boundaries = [...literal.syntax.matchAll(/&&|;/g)];
+  if (!boundaries.length || boundaries.length > 31) return undefined;
+  const parts: LiteralChainPart[] = [];
+  let start = 0;
+  for (const end of [...boundaries.map((match) => match.index), command.length]) {
+    const source = command.slice(start, end).trim();
+    const parsed = parseStaticShellCommands(source);
+    if (
+      !parsed ||
+      typeof parsed === "string" ||
+      parsed.pipelines.length !== 1 ||
+      parsed.pipelines[0]?.length !== 1
+    )
+      return undefined;
+    const argv = unwrapProofCommand(parsed.pipelines[0][0] ?? [], "\0");
+    if (!argv) return undefined;
+    parts.push({ source, argv, redirects: parsed.redirects.length > 0 });
+    start = end + (literal.syntax.startsWith("&&", end) ? 2 : 1);
+  }
+  return parts;
+}
+
+function isIndependentHerdrOperation(argv: string[]): boolean {
+  if (isLiteralHerdrPrompt(argv)) return argv.length === 5;
+  if (argv[0] !== "herdr") return false;
+  if (argv[1] === "agent" && argv[2] === "start") {
+    const separator = argv.indexOf("--", 3);
+    const options = argv.slice(3, separator < 0 ? undefined : separator);
+    const kinds = options.filter((arg) => arg === "--kind" || arg.startsWith("--kind="));
+    return (
+      kinds.length === 1 &&
+      kinds[0] === "--kind" &&
+      options[options.indexOf("--kind") + 1] === "codex"
+    );
+  }
+  if (argv[1] !== "pane") return false;
+  if (argv[2] === "run")
+    return argv.length === 5 && argv[4] === "exec bash ~/.codex/codex-clean.sh bash --norc -i";
+  if (argv[2] !== "wait-output" || argv.length < 6) return false;
+  const seen = new Set<string>();
+  for (let index = 4; index < argv.length; index += 2) {
+    const option = argv[index] ?? "";
+    if (seen.has(option)) return false;
+    seen.add(option);
+    if (!["--match", "--regex", "--timeout"].includes(option) || !argv[index + 1]) return false;
+    if (argv[index] === "--timeout" && !/^\d+$/.test(argv[index + 1] ?? "")) return false;
+  }
+  return true;
+}
+
+function isIndependentDataCopy(argv: string[], destinations: string[]): boolean {
+  if (!destinations.length || argv[0] !== "cp" || argv.length !== 3) return false;
+  const source = argv[1] ?? "";
+  const target = argv[2] ?? "";
+  const literalPath = (path: string) =>
+    /^\/[A-Za-z0-9_./ -]+$/.test(path) &&
+    !path.split("/").some((part) => part === "." || part === "..");
+  if (!/^(?:~\/)?[A-Za-z0-9_./-]+$/.test(source) || source.startsWith("-") || !literalPath(target))
+    return false;
+  try {
+    const targetPath = target.replace(/\/+$/, "");
+    const targetStat = lstatSync(targetPath, { throwIfNoEntry: false });
+    if (target.endsWith("/") && !targetStat?.isDirectory()) return false;
+    const destination = targetStat?.isDirectory()
+      ? posix.join(targetPath, posix.basename(source))
+      : targetPath;
+    for (const directory of destinations) {
+      if (!literalPath(directory)) continue;
+      const root = directory.replace(/\/+$/, "");
+      if (!destination.startsWith(root + "/")) continue;
+      if (!lstatSync(root).isDirectory() || realpathSync(root) !== root) return false;
+      const parts = destination.slice(root.length + 1).split("/");
+      let current = root;
+      for (const [index, part] of parts.entries()) {
+        current += "/" + part;
+        const stat = lstatSync(current, { throwIfNoEntry: false });
+        const last = index === parts.length - 1;
+        if (!stat) return last;
+        if (stat.isSymbolicLink() || (!last && !stat.isDirectory())) return false;
+        if (realpathSync(current) !== current) return false;
+      }
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
 function isLiteralHerdrPrompt(argv: string[]): boolean {
   return argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt" && argv.length >= 5;
 }
@@ -3730,6 +3856,31 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     });
     if (unterminatedQuote)
       return "cannot prove shell syntax: an unterminated quoted argument was found";
+    const chain = literalCommandChain(command);
+    if (chain?.some(({ argv }) => isLiteralHerdrPrompt(argv)) && !isStaticHerdrPrompt(command)) {
+      let copied = false;
+      for (const [index, part] of chain.entries()) {
+        const reason = getDangerousBashReason(part.source, shellDepth);
+        if (reason) return `cannot prove chain part ${index + 1} (${part.source}): ${reason}`;
+        if (
+          !part.redirects &&
+          isIndependentDataCopy(part.argv, config?.chainCopyDestinations ?? []) &&
+          !copied
+        ) {
+          copied = true;
+          continue;
+        }
+        if (
+          part.redirects ||
+          !isIndependentHerdrOperation(part.argv) ||
+          (copied && !(isLiteralHerdrPrompt(part.argv) && part.argv.length === 5))
+        )
+          return `cannot prove independent chain part ${index + 1} (${part.source}) under the environment/execution policy`;
+      }
+      if (dangerousBashPatterns.some((pattern) => pattern.test(originalCommand)))
+        return "matches a configured dangerous-command pattern";
+      return null;
+    }
     const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
     const promptWords = isStaticHerdrPrompt(command)
       ? parseStaticShellCommands(command)
@@ -4140,7 +4291,24 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     if (tool === "bash") {
       const command = extractCommand(args);
 
