@hanhnd/agent-kit 1.0.8 → 1.0.9

package/README.md

@@ -15,6 +15,7 @@
 | `/ak:research [topic]`           | Research a topic                                                   |
 | `/ak:review-pr [PR URL]`         | Review a pull request                                              |
 | `/ak:review`                     | Review uncommitted local changes                                   |
+| `/ak:debate [subject]`           | Run adversarial debate (Gilfoyle vs Dinesh vs Judge)               |
 | `/ak:ticket [ID]`                | Fetch a Jira ticket and plan from it                               |
 | `/ak:git`                        | Git commit, branch, and PR workflow                                |
 | `/ak:init`                       | Create the project overview file                                   |

package/dist/kit-server.js

@@ -20998,6 +20998,62 @@ function getWorkspaceRoot() {
   return process.env.WORKSPACE_DIR || process.env.CLAUDE_WORKSPACE || process.env.GEMINI_WORKSPACE || process.env.INIT_CWD || process.env.PWD || process.cwd();
 }
 
+// src/tools/config.ts
+var FORBIDDEN_FILES = [
+  ".env",
+  ".bashrc",
+  ".zshrc",
+  ".profile",
+  ".bash_profile",
+  ".bash_history",
+  ".zsh_history",
+  "config.mjs",
+  ".npmrc",
+  ".yarnrc",
+  ".netrc",
+  ".gitconfig"
+];
+var FORBIDDEN_PATTERNS = [
+  /^\.env$/i,
+  // .env, .Env — case-insensitive exact
+  /^\.env[^a-z]/i,
+  // .env_bak, .env-prod, .env.local
+  /^id_rsa/i,
+  // SSH private keys
+  /^id_ed25519/i,
+  /^id_ecdsa/i,
+  /\.pem$/i,
+  // Certificates
+  /credentials\.json$/i,
+  /secrets\.json$/i,
+  /secret\.json$/i
+];
+var FORBIDDEN_DIRS = [
+  ".git",
+  ".ssh",
+  ".aws",
+  ".kube",
+  ".gnupg",
+  ".docker"
+];
+var SAFE_ENV_VARS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "NODE_ENV",
+  "GEMINI_WORKSPACE",
+  "KIT_AGENT_TIMEOUT",
+  "GEMINI_KIT_GIT_TIMEOUT"
+];
+
 // src/tools/core.ts
 function registerCoreTools(server2) {
   server2.tool(
@@ -21043,27 +21099,24 @@ import * as path2 from "path";
 function sanitize(input) {
   return String(input).replace(/[;&|`$<>\\]/g, "").trim().slice(0, 500);
 }
-var FORBIDDEN_FILES = [
-  ".env",
-  ".bashrc",
-  ".zshrc",
-  ".profile",
-  ".bash_profile",
-  ".bash_history",
-  ".zsh_history",
-  "config.mjs"
-  // Some projects use this for sensitive config
-];
 function validatePath(filePath, baseDir = process.cwd()) {
   const resolved = path2.resolve(baseDir, filePath);
   const root = path2.resolve(baseDir);
   if (resolved !== root && !resolved.startsWith(root + path2.sep)) {
     throw new Error(`Path traversal detected: ${filePath}`);
   }
+  const segments = resolved.split(path2.sep);
+  for (const segment of segments) {
+    if (FORBIDDEN_DIRS.some((d) => segment.toLowerCase() === d.toLowerCase())) {
+      throw new Error(`Access to sensitive directory is FORBIDDEN: ${segment}`);
+    }
+  }
   const fileName = path2.basename(resolved);
-  if (FORBIDDEN_FILES.some(
-    (forbidden) => fileName === forbidden || fileName.startsWith(forbidden + ".")
-  )) {
+  const isExactForbidden = FORBIDDEN_FILES.some(
+    (f) => fileName.toLowerCase() === f.toLowerCase()
+  );
+  const isPatternForbidden = FORBIDDEN_PATTERNS.some((re) => re.test(fileName));
+  if (isExactForbidden || isPatternForbidden) {
     throw new Error(`Access to sensitive file is FORBIDDEN: ${fileName}`);
   }
   return resolved;
@@ -21083,6 +21136,25 @@ function commandExists(cmd) {
     return false;
   }
 }
+function sanitizeOutput(text) {
+  const SECRET_PATTERNS = [
+    /(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/g,
+    // GitHub tokens
+    /SK-[A-Za-z0-9]{40,}/g,
+    // OpenAI keys
+    /AKIA[0-9A-Z]{16}/g,
+    // AWS access keys
+    /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+    // Slack tokens
+    /[Aa]tlassian[_\-]?[Aa][Pp][Ii][_\-]?[Tt]oken[^\s]*\s*[:=]\s*\S+/g
+    // Atlassian token patterns
+  ];
+  let sanitized = text;
+  for (const pattern of SECRET_PATTERNS) {
+    sanitized = sanitized.replace(pattern, "[REDACTED]");
+  }
+  return sanitized;
+}
 
