@ictechgy/context-guard 0.4.16 → 0.5.1

package/plugins/context-guard/lib/context_guard_commands.py

@@ -29,6 +29,7 @@ IMPLEMENTATION_PAIRS = (('context_guard_cli.py', 'context-guard'),
  ('trim_command_output.py', 'context-guard-trim-output'))
 
 HELPER_PAIRS = (('hook_secret_patterns.py', 'lib/hook_secret_patterns.py'),
+ ('bash_reference_policy.py', 'bin/bash_reference_policy.py'),
  ('credential_policy.py', 'lib/credential_policy.py'),
  ('context_guard_commands.py', 'lib/context_guard_commands.py'),
  ('context_guard_command_manifest_loader.py',
@@ -89,6 +90,7 @@ DISPATCHER_SUBCOMMANDS = {'setup': ('context-guard-setup',),
  'scan': ('context-guard-diet', 'scan'),
  'trim-output': ('context-guard-trim-output',),
  'trim': ('context-guard-trim-output',),
+ 'reference': ('context-guard-trim-output', '--expand-bash-reference'),
  'sanitize-output': ('context-guard-sanitize-output',),
  'sanitize': ('context-guard-sanitize-output',),
  'filter': ('context-guard-filter',),
@@ -196,6 +198,7 @@ PLUGIN_ENTRYPOINTS = ('claude-read-symbol',
  'context-guard-trim-output')
 
 DISPATCHER_SMOKE_CASES = ({'entrypoint': 'context-guard', 'args': ['experiments', 'list', '--json'], 'mode': 'json'},
+ {'entrypoint': 'context-guard', 'args': ['reference', '--help'], 'mode': 'text'},
  {'entrypoint': 'context-guard', 'args': ['cost', '--help'], 'mode': 'text'},
  {'entrypoint': 'context-guard', 'args': ['route-advisor', '--help'], 'mode': 'text'},
  {'entrypoint': 'context-guard', 'args': ['cache-score', '--help'], 'mode': 'text'},
@@ -216,6 +219,7 @@ EXPECTED_COMMAND_PACK_FILES = ('plugins/context-guard/bin/claude-read-symbol',
  'plugins/context-guard/bin/claude-token-statusline',
  'plugins/context-guard/bin/claude-token-statusline-merged',
  'plugins/context-guard/bin/claude-trim-output',
+ 'plugins/context-guard/bin/bash_reference_policy.py',
  'plugins/context-guard/bin/context-guard',
  'plugins/context-guard/bin/context-guard-artifact',
  'plugins/context-guard/bin/context-guard-audit',

package/plugins/context-guard/lib/credential_policy.py

@@ -7,7 +7,9 @@ import re
 SECRET_KEY = (
     r"[A-Za-z0-9_.-]*(?:api[_-]?key|apikey|token|secret|password|passwd|pwd|"
     r"private[_-]?key|access[_-]?key|client[_-]?secret|credential|signature|sig|"
-    r"ssh[_-]?key|pgp[_-]?private[_-]?key)[A-Za-z0-9_.-]*"
+    r"ssh[_-]?key|ssh[_-]?command|pgp[_-]?private[_-]?key)[A-Za-z0-9_.-]*"
+    r"|(?:pass|[A-Za-z0-9_.-]+[._-]pass)"
+    r"(?:[._-](?:v\d+|prod|production|dev|test|backup))?|smtp[_-]?pass"
     r"|(?:session(?:[_-]?(?:id|token))?|sessionid|sid|jsessionid|"
     r"csrf(?:[_-]?token)?|xsrf(?:[_-]?token)?)"
     r"|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|"
@@ -34,6 +36,7 @@ EXACT_SENSITIVE_KEYS = frozenset(
         "client_secret",
         "cookie",
         "credential",
+        "credential_helper",
         "credentials",
         "csrf",
         "csrf_token",
@@ -41,6 +44,7 @@ EXACT_SENSITIVE_KEYS = frozenset(
         "id_token",
         "jsessionid",
         "jwt",
+        "pass",
         "password",
         "passwd",
         "private_key",
@@ -57,6 +61,9 @@ EXACT_SENSITIVE_KEYS = frozenset(
         "sid",
         "sig",
         "signature",
+        "smtp_pass",
+        "smtppass",
+        "ssh_command",
         "ssh_key",
         "sshkey",
         "token",
@@ -80,10 +87,11 @@ SENSITIVE_KEY_SUFFIXES = (
     "_secret",
     "_secret_key",
     "_session_token",
+    "_ssh_command",
     "_token",
 )
 SENSITIVE_KEY_QUALIFIER_RE = re.compile(
-    r"(?:^|_)(?:api_?key|apikey|token|secret|password|passwd|pwd|"
+    r"(?:^|_)(?:api_?key|apikey|token|secret|password|passwd|pass|pwd|"
     r"private_key|access_key|client_secret|credential|signature|sig|"
     r"session_id|session_token)(?:_(?:v\d+|prod|production|dev|test|backup))?$"
 )