-      const dangerousReason = getDangerousBashReason(command);
+      let dangerousReason = getDangerousBashReason(command);
+      if (dangerousReason && !dangerousReason.includes("chain part")) {
+        let unproved: string | undefined;
+        for (const [index, source] of (commandChainSources(command) ?? []).entries()) {
+          const reason = getDangerousBashReason(source);
+          const parsed = parseStaticShellCommands(source);
+          const literal = literalBindingText(source, "", "");
+          const words = parsed && typeof parsed !== "string" ? parsed.pipelines[0]?.[0] : undefined;
+          const argv = words ? unwrapProofCommand(words, "\0") : undefined;
+          if (reason) {
+            dangerousReason += `; cannot prove chain part ${index + 1} (${source}): ${reason}`;
+            break;
+          }
+          if (!unproved && (!literal || /[<>]/.test(literal.syntax) || !argv))
+            unproved = `cannot prove chain part ${index + 1} (${source}): independent composition is unproved`;
+        }
+        if (!dangerousReason.includes("chain part") && unproved) dangerousReason += `; ${unproved}`;
+      }
       if (dangerousReason) {
         throw new Error(
           `\u{1F6AB} Command blocked: ${dangerousReason}.\n\n` +

package/src/db-tool/service.ts

@@ -6,7 +6,7 @@ import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./t
 import { ConfigService } from "#config";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { resolveEnvTemplate } from "#shared/env-template";
-import { unsafeOutboundTextReason } from "#shared/content-security";
+import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
 import { resolveEnvironmentScopedPrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
@@ -227,18 +227,21 @@ export class DbService extends Context.Service<
           env: string,
         ) {
           if (config.password) {
+            registerResolvedSecret(config.password);
             return config.password;
           }
 
           if (config.passwordEnvVar) {
             const fromEnv = process.env[config.passwordEnvVar];
             if (fromEnv) {
+              registerResolvedSecret(fromEnv);
               return fromEnv;
             }
 
             const zshrcEnv = yield* loadEnvFromZshrc();
             const fromZsh = zshrcEnv[config.passwordEnvVar];
             if (fromZsh) {
+              registerResolvedSecret(fromZsh);
               return fromZsh;
             }
 

package/src/gh-tool/branch.ts

@@ -3,7 +3,9 @@ import { Effect, Option } from "effect";
 
 import { formatOption, logFormatted } from "#shared";
 import type { BranchRenameResult } from "./types";
-import { GitHubService } from "./service";
+import { writes } from "./read/writes";
+import { resolveRepo } from "./read/reads";
+import { repoSlug } from "./read/keys";
 
