@dadado/agent-kit-cli 5.15.1 → 5.17.0

package/dist/guard-EHXF76ID.js

@@ -0,0 +1,530 @@
+import {
+  readStdinJson
+} from "./chunk-DE3LQFSJ.js";
+
+// src/commands/guard.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { defineCommand } from "citty";
+
+// src/hooks/format-guard-shell.ts
+function resolveGuardShellFormat(value) {
+  return value === "claude" ? "claude" : "cursor";
+}
+function extractGuardShellInput(payload, format) {
+  const p = payload && typeof payload === "object" ? payload : {};
+  const cwd = typeof p.cwd === "string" && p.cwd ? p.cwd : void 0;
+  if (format === "claude") {
+    const command2 = typeof p.tool_input?.command === "string" ? p.tool_input.command : "";
+    return { command: command2, cwd };
+  }
+  const command = typeof p.command === "string" ? p.command : "";
+  return { command, cwd };
+}
+function formatGuardShellOutput(result, format) {
+  if (format !== "claude") return JSON.stringify(result);
+  if (result.permission !== "deny") return "";
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: result.agent_message ?? `Denied by agent-kit guard shell (rule \`${result.rule ?? "unknown"}\`).`
+    }
+  });
+}
+
+// src/invariants/secrets-scan.ts
+var CITE = "agent-kit guard prompt (docs/cursor-native-audit.md)";
+var SECRET_PATTERNS = [
+  {
+    id: "json-secret-kv",
+    re: /"(password|apiKey|api_key|secret|token|auth)"\s*:\s*"[^"]{12,}"/i
+  },
+  {
+    id: "env-assignment",
+    re: /\b(?:API_KEY|SECRET|PASSWORD|TOKEN|ACCESS_KEY|PRIVATE_KEY)\s*=\s*['"]?[^\s'"]{12,}/i
+  },
+  {
+    id: "aws-access-key",
+    re: /\bAKIA[0-9A-Z]{16}\b/
+  },
+  {
+    // Classic (`ghp_`), OAuth (`gho_`), user-to-server (`ghu_`), server-to-server
+    // (`ghs_`), refresh (`ghr_`) and fine-grained (`github_pat_`) tokens.
+    id: "github-pat",
+    re: /\b(?:gh[pousr]_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,})\b/
+  },
+  {
+    id: "pem-private-key",
+    re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/
+  },
+  {
+    id: "slack-token",
+    re: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/
+  },
+  // Hyphenated vendor keys (`sk-ant-api03-…`, `sk-proj-…`) cannot be matched by
+  // `openai-sk`: its body class excludes `-`, so it stops at the first separator.
+  // Listed before `openai-sk`; the two cannot both hit the same span.
+  {
+    id: "sk-hyphenated-vendor",
+    re: /\bsk-[A-Za-z0-9]{2,12}-[A-Za-z0-9_-]{16,}\b/
+  },
+  {
+    // Single-segment `sk-` bodies only (no `-` in the class) — see `sk-hyphenated-vendor`.