 // src/tools/agent.ts
 var AGENT_TIMEOUT = parseInt(process.env.KIT_AGENT_TIMEOUT || "300000", 10);
@@ -21162,9 +21234,16 @@ function registerAgentTools(server2) {
         const slug = taskSlug(task);
         const { logPath, logStream } = initAgentLog(workspaceRoot, slug, usedAgent);
         const jobId = randomUUID();
+        const sanitizedEnv = {};
+        for (const key of SAFE_ENV_VARS) {
+          if (process.env[key] !== void 0) {
+            sanitizedEnv[key] = process.env[key];
+          }
+        }
+        sanitizedEnv.GEMINI_WORKSPACE = workspaceRoot;
         const child = spawn(usedAgent, agentArgs, {
           cwd: workspaceRoot,
-          env: { ...process.env, GEMINI_WORKSPACE: workspaceRoot }
+          env: sanitizedEnv
         });
         const job = {
           id: jobId,
@@ -21195,6 +21274,7 @@ function registerAgentTools(server2) {
             child.on("error", reject);
           });
           const output = job.chunks.join("");
+          const safeOutput = sanitizeOutput(output);
           return {
             content: [
               {
@@ -21204,7 +21284,7 @@ function registerAgentTools(server2) {
                     agent: usedAgent,
                     status: fallbackReason ? "fallback" : "success",
                     log: logPath,
-                    output,
+                    output: safeOutput,
                     ...fallbackReason && { fallback_reason: fallbackReason }
                   },
                   null,

package/dist/tools/agent.js

@@ -8,7 +8,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { z } from 'zod';
 import { getWorkspaceRoot } from '../utils.js';
-import { commandExists, validatePath } from './security.js';
+import { commandExists, validatePath, sanitizeOutput } from './security.js';
+import { SAFE_ENV_VARS } from './config.js';
 // Configurable timeout via environment variable (default: 5 minutes)
 const AGENT_TIMEOUT = parseInt(process.env.KIT_AGENT_TIMEOUT || '300000', 10);
 const jobRegistry = new Map();
@@ -109,9 +110,17 @@ export function registerAgentTools(server) {
             const slug = taskSlug(task);
             const { logPath, logStream } = initAgentLog(workspaceRoot, slug, usedAgent);
             const jobId = randomUUID();
+            // Build sanitized environment: only SAFE_ENV_VARS + GEMINI_WORKSPACE
+            const sanitizedEnv = {};
+            for (const key of SAFE_ENV_VARS) {
+                if (process.env[key] !== undefined) {
+                    sanitizedEnv[key] = process.env[key];
+                }
+            }
+            sanitizedEnv.GEMINI_WORKSPACE = workspaceRoot;
             const child = spawn(usedAgent, agentArgs, {
                 cwd: workspaceRoot,
-                env: { ...process.env, GEMINI_WORKSPACE: workspaceRoot },
+                env: sanitizedEnv,
             });
             const job = {
                 id: jobId,
@@ -144,6 +153,7 @@ export function registerAgentTools(server) {
                     child.on('error', reject);
                 });
                 const output = job.chunks.join('');
+                const safeOutput = sanitizeOutput(output);
                 return {
                     content: [
                         {
@@ -152,7 +162,7 @@ export function registerAgentTools(server) {
                                 agent: usedAgent,
                                 status: fallbackReason ? 'fallback' : 'success',
                                 log: logPath,
-                                output,
+                                output: safeOutput,
                                 ...(fallbackReason && { fallback_reason: fallbackReason }),
                             }, null, 2),
                         },