 // ---------------------------------------------------------------------------
 // Internal handlers
@@ -15,8 +17,6 @@ export const renameBranch = Effect.fn("branch.renameBranch")(function* (opts: {
   confirm: boolean;
   repo: string | null;
 }) {
-  const gh = yield* GitHubService;
-
   if (!opts.confirm) {
     const scope = opts.repo !== null ? ` in ${opts.repo}` : "";
 
@@ -31,10 +31,7 @@ export const renameBranch = Effect.fn("branch.renameBranch")(function* (opts: {
     return dryRun;
   }
 
-  const repoInfo =
-    opts.repo !== null
-      ? opts.repo
-      : yield* gh.getRepoInfo().pipe(Effect.map((r) => `${r.owner}/${r.name}`));
+  const repoInfo = opts.repo !== null ? opts.repo : repoSlug(yield* resolveRepo(null));
 
   const args = [
     "api",
@@ -45,7 +42,7 @@ export const renameBranch = Effect.fn("branch.renameBranch")(function* (opts: {
     `new_name=${opts.newName}`,
   ];
 
-  yield* gh.runGh(args);
+  yield* writes.run(args, [`repo:${repoInfo.toLowerCase()}`]);
 
   const result: BranchRenameResult = {
     renamed: true,

package/src/gh-tool/environment.ts

@@ -41,10 +41,11 @@ const GH_ENVIRONMENT_NAMES = [
 
 export const ghEnvironment = (
   environment: Record<string, string | undefined> = process.env,
+  credential: string | null = null,
 ): Record<string, string> =>
   Object.fromEntries(
     GH_ENVIRONMENT_NAMES.flatMap((name) => {
-      const value = environment[name];
+      const value = name === "GH_TOKEN" && credential !== null ? credential : environment[name];
       return value === undefined ? [] : [[name, value]];
     }),
   );

package/src/gh-tool/gist.ts

@@ -1,3 +1,6 @@
+import { passthrough } from "./read/catalog";
+import type { GistApi } from "./read/catalog";
+import { writes } from "./read/writes";
 import { Command, Flag } from "effect/cli";
 import { Effect, Option } from "effect";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -11,33 +14,12 @@ import {
   resolveOptionalTextInput,
 } from "#gh/text-input";
 import { GitHubCommandError } from "./errors";
-import { GitHubService } from "./service";
 
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
 // `gh gist list/view` have no --json, so reads go through `gh api gists` (REST shape).
-type GistApiFile = {
-  filename: string;
-  language: string | null;
-  type: string;
-  size: number;
-  truncated?: boolean;
-  content?: string;
-};
-
-type GistApi = {
-  id: string;
-  description: string | null;
-  public: boolean;
-  html_url: string;
-  created_at: string;
-  updated_at: string;
-  owner: { login: string } | null;
-  files: Record<string, GistApiFile>;
-};
-
 type GistListItem = {
   id: string;
   description: string | null;
@@ -247,9 +229,7 @@ const listGists = Effect.fn("gist.listGists")(function* (opts: {
   limit: number;
   visibility: string | null;
 }) {
-  const gh = yield* GitHubService;
-
-  const gists = yield* gh.runGhJson<GistApi[]>(["api", `gists?per_page=${opts.limit}`]);
+  const gists = yield* passthrough.gistList(opts.limit);
 