+    id: "openai-sk",
+    re: /\bsk-[A-Za-z0-9]{20,}\b/
+  }
+];
+function maskSecretExcerpt(raw) {
+  return raw.replace(
+    /\b(github_pat_|gh[pousr]_|xox[abposr]-|sk-|AKIA)([A-Za-z0-9_-]{4,})/g,
+    (_m, p1, p2) => `${p1}${"*".repeat(Math.min(8, p2.length))}`
+  ).replace(
+    /(PRIVATE KEY-----\s*)([A-Za-z0-9+/=]+)/g,
+    (_m, p1, p2) => `${p1}${"*".repeat(Math.min(8, p2.length))}`
+  ).replace(
+    /(=\s*['"]?)([^\s'"]{4,})/g,
+    (_m, p1, p2) => `${p1}${"*".repeat(Math.min(8, p2.length))}`
+  ).replace(
+    /("(?:password|apiKey|api_key|secret|token|auth)"\s*:\s*")([^"]{4,})(")/gi,
+    (_m, p1, p2, p3) => `${p1}${"*".repeat(Math.min(8, p2.length))}${p3}`
+  );
+}
+function excerptAround(text, index, len) {
+  const start = Math.max(0, index - 8);
+  const end = Math.min(text.length, index + len + 8);
+  return maskSecretExcerpt(text.slice(start, end).replace(/\s+/g, " "));
+}
+function scanTextForSecrets(text) {
+  if (!text) return [];
+  const hits = [];
+  for (const { id, re } of SECRET_PATTERNS) {
+    const flags = re.flags.includes("g") ? re.flags : `${re.flags}g`;
+    const global = new RegExp(re.source, flags);
+    let match = global.exec(text);
+    while (match) {
+      hits.push({
+        patternId: id,
+        excerpt: excerptAround(text, match.index, match[0].length)
+      });
+      if (!global.global) break;
+      match = global.exec(text);
+    }
+  }
+  return hits;
+}
+function secretsAdviseMessage(hits) {
+  const ids = [...new Set(hits.map((h) => h.patternId))].join(", ");
+  return `Possible secret pattern(s) in prompt (${ids}). Cite: ${CITE}. Remove live credentials before submitting; use env vars or a secrets store.`;
+}
+
+// src/invariants/shell-guard.ts
+var CITE2 = "agent-kit guard shell (ADR 2026-07-29_cli-invariants-thin-hook-adapters)";
+var PROTECTED_BRANCH_RE = /^(?:main|master|prod)$/;
+function normalizeShellCommand(command) {
+  return command.replace(/\s+/g, " ").trim();
+}
+function joinNonTerminatingNewlines(command) {
+  return command.replace(/(?<!\\)((?:\\\\)*)\\\r?\n/g, "$1");
+}
+var SEGMENT_SPLIT = /\r?\n|&&|\|\||[;|]|(?<![<>])&(?![<>])/;
+function splitSegments(command) {
+  return command.split(SEGMENT_SPLIT).map(normalizeShellCommand).filter(Boolean);
+}
+function shellSegments(command) {
+  const joined = splitSegments(joinNonTerminatingNewlines(command));
+  const raw = splitSegments(command);
+  return [.../* @__PURE__ */ new Set([...joined, ...raw])];
+}
+function stripLeadingEnvAssignments(segment) {
+  return segment.replace(/^(?:\w+=\S+\s+)*/, "");
+}
+var WRAPPER_ARG_FLAGS = /* @__PURE__ */ new Map([
+  ["sudo", /* @__PURE__ */ new Set(["-u", "-g", "-h", "-p", "-C", "-D", "-r", "-t", "-U", "-T"])],
+  ["env", /* @__PURE__ */ new Set(["-u", "-C", "-S", "--unset", "--chdir", "--split-string"])],
+  ["command", /* @__PURE__ */ new Set()],
+  ["exec", /* @__PURE__ */ new Set(["-a"])],
+  ["nohup", /* @__PURE__ */ new Set()],
+  ["time", /* @__PURE__ */ new Set(["-f", "-o", "--format", "--output"])]
+]);
+var GIT_GLOBAL_OPTS = /* @__PURE__ */ new Map([
+  ["-C", true],
+  ["-c", true],
+  ["--git-dir", true],
+  ["--work-tree", true],
+  ["--namespace", true],
+  ["--no-pager", false],
+  ["-P", false],
+  ["--literal-pathspecs", false]
+]);
+function canonicalGitHead(segment) {
+  let tokens = normalizeShellCommand(segment).split(" ").filter(Boolean);
+  for (; ; ) {
+    const t = tokens[0];
