llm-mask 0.3.0

package/dist/diff-masking.js

@@ -0,0 +1,121 @@
+/**
+ * Diff masking - mask git diff output for safe LLM code review
+ *
+ * Preserves diff structure while masking sensitive data
+ */
+import { execSync } from 'child_process';
+import { DataMasker } from './masker.js';
+/**
+ * Masker for git diff output
+ */
+export class DiffMasker {
+    masker;
+    constructor() {
+        this.masker = new DataMasker();
+    }
+    /**
+     * Get git diff and mask it
+     */
+    maskDiff(options = {}) {
+        const diff = this.getDiff(options);
+        const lines = diff.split('\n');
+        let filesChanged = 0;
+        let linesAdded = 0;
+        let linesRemoved = 0;
+        let masksApplied = 0;
+        const maskedLines = lines.map(line => {
+            // Track diff metadata
+            if (line.startsWith('diff --git')) {
+                filesChanged++;
+            }
+            if (line.startsWith('+') && !line.startsWith('++')) {
+                linesAdded++;
+            }
+            if (line.startsWith('-') && !line.startsWith('--')) {
+                linesRemoved++;
+            }
+            // Don't mask diff metadata
+            if (line.startsWith('diff ') ||
+                line.startsWith('index ') ||
+                line.startsWith('@') ||
+                line.startsWith('---') ||
+                line.startsWith('+++') ||
+                line === '') {
+                return line;
+            }
+            // Mask the line content (preserve the +/- prefix)
+            const prefix = line.charAt(0) === '+' || line.charAt(0) === '-' ? line.charAt(0) : '';
+            const content = prefix ? line.slice(1) : line;
+            const result = this.masker.mask(content, { level: options.level });
+            masksApplied += result.stats.total;
+            return prefix + result.masked;
+        });
+        return {
+            maskedDiff: maskedLines.join('\n'),
+            originalLineCount: lines.length,
+            stats: {
+                filesChanged,
+                linesAdded,
+                linesRemoved,
+                masksApplied
+            }
+        };
+    }
+    /**
+     * Get git diff output
+     */
+    getDiff(options) {
+        const args = ['diff', '--color=never', '--unified=3'];
+        if (options.base) {
+            if (options.head) {
+                args.push(`${options.base}...${options.head}`);
+            }
+            else {
+                args.push(options.base);
+            }
+        }
+        if (options.path) {
+            args.push('--', options.path);
+        }
+        try {
+            const cmd = ['git'];
+            if (options.gitDir) {
+                cmd.push(`--git-dir=${options.gitDir}`);
+            }
+            cmd.push(...args);
+            return execSync(cmd.join(' '), {
+                encoding: 'utf-8',
+                maxBuffer: 50 * 1024 * 1024 // 50MB
+            });
+        }
+        catch (error) {
+            throw new Error(`Failed to get git diff: ${error}`);
+        }
+    }
+    /**
+     * Format masked diff for display
+     */
+    format(maskedDiff) {
+        const lines = [];
+        lines.push('📝 Masked Git Diff');
+        lines.push('');
+        lines.push(`Files changed: ${maskedDiff.stats.filesChanged}`);
+        lines.push(`Lines added: ${maskedDiff.stats.linesAdded}`);
+        lines.push(`Lines removed: ${maskedDiff.stats.linesRemoved}`);
+        lines.push(`Masks applied: ${maskedDiff.stats.masksApplied}`);
+        lines.push('');
+        lines.push('---');
+        lines.push('');
+        lines.push(maskedDiff.maskedDiff);
+        return lines.join('\n');
+    }
+}
+/**
+ * Convenience function to mask git diff
+ */
+export function maskDiff(options) {
+    const masker = new DiffMasker();
+    const result = masker.maskDiff(options);
+    return result.maskedDiff;
+}
+//# sourceMappingURL=diff-masking.js.map