   return gists
     .filter(
@@ -264,9 +244,7 @@ const viewGist = Effect.fn("gist.viewGist")(function* (opts: {
   filename: string | null;
   withContent: boolean;
 }) {
-  const gh = yield* GitHubService;
-
-  const gist = yield* gh.runGhJson<GistApi>(["api", `gists/${opts.id}`]);
+  const gist = yield* passthrough.gistView(opts.id);
 
   return toGistDetail(gist, { filename: opts.filename, withContent: opts.withContent });
 });
@@ -276,7 +254,6 @@ export const createGist = Effect.fn("gist.createGist")(function* (opts: {
   description: string | null;
   public: boolean;
 }) {
-  const gh = yield* GitHubService;
   return yield* Effect.scoped(
     Effect.gen(function* () {
       const snapshots: string[] = [];
@@ -298,7 +275,7 @@ export const createGist = Effect.fn("gist.createGist")(function* (opts: {
         args.push("--public");
       }
 
-      const result = yield* gh.runGh(args);
+      const result = yield* writes.run(args, []);
       const url =
         result.stdout
           .trim()
@@ -333,8 +310,6 @@ export const editGist = Effect.fn("gist.editGist")(function* (opts: {
   filename: string | null;
   sourcePath: string | null;
 }) {
-  const gh = yield* GitHubService;
-
   const args = ["gist", "edit", opts.id];
   const changes: string[] = [];
 
@@ -371,7 +346,7 @@ export const editGist = Effect.fn("gist.editGist")(function* (opts: {
     args.push("--filename", opts.filename);
   }
 
-  yield* gh.runGh(args);
+  yield* writes.run(args, []);
 
   const edited: GistEditResult = { edited: true, id: opts.id, changes };
 
@@ -379,8 +354,6 @@ export const editGist = Effect.fn("gist.editGist")(function* (opts: {
 });
 
 const deleteGist = Effect.fn("gist.deleteGist")(function* (opts: { id: string; confirm: boolean }) {
-  const gh = yield* GitHubService;
-
   if (!opts.confirm) {
     const dryRun: GistDeleteResult = {
       deleted: false,
@@ -392,7 +365,7 @@ const deleteGist = Effect.fn("gist.deleteGist")(function* (opts: { id: string; c
     return dryRun;
   }
 
-  yield* gh.runGh(["gist", "delete", opts.id, "--yes"]);
+  yield* writes.run(["gist", "delete", opts.id, "--yes"], []);
 
   const deleted: GistDeleteResult = { deleted: true, id: opts.id };
 

package/src/gh-tool/issue/commands.ts

@@ -18,7 +18,7 @@ import {
   reopenIssue,
   viewIssue,
 } from "./core";
-import { GitHubService } from "#gh/service";
+import { GitHubService } from "#gh/read/transport";
 
 const repoOption = Flag.String("repo").pipe(
   Flag.withDescription("Target repository profile name or owner/name"),
@@ -35,6 +35,14 @@ export const issueListCommand = Command.make(
   "list",
   {
     format: formatOption,
+    includeBody: Flag.Boolean("include-body").pipe(
+      Flag.withDescription("Include each issue's body in the result"),
+      Flag.withDefault(false),
+    ),
+    fresh: Flag.Boolean("fresh").pipe(
+      Flag.withDescription("Read from GitHub instead of the shared cache"),
+      Flag.withDefault(false),
+    ),
     labels: Flag.String("labels").pipe(
       Flag.withDescription("Filter by label (comma-separated)"),
       Flag.optional,
@@ -49,12 +57,14 @@ export const issueListCommand = Command.make(
       Flag.withDefault("open"),
     ),
   },
-  ({ format, labels, limit, repo, state }) =>
+  ({ format, fresh, includeBody, labels, limit, repo, state }) =>
     withRepo(
       repo,
       Effect.gen(function* () {
         const issues = yield* listIssues({
           labels: Option.getOrNull(labels),
+          includeBody,
+          fresh,
           limit,
           state,
         });