+    if (t === void 0) break;
+    if (/^[({]/.test(t)) {
+      const rest = t.replace(/^[({]+/, "");
+      tokens = rest ? [rest, ...tokens.slice(1)] : tokens.slice(1);
+      continue;
+    }
+    if (/^\w+=/.test(t)) {
+      tokens = tokens.slice(1);
+      continue;
+    }
+    const argFlags = WRAPPER_ARG_FLAGS.get(t);
+    if (argFlags) {
+      let i = 1;
+      while (i < tokens.length && tokens[i]?.startsWith("-")) {
+        i += argFlags.has(tokens[i]) ? 2 : 1;
+      }
+      tokens = tokens.slice(i);
+      continue;
+    }
+    break;
+  }
+  if (tokens.length > 0) {
+    const last = tokens[tokens.length - 1].replace(/[)}]+$/, "");
+    tokens = last ? [...tokens.slice(0, -1), last] : tokens.slice(0, -1);
+  }
+  if (tokens.length > 0 && /^(?:[\w./-]+\/)?git$/.test(tokens[0])) {
+    let i = 1;
+    while (i < tokens.length) {
+      const t = tokens[i];
+      const name = t.includes("=") ? t.slice(0, t.indexOf("=")) : t;
+      const takesArg = GIT_GLOBAL_OPTS.get(name);
+      if (takesArg === void 0) break;
+      i += takesArg && !t.includes("=") ? 2 : 1;
+    }
+    tokens = [tokens[0], ...tokens.slice(i)];
+  }
+  return tokens.join(" ");
+}
+function shellInvocationHeads(command) {
+  return shellSegments(command).map(canonicalGitHead).filter(Boolean);
+}
+function segmentHasAllowMainPushEnv(segment) {
+  if (process.env.ALLOW_MAIN_PUSH === "1") return true;
+  const leading = segment.match(/^(?:\w+=\S+\s+)*/)?.[0] ?? "";
+  return /(?:^|\s)ALLOW_MAIN_PUSH=1(?:\s|$)/.test(leading);
+}
+function hasForbiddenMainPushFlags(head) {
+  for (const t of head.split(/\s+/).filter(Boolean)) {
+    if (t === "--force" || t === "-f" || t === "--force-with-lease" || t === "--no-verify" || t === "--all" || t === "--tags") {
+      return true;
+    }
+  }
+  return false;
+}
+var AUTHORIZED_MAIN_PUSH_FLAGS = /* @__PURE__ */ new Set([
+  "-u",
+  "--set-upstream",
+  "-v",
+  "--verbose",
+  "-q",
+  "--quiet",
+  "--progress",
+  "--no-progress"
+]);
+function isAuthorizedProdMainPush(head) {
+  if (!/^(?:[\w./-]+\/)?git\s+push\b/.test(head)) return false;
+  if (hasForbiddenMainPushFlags(head)) return false;
+  const after = head.replace(/^(?:[\w./-]+\/)?git\s+push\b/, "").trim();
+  const positional = [];
+  for (const t of after.split(/\s+/).filter(Boolean)) {
+    if (t.startsWith("-")) {
+      if (!AUTHORIZED_MAIN_PUSH_FLAGS.has(t)) return false;
+      continue;
+    }
+    positional.push(t);
+  }
+  const refspec = positional.length === 2 ? positional[1] : void 0;
+  if (!refspec) return false;
+  const unquoted = refspec.replace(/['"\\]/g, "");
+  if (unquoted.startsWith("+")) return false;
+  if (unquoted.includes(":")) {
+    const src = unquoted.slice(0, unquoted.lastIndexOf(":"));
+    if (src !== "HEAD") return false;
+  }
+  const dest = unquoted.includes(":") ? unquoted.slice(unquoted.lastIndexOf(":") + 1) : unquoted;
+  return normalizePushRefspecToken(dest) === "main";
+}
+function segmentAllowsMainPush(segment) {
+  if (!segmentHasAllowMainPushEnv(segment)) return false;
+  return isAuthorizedProdMainPush(stripLeadingEnvAssignments(segment));
+}
+var PUBLIC_REPO_RE = /agent-kit-startup\/agent-kit(?![\w-])/i;
+function segmentHasAllowPublicPushEnv(segment) {
+  if (process.env.ALLOW_PUBLIC_PUSH === "1") return true;
+  const leading = segment.match(/^(?:\w+=\S+\s+)*/)?.[0] ?? "";
+  return /(?:^|\s)ALLOW_PUBLIC_PUSH=1(?:\s|$)/.test(leading);
+}