package/dist/tools/config.d.ts

@@ -23,3 +23,19 @@ export declare function getFileExtensions(projectDir: string): string[];
  * Load project settings from .gemini/settings.json
  */
 export declare function loadProjectSettings(projectDir: string): ProjectSettings;
+/**
+ * Sensitive files that agents are FORBIDDEN from reading/writing.
+ */
+export declare const FORBIDDEN_FILES: string[];
+/**
+ * Regex patterns (case-insensitive) matched against path.basename.
+ */
+export declare const FORBIDDEN_PATTERNS: RegExp[];
+/**
+ * Directory name segments that are always blocked.
+ */
+export declare const FORBIDDEN_DIRS: string[];
+/**
+ * Environment variables safe to pass to child processes.
+ */
+export declare const SAFE_ENV_VARS: string[];

package/dist/tools/config.js

@@ -58,3 +58,65 @@ export function loadProjectSettings(projectDir) {
     }
     return {};
 }
+/**
+ * Sensitive files that agents are FORBIDDEN from reading/writing.
+ */
+export const FORBIDDEN_FILES = [
+    '.env',
+    '.bashrc',
+    '.zshrc',
+    '.profile',
+    '.bash_profile',
+    '.bash_history',
+    '.zsh_history',
+    'config.mjs',
+    '.npmrc',
+    '.yarnrc',
+    '.netrc',
+    '.gitconfig',
+];
+/**
+ * Regex patterns (case-insensitive) matched against path.basename.
+ */
+export const FORBIDDEN_PATTERNS = [
+    /^\.env$/i, // .env, .Env — case-insensitive exact
+    /^\.env[^a-z]/i, // .env_bak, .env-prod, .env.local
+    /^id_rsa/i, // SSH private keys
+    /^id_ed25519/i,
+    /^id_ecdsa/i,
+    /\.pem$/i, // Certificates
+    /credentials\.json$/i,
+    /secrets\.json$/i,
+    /secret\.json$/i,
+];
+/**
+ * Directory name segments that are always blocked.
+ */
+export const FORBIDDEN_DIRS = [
+    '.git',
+    '.ssh',
+    '.aws',
+    '.kube',
+    '.gnupg',
+    '.docker',
+];
+/**
+ * Environment variables safe to pass to child processes.
+ */
+export const SAFE_ENV_VARS = [
+    'PATH',
+    'HOME',
+    'USER',
+    'SHELL',
+    'TERM',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'NODE_ENV',
+    'GEMINI_WORKSPACE',
+    'KIT_AGENT_TIMEOUT',
+    'GEMINI_KIT_GIT_TIMEOUT',
+];

package/dist/tools/security.d.ts

@@ -38,3 +38,7 @@ export declare function commandExists(cmd: string): boolean;
  * Uses queue-based approach to prevent stack overflow on deep directories
  */
 export declare function findFilesAsync(dir: string, extensions: string[], maxFiles: number, excludeDirs?: string[]): Promise<string[]>;
+/**
+ * Sanitize output text by redacting sensitive tokens (API keys, etc.)
+ */
+export declare function sanitizeOutput(text: string): string;