package/dist/diff-masking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-masking.js","sourceRoot":"","sources":["../src/diff-masking.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA0BxC;;GAEG;AACH,MAAM,OAAO,UAAU;IACb,MAAM,CAAY;IAE1B;QACE,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE,CAAA;IAChC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,UAAuB,EAAE;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAE9B,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,IAAI,YAAY,GAAG,CAAC,CAAA;QAEpB,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACnC,sBAAsB;YACtB,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,YAAY,EAAE,CAAA;YAChB,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,UAAU,EAAE,CAAA;YACd,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,YAAY,EAAE,CAAA;YAChB,CAAC;YAED,2BAA2B;YAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACpB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBACtB,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,kDAAkD;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACrF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YAClE,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAA;YAElC,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC/B,CAAC,CAAC,CAAA;QAEF,OAAO;YACL,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,iBAAiB,EAAE,KAAK,CAAC,MAAM;YAC/B,KAAK,EAAE;gBACL,YAAY;gBACZ,UAAU;gBACV,YAAY;gBACZ,YAAY;aACb;SACF,CAAA;IACH,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,OAAoB;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;QAErD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YAChD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACzC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;YAEjB,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;aACpC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAsB;QAC3B,MAAM,KAAK,GAAa,EAAE,CAAA;QAE1B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,gBAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAEd,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAEjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAqB;IAC5C,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACvC,OAAO,MAAM,CAAC,UAAU,CAAA;AAC1B,CAAC"}

package/dist/executor.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Secure executor - run commands and redact sensitive output
+ *
+ * Key principle: Credentials work for the command, but output is redacted
+ * before the LLM sees it.
+ */
+import type { MaskResult } from './types.js';
+export interface ExecOptions {
+    /** Command to execute (optional for specialized executors like kubectl/ssh) */
+    command?: string;
+    /** Arguments */
+    args?: string[];
+    /** Working directory */
+    cwd?: string;
+    /** Environment variables (merged with process.env) */
+    env?: Record<string, string>;
+    /** Timeout in milliseconds (default: 30000) */
+    timeout?: number;
+    /** Redaction level */
+    level?: 'basic' | 'standard' | 'aggressive';
+    /** Preserve format in redacted output */
+    preserveFormat?: boolean;
+    /** Redact specific patterns only */
+    redactPatterns?: string[];
+    /** Include stderr in output */
+    includeStderr?: boolean;
+    /** Include exit code in output */
+    includeExitCode?: boolean;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    signal: string | null;
+    timedOut: boolean;
+    redacted: {
+        stdout: string;
+        stderr: string;
+        stats: MaskResult['stats'];
+    };
+}
+export interface KubernetesExecOptions extends ExecOptions {
+    /** Kubernetes namespace */
+    namespace?: string;
+    /** Pod name */
+    pod?: string;
+    /** Container name */
+    container?: string;
+    /** Context from kubeconfig */
+    context?: string;
+    /** Command to execute in pod */
+    execCommand?: string;
+}
+export interface SSHExecOptions extends ExecOptions {
+    /** SSH host */
+    host: string;
+    /** SSH user */
+    user?: string;
+    /** Port */
+    port?: number;
+    /** Identity file (private key) */
+    identity?: string;
+    /** Command to run on remote host */
+    remoteCommand?: string;
+}
+/**
+ * Secure executor - runs commands and redacts output
+ */
+export declare class SecureExecutor {
+    private masker;
+    constructor();
+    /**
+     * Execute a command and return both original and redacted output
+     */
+    exec(options: ExecOptions): Promise<ExecResult>;
+    /**
+     * Execute a kubectl command
+     */
+    kubectl(options: KubernetesExecOptions): Promise<ExecResult>;
+    /**
+     * Execute a command via SSH
+     */
+    ssh(options: SSHExecOptions): Promise<ExecResult>;
+    /**
+     * Execute a command and return only redacted output (for LLM consumption)
+     */
+    execRedacted(options: ExecOptions): Promise<string>;
+    /**
+     * Format exec result for display
+     */
+    formatResult(result: ExecResult, showOriginal?: boolean): string;
+}
+/**
+ * Convenience function
+ */
+export declare function execRedacted(options: ExecOptions): Promise<string>;
+/**
+ * Kubernetes convenience function
+ */
+export declare function kubectl(options: KubernetesExecOptions): Promise<ExecResult>;
+/**
+ * SSH convenience function
+ */
+export declare function sshExec(options: SSHExecOptions): Promise<ExecResult>;
+//# sourceMappingURL=executor.d.ts.map