+function pushTargetsPublicRepo(head, remotes) {
+  if (!/^(?:[\w./-]+\/)?git\s+push\b/.test(head)) return false;
+  if (PUBLIC_REPO_RE.test(head)) return true;
+  if (!remotes) return false;
+  const after = head.replace(/^(?:[\w./-]+\/)?git\s+push\b/, "").trim();
+  const remoteToken = after.split(/\s+/).find((t) => t && !t.startsWith("-"));
+  if (!remoteToken) return false;
+  const url = remotes[remoteToken];
+  return typeof url === "string" && PUBLIC_REPO_RE.test(url);
+}
+function ghTargetsPublicRepo(head) {
+  if (!/^(?:[\w./-]+\/)?gh\s+pr\s+(?:create|merge)\b/.test(head)) return false;
+  return PUBLIC_REPO_RE.test(head);
+}
+function anyHeadMatches(command, re) {
+  return shellInvocationHeads(command).some((head) => re.test(head));
+}
+function isProtectedBranch(name) {
+  return typeof name === "string" && PROTECTED_BRANCH_RE.test(name.trim());
+}
+function normalizePushRefspecToken(token) {
+  let t = token.trim();
+  t = t.replace(/['"\\]/g, "");
+  if (t.startsWith("+")) t = t.slice(1);
+  if (t.startsWith("refs/heads/")) t = t.slice("refs/heads/".length);
+  if (t.startsWith("origin/")) t = t.slice("origin/".length);
+  return t;
+}
+function pushHeadHasProtectedDest(head) {
+  if (/(?:HEAD|@):(?:refs\/heads\/)?(?:main|master|prod)\b/.test(head)) return true;
+  if (/(?:^|\s)-(?:u|--set-upstream)\s+\S+\s+(?:main|master|prod)(?:\s|$)/.test(head)) {
+    return true;
+  }
+  const after = head.replace(/^(?:[\w./-]+\/)?git\s+push\b/, "");
+  for (const raw of after.split(/\s+/).filter(Boolean)) {
+    if (raw.startsWith("-")) continue;
+    const dest = raw.includes(":") ? raw.slice(raw.lastIndexOf(":") + 1) : raw;
+    if (PROTECTED_BRANCH_RE.test(normalizePushRefspecToken(dest))) return true;
+  }
+  return false;
+}
+function isBareOrHeadPushToCurrent(head) {
+  if (!/^(?:[\w./-]+\/)?git\s+push\b/.test(head)) return false;
+  if (pushHeadHasProtectedDest(head)) {
+    return false;
+  }
+  if (/(?:^|\s)\+?(?:refs\/heads\/)?(?:origin\/)?(?:staging|develop|homologacao)(?:\s|$|:)/.test(
+    head
+  ) || /(?:HEAD|@):(?:refs\/heads\/)?(?!main|master|prod)[A-Za-z0-9._/-]+/.test(head)) {
+    return false;
+  }
+  const after = head.replace(/^(?:[\w./-]+\/)?git\s+push\b/, "").trim();
+  const withoutFlags = after.replace(/(?:^|\s)(?:--force|-f|-u|--set-upstream|--tags|--all|--prune)(?=\s|$)/g, " ").replace(/(?:^|\s)--\w[\w-]*(?:=\S+)?/g, " ").replace(/\s+/g, " ").trim();
+  if (!withoutFlags) return true;
+  const tokens = withoutFlags.split(/\s+/);
+  if (tokens.length === 1) return true;
+  if (tokens.length >= 2 && (tokens[1] === "HEAD" || tokens[1] === "@")) return true;
+  if (/\bHEAD\b|(?:^|\s)@(?:\s|$)/.test(withoutFlags) && !/(?:HEAD|@):/.test(withoutFlags)) {
+    return true;
+  }
+  return false;
+}
+var SHELL_DENY_RULES = [
+  {
+    id: "git-checkout-path",
+    description: "git checkout -- / HEAD -- / . discards working-tree edits",
+    test: (cmd) => shellInvocationHeads(cmd).some((head) => {
+      if (!/^(?:[\w./-]+\/)?git\s+checkout\b/.test(head)) return false;
+      if (/\s--(?:\s|$)/.test(head)) return true;
+      if (/\scheckout\s+\.(?:\s|$)/.test(head)) return true;
+      return false;
+    })
+  },
+  {
+    id: "git-restore",
+    description: "git restore discards working-tree edits",
+    test: (cmd) => anyHeadMatches(cmd, /^(?:[\w./-]+\/)?git\s+restore\b/)
+  },
+  {
+    id: "git-reset-hard",
+    description: "git reset --hard destroys uncommitted work",