package/dist/tools/security.js

@@ -6,6 +6,7 @@ import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import { getWorkspaceRoot } from '../utils.js';
+import { FORBIDDEN_FILES, FORBIDDEN_PATTERNS, FORBIDDEN_DIRS } from './config.js';
 /**
  * Sanitize string for safe use with execFileSync
  * Only removes dangerous shell operators - safe chars like !?#* are allowed
@@ -24,20 +25,6 @@ export function sanitize(input) {
         .trim()
         .slice(0, 500); // Limit length
 }
-/**
- * Sensitive files that agents are FORBIDDEN from reading/writing.
- * Includes environment variables, shell configs, and system profiles.
- */
-const FORBIDDEN_FILES = [
-    '.env',
-    '.bashrc',
-    '.zshrc',
-    '.profile',
-    '.bash_profile',
-    '.bash_history',
-    '.zsh_history',
-    'config.mjs', // Some projects use this for sensitive config
-];
 /**
  * Validate file path to prevent path traversal attacks and access to forbidden files.
  * Uses stricter path.sep check to prevent prefix matching flaws.
@@ -49,9 +36,18 @@ export function validatePath(filePath, baseDir = process.cwd()) {
     if (resolved !== root && !resolved.startsWith(root + path.sep)) {
         throw new Error(`Path traversal detected: ${filePath}`);
     }
-    // 2. Forbidden files check (exact filename or suffix)
+    // 2. Directory segment check
+    const segments = resolved.split(path.sep);
+    for (const segment of segments) {
+        if (FORBIDDEN_DIRS.some((d) => segment.toLowerCase() === d.toLowerCase())) {
+            throw new Error(`Access to sensitive directory is FORBIDDEN: ${segment}`);
+        }
+    }
+    // 3. Forbidden files check (two-stage)
     const fileName = path.basename(resolved);
-    if (FORBIDDEN_FILES.some((forbidden) => fileName === forbidden || fileName.startsWith(forbidden + '.'))) {
+    const isExactForbidden = FORBIDDEN_FILES.some((f) => fileName.toLowerCase() === f.toLowerCase());
+    const isPatternForbidden = FORBIDDEN_PATTERNS.some((re) => re.test(fileName));
+    if (isExactForbidden || isPatternForbidden) {
         throw new Error(`Access to sensitive file is FORBIDDEN: ${fileName}`);
     }
     return resolved;
@@ -147,3 +143,20 @@ export async function findFilesAsync(dir, extensions, maxFiles, excludeDirs = ['
     }
     return results;
 }
+/**
+ * Sanitize output text by redacting sensitive tokens (API keys, etc.)
+ */
+export function sanitizeOutput(text) {
+    const SECRET_PATTERNS = [
+        /(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/g, // GitHub tokens
+        /SK-[A-Za-z0-9]{40,}/g, // OpenAI keys
+        /AKIA[0-9A-Z]{16}/g, // AWS access keys
+        /xox[baprs]-[A-Za-z0-9-]{10,}/g, // Slack tokens
+        /[Aa]tlassian[_\-]?[Aa][Pp][Ii][_\-]?[Tt]oken[^\s]*\s*[:=]\s*\S+/g, // Atlassian token patterns
+    ];
+    let sanitized = text;
+    for (const pattern of SECRET_PATTERNS) {
+        sanitized = sanitized.replace(pattern, '[REDACTED]');
+    }
+    return sanitized;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanhnd/agent-kit",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Super Engineer - Team of AI Agents for software development (Claude Code Plugin)",
   "type": "module",
   "main": "dist/kit-server.js",
@@ -21,7 +21,8 @@
     "prepublishOnly": "npm run build",
     "build": "tsc && npm run bundle",
     "bundle": "esbuild src/kit-server.ts --bundle --platform=node --format=esm --outfile=dist/kit-server.js --external:node:* --banner:js=\"import { createRequire } from 'module'; const require = createRequire(import.meta.url);\"",
-    "dev": "tsc --watch"
+    "dev": "tsc --watch",
+    "test": "node --test tests/*.test.js"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.13.1",