package/dist/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,YAAY,CAAA;IAC3C,yCAAyC;IACzC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,oCAAoC;IACpC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,+BAA+B;IAC/B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,kCAAkC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;KAC3B,CAAA;CACF;AAED,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,eAAe;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAY;;IAM1B;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAqGrD;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;IA4ClE;;OAEG;IACG,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAmCvD;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBzD;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,GAAE,OAAe,GAAG,MAAM;CA2CxE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAGjF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAG1E"}

package/dist/executor.js

@@ -0,0 +1,250 @@
+/**
+ * Secure executor - run commands and redact sensitive output
+ *
+ * Key principle: Credentials work for the command, but output is redacted
+ * before the LLM sees it.
+ */
+import { spawn } from 'child_process';
+import { DataMasker } from './masker.js';
+/**
+ * Secure executor - runs commands and redacts output
+ */
+export class SecureExecutor {
+    masker;
+    constructor() {
+        this.masker = new DataMasker();
+    }
+    /**
+     * Execute a command and return both original and redacted output
+     */
+    async exec(options) {
+        const { command, args = [], cwd, env, timeout = 30000, includeStderr = true, includeExitCode = false, level = 'standard', preserveFormat = false, redactPatterns } = options;
+        // Validate command for direct exec calls
+        if (!command) {
+            throw new Error('Command is required for exec(). Use kubectl() or ssh() for specialized operations.');
+        }
+        return new Promise((resolve) => {
+            const startTime = Date.now();
+            let timedOut = false;
+            let timeoutHandle;
+            // Spawn the process
+            const proc = spawn(command, args, {
+                cwd,
+                env: { ...process.env, ...env },
+                timeout: undefined // We handle timeout ourselves
+            });
+            let stdout = '';
+            let stderr = '';
+            let exitCode = null;
+            let signal = null;
+            // Set timeout
+            if (timeout > 0) {
+                timeoutHandle = setTimeout(() => {
+                    timedOut = true;
+                    proc.kill('SIGTERM');
+                    // Force kill if it doesn't terminate
+                    setTimeout(() => proc.kill('SIGKILL'), 5000);
+                }, timeout);
+            }
+            // Collect output
+            proc.stdout?.on('data', (data) => {
+                stdout += data.toString();
+            });
+            proc.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            // Handle process exit
+            proc.on('close', (code, sig) => {
+                if (timeoutHandle) {
+                    clearTimeout(timeoutHandle);
+                }
+                const duration = Date.now() - startTime;
+                // Redact output
+                const maskOptions = { level, preserveFormat };
+                // Filter by patterns if specified
+                if (redactPatterns && redactPatterns.length > 0) {
+                    // Custom redaction logic would go here
+                    // For now, use default masking
+                }
+                const stdoutResult = this.masker.mask(stdout, maskOptions);
+                const stderrResult = this.masker.mask(stderr, maskOptions);
+                resolve({
+                    stdout,
+                    stderr,
+                    exitCode: code,
+                    signal: sig,
+                    timedOut,
+                    redacted: {
+                        stdout: stdoutResult.masked,
+                        stderr: stderrResult.masked,
+                        stats: {
+                            ...stdoutResult.stats,
+                            byPattern: {
+                                ...stdoutResult.stats.byPattern,
+                                ...Object.entries(stderrResult.stats.byPattern).reduce((acc, [k, v]) => ({ ...acc, [k]: (acc[k] || 0) + v }), {})
+                            },
+                            total: stdoutResult.stats.total + stderrResult.stats.total
+                        }
+                    }
+                });
+            });
+        });
+    }
+    /**
+     * Execute a kubectl command
+     */
+    async kubectl(options) {
+        const args = [];
+        // Add context
+        if (options.context) {
+            args.push('--context', options.context);