+    test: (cmd) => anyHeadMatches(cmd, /^(?:[\w./-]+\/)?git\s+reset\b.*--hard\b/)
+  },
+  {
+    id: "git-clean-fd",
+    description: "git clean -fd removes untracked files",
+    test: (cmd) => shellInvocationHeads(cmd).some((head) => {
+      if (!/^(?:[\w./-]+\/)?git\s+clean\b/.test(head)) return false;
+      const tokens = head.split(/\s+/);
+      const shortBundle = (t) => /^-[a-zA-Z]+$/.test(t);
+      const hasForce = tokens.some((t) => t === "--force" || shortBundle(t) && t.includes("f"));
+      const hasD = tokens.some((t) => shortBundle(t) && t.includes("d"));
+      return hasForce && hasD;
+    })
+  },
+  {
+    id: "public-repo-direct-write",
+    description: "agents ship to the public repo only via scripts/sync-public.mjs (CI); no direct git push / gh pr create|merge against it",
+    test: (cmd, opts) => shellSegments(cmd).some((segment) => {
+      if (segmentHasAllowPublicPushEnv(segment)) return false;
+      const head = canonicalGitHead(segment);
+      return pushTargetsPublicRepo(head, opts?.remotes) || ghTargetsPublicRepo(head);
+    })
+  },
+  {
+    id: "git-push-main",
+    description: "direct push to main/master/prod bypasses staging",
+    test: (cmd, opts) => shellSegments(cmd).some((segment) => {
+      if (segmentAllowsMainPush(segment)) return false;
+      const head = canonicalGitHead(segment);
+      if (!/^(?:[\w./-]+\/)?git\s+push\b/.test(head)) return false;
+      if (pushHeadHasProtectedDest(head)) {
+        return true;
+      }
+      if (isProtectedBranch(opts?.currentBranch) && isBareOrHeadPushToCurrent(head)) {
+        return true;
+      }
+      return false;
+    })
+  }
+];
+function evaluateShellCommand(command, opts = {}) {
+  const normalized = normalizeShellCommand(command);
+  if (!normalized) {
+    return { permission: "allow" };
+  }
+  for (const rule of SHELL_DENY_RULES) {
+    if (rule.test(command, opts)) {
+      const agent_message = `Denied by ${CITE2}: ${rule.description} (rule \`${rule.id}\`). Use /git-staging; never discard human hunks or push protected branches from the agent.`;
+      return {
+        permission: "deny",
+        rule: rule.id,
+        agent_message,
+        user_message: agent_message
+      };
+    }
+  }
+  return { permission: "allow" };
+}
+
+// src/commands/guard.ts
+var execFileAsync = promisify(execFile);
+async function detectCurrentBranch(cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+      encoding: "utf8",
+      cwd
+    });
+    const branch = stdout.trim();
+    return branch && branch !== "HEAD" ? branch : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function detectRemotes(cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", ["remote", "-v"], { encoding: "utf8", cwd });
+    const remotes = {};
+    for (const line of stdout.split("\n")) {
+      const m = line.match(/^(\S+)\s+(\S+)\s+\(fetch\)$/);
+      if (m?.[1] && m[2]) remotes[m[1]] = m[2];
+    }
+    return Object.keys(remotes).length > 0 ? remotes : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var defaultGuardShellDeps = { detectCurrentBranch, detectRemotes };
+var GIT_OR_GH_RE = /\b(git|gh)\b/;
+async function evaluateGuardShell(command, cwd = process.cwd(), deps = defaultGuardShellDeps) {
+  if (!GIT_OR_GH_RE.test(command)) return evaluateShellCommand(command);
+  const [currentBranch, remotes] = await Promise.all([
+    deps.detectCurrentBranch(cwd),
+    deps.detectRemotes(cwd)
+  ]);
+  return evaluateShellCommand(command, { currentBranch, remotes });
+}
+async function runGuardShellHook(formatArg, deps = {}) {
+  const format = resolveGuardShellFormat(formatArg);
+  const run = async () => {
+    let command = typeof deps.command === "string" ? deps.command : "";
+    let cwd = deps.cwd ?? process.cwd();
+    if (!command) {
+      const readStdin = deps.readStdin ?? readStdinJson;
+      const input = extractGuardShellInput(await readStdin(), format);
+      command = input.command;
+      if (input.cwd) cwd = input.cwd;
+    }
+    const result = await evaluateGuardShell(command, cwd, {
+      detectCurrentBranch: deps.detectCurrentBranch ?? defaultGuardShellDeps.detectCurrentBranch,
+      detectRemotes: deps.detectRemotes ?? defaultGuardShellDeps.detectRemotes
+    });
+    return formatGuardShellOutput(result, format);
+  };
+  if (format !== "claude") return run();
+  try {
+    return await run();
+  } catch {
+    return "";
+  }
+}
+var guardCommand = defineCommand({
+  meta: {
+    name: "guard",
+    description: "Deny/annotate guards (shell, prompt). Hooks are thin adapters."
+  },
+  subCommands: {
+    shell: defineCommand({
+      meta: {
+        name: "shell",
+        description: "Evaluate a shell command against the git-workflow / protected-branch deny-list (git checkout|restore|reset --hard|clean -fd + pushes to main/master/prod + direct git push/gh pr create|merge against the public repo). Not a general destructive-command guard: rm -rf, chmod, dd are allowed."
+      },
+      args: {
+        json: {
+          type: "boolean",
+          default: true,
+          description: "Print Cursor beforeShellExecution JSON (default)"
+        },
+        format: {
+          type: "string",
+          default: "cursor",
+          description: "cursor (default, beforeShellExecution JSON) | claude (PreToolUse deny JSON, empty on allow)"
+        },
+        command: {
+          type: "string",
+          description: "Command string (otherwise read from stdin: JSON.command, or tool_input.command with --format claude)"
+        }
+      },
+      async run({ args }) {
+        const command = typeof args.command === "string" ? args.command : void 0;
+        const out = await runGuardShellHook(args.format, { command });
+        if (out) console.log(out);
+      }
+    }),
+    prompt: defineCommand({
+      meta: {
+        name: "prompt",
+        description: "Scan prompt text for secret patterns (advisory; fail-open at hook)"
+      },
+      args: {
+        json: {
+          type: "boolean",
+          default: true
+        }
+      },
+      async run() {
+        const payload = await readStdinJson();
+        const text = typeof payload.prompt === "string" && payload.prompt || typeof payload.text === "string" && payload.text || "";
+        const hits = scanTextForSecrets(text);
+        if (hits.length === 0) {
+          console.log(JSON.stringify({ continue: true, hits: [] }));
+          return;
+        }
+        console.log(
+          JSON.stringify({
+            continue: true,
+            user_message: secretsAdviseMessage(hits),
+            agent_message: secretsAdviseMessage(hits),
+            hits: hits.map((h) => ({ patternId: h.patternId }))
+          })
+        );
+      }
+    })
+  }
+});
+export {
+  evaluateGuardShell,
+  guardCommand,
+  runGuardShellHook
+};