+        }
+        // Add namespace
+        if (options.namespace) {
+            args.push('--namespace', options.namespace);
+        }
+        // Build the kubectl command
+        if (options.pod) {
+            // Exec into a pod
+            if (options.container) {
+                args.push('exec', '-c', options.container, options.pod, '--');
+            }
+            else {
+                args.push('exec', options.pod, '--');
+            }
+            // Add command if provided
+            if (options.execCommand) {
+                args.push(options.execCommand);
+            }
+        }
+        else {
+            // Regular kubectl command
+            args.push(...(options.args || []));
+        }
+        return this.exec({
+            command: 'kubectl',
+            args,
+            cwd: options.cwd,
+            env: options.env,
+            timeout: options.timeout,
+            level: options.level,
+            preserveFormat: options.preserveFormat,
+            includeStderr: options.includeStderr,
+            includeExitCode: options.includeExitCode
+        });
+    }
+    /**
+     * Execute a command via SSH
+     */
+    async ssh(options) {
+        const args = [];
+        // Add port
+        if (options.port) {
+            args.push('-p', String(options.port));
+        }
+        // Add identity file
+        if (options.identity) {
+            args.push('-i', options.identity);
+        }
+        // Add host
+        const host = options.user ? `${options.user}@${options.host}` : options.host;
+        args.push(host);
+        // Add remote command
+        if (options.remoteCommand) {
+            args.push(options.remoteCommand);
+        }
+        return this.exec({
+            command: 'ssh',
+            args,
+            cwd: options.cwd,
+            env: options.env,
+            timeout: options.timeout,
+            level: options.level,
+            preserveFormat: options.preserveFormat,
+            includeStderr: options.includeStderr,
+            includeExitCode: options.includeExitCode
+        });
+    }
+    /**
+     * Execute a command and return only redacted output (for LLM consumption)
+     */
+    async execRedacted(options) {
+        const result = await this.exec(options);
+        // Combine stdout and stderr
+        let output = result.redacted.stdout;
+        if (options.includeStderr !== false && result.redacted.stderr) {
+            output += '\n' + result.redacted.stderr;
+        }
+        if (options.includeExitCode && result.exitCode !== null) {
+            output += `\n[Exit code: ${result.exitCode}]`;
+        }
+        if (result.timedOut) {
+            output += '\n[Command timed out]';
+        }
+        if (result.signal) {
+            output += `\n[Terminated by signal: ${result.signal}]`;
+        }
+        return output;
+    }
+    /**
+     * Format exec result for display
+     */
+    formatResult(result, showOriginal = false) {
+        const lines = [];
+        if (result.timedOut) {
+            lines.push('⏱️  Command timed out');
+        }
+        if (result.signal) {
+            lines.push(`💥 Terminated by signal: ${result.signal}`);
+        }
+        if (result.exitCode !== null && result.exitCode !== 0) {
+            lines.push(`❌ Exit code: ${result.exitCode}`);
+        }
+        // Show redacted output by default
+        if (!showOriginal) {
+            lines.push('--- Redacted Output ---');
+            lines.push(result.redacted.stdout);
+            if (result.redacted.stderr) {
+                lines.push('--- Redacted Stderr ---');
+                lines.push(result.redacted.stderr);
+            }
+            if (result.redacted.stats.total > 0) {
+                lines.push('');
+                lines.push(`🔒 Redacted ${result.redacted.stats.total} item(s)`);
+            }
+        }
+        else {
+            // Show original (WARNING: contains sensitive data)
+            lines.push('⚠️  ORIGINAL OUTPUT (MAY CONTAIN SENSITIVE DATA)');
+            lines.push('---');
+            lines.push(result.stdout);
+            if (result.stderr) {
+                lines.push('--- Stderr ---');
+                lines.push(result.stderr);
+            }
+        }
+        return lines.join('\n');
+    }
+}
+/**
+ * Convenience function
+ */
+export async function execRedacted(options) {
+    const executor = new SecureExecutor();
+    return executor.execRedacted(options);
+}
+/**
+ * Kubernetes convenience function
+ */
+export async function kubectl(options) {
+    const executor = new SecureExecutor();
+    return executor.kubectl(options);
+}
+/**
+ * SSH convenience function
+ */
+export async function sshExec(options) {
+    const executor = new SecureExecutor();
+    return executor.ssh(options);
+}
+//# sourceMappingURL=executor.js.map

package/dist/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAiExC;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAY;IAE1B;QACE,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,EAAE,CAAA;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,MAAM,EACJ,OAAO,EACP,IAAI,GAAG,EAAE,EACT,GAAG,EACH,GAAG,EACH,OAAO,GAAG,KAAK,EACf,aAAa,GAAG,IAAI,EACpB,eAAe,GAAG,KAAK,EACvB,KAAK,GAAG,UAAU,EAClB,cAAc,GAAG,KAAK,EACtB,cAAc,EACf,GAAG,OAAO,CAAA;QAEX,yCAAyC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAA;QACvG,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,aAAyC,CAAA;YAE7C,oBAAoB;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAChC,GAAG;gBACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;gBAC/B,OAAO,EAAE,SAAS,CAAC,8BAA8B;aAClD,CAAC,CAAA;YAEF,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,MAAM,GAAkB,IAAI,CAAA;YAEhC,cAAc;YACd,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,QAAQ,GAAG,IAAI,CAAA;oBACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpB,qCAAqC;oBACrC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC9C,CAAC,EAAE,OAAO,CAAC,CAAA;YACb,CAAC;YAED,iBAAiB;YACjB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;YAEF,sBAAsB;YACtB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7B,IAAI,aAAa,EAAE,CAAC;oBAClB,YAAY,CAAC,aAAa,CAAC,CAAA;gBAC7B,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;gBAEvC,gBAAgB;gBAChB,MAAM,WAAW,GAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;gBAElD,kCAAkC;gBAClC,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChD,uCAAuC;oBACvC,+BAA+B;gBACjC,CAAC;gBAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;gBAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;gBAE1D,OAAO,CAAC;oBACN,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,GAAG;oBACX,QAAQ;oBACR,QAAQ,EAAE;wBACR,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,KAAK,EAAE;4BACL,GAAG,YAAY,CAAC,KAAK;4BACrB,SAAS,EAAE;gCACT,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS;gCAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CACpD,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EACrD,EAA4B,CAC7B;6BACF;4BACD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK;yBAC3D;qBACF;iBACF,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAA8B;QAC1C,MAAM,IAAI,GAAa,EAAE,CAAA;QAEzB,cAAc;QACd,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAC7C,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,kBAAkB;YAClB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC/D,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACtC,CAAC;YAED,0BAA0B;YAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0BAA0B;YAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,SAAS;YAClB,IAAI;YACJ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,OAAuB;QAC/B,MAAM,IAAI,GAAa,EAAE,CAAA;QAEzB,WAAW;QACX,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,CAAC;QAED,oBAAoB;QACpB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QACnC,CAAC;QAED,WAAW;QACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEf,qBAAqB;QACrB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,KAAK;YACd,IAAI;YACJ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAAoB;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,4BAA4B;QAC5B,IAAI,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QAEnC,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9D,MAAM,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QACzC,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,MAAM,CAAC,QAAQ,GAAG,CAAA;QAC/C,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,IAAI,uBAAuB,CAAA;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,4BAA4B,MAAM,CAAC,MAAM,GAAG,CAAA;QACxD,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAkB,EAAE,eAAwB,KAAK;QAC5D,MAAM,KAAK,GAAa,EAAE,CAAA;QAE1B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACzD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/C,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;YACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAElC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;gBACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACpC,CAAC;YAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACd,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mDAAmD;YACnD,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAA;YAC9D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAEzB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;gBAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAoB;IACrD,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAA8B;IAC1D,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAA;IACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAC9B,CAAC"}

package/dist/executor.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for SecureExecutor
+ */
+export {};
+//# sourceMappingURL=executor.test.d.ts.map

package/dist/executor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.test.d.ts","sourceRoot":"","sources":["../src/executor.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}