shell-aliasforge 0.0.0-stage → 0.1.1

package/dist/risks/packs/core.js

@@ -0,0 +1,177 @@
+const R = String.raw;
+// Reused fragments. "rm -r" and "rm -f" can come in any order or spelling.
+const RECURSIVE = R `(?=[^;&|]*\s(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)(?=\s|$))`;
+const FORCE = R `(?=[^;&|]*\s(?:-[a-zA-Z]*f[a-zA-Z]*|--force)(?=\s|$))`;
+const SECRET_NAME = R `[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY)`;
+const VALUE = R `(?<secret>[^\s"'$-][^\s"']*)`;
+// A fish value must not be "=": that is SQL or config syntax, not a fish `set`.
+const FISH_VALUE = R `(?<secret>[^\s"'$=-][^\s"']*)`;
+export const core = [
+    {
+        id: "core/chmod-recursive-777",
+        category: "danger",
+        severity: "high",
+        title: "Recursive world-writable chmod",
+        advice: "Use a narrower mode (755 for directories, 644 for files) and limit the path.",
+        pattern: R `\bchmod(?=\s)(?=[^;&|]*\s(?:-[a-zA-Z]*R[a-zA-Z]*|--recursive)(?=\s|$))(?=[^;&|]*\s(?:0?777|a\+rwx|ugo\+rwx)(?=\s|$))`,
+    },
+    {
+        id: "core/rm-rf-root",
+        category: "danger",
+        severity: "high",
+        title: "Recursive forced delete of / or ~",
+        advice: "Double-check the path. Prefer deleting a specific directory.",
+        pattern: R `\brm(?=\s)${RECURSIVE}${FORCE}[^;&|]*\s(?:\/\*?|~\/?\*?)(?=\s|$)`,
+    },
+    {
+        id: "core/rm-rf-unquoted-variable",
+        category: "danger",
+        severity: "high",
+        title: "Recursive forced delete of an unquoted variable",
+        advice: 'If the variable is empty or contains spaces this deletes the wrong thing. Quote it ("$DIR") and use ${DIR:?}.',
+        pattern: R `\brm(?=\s)${RECURSIVE}${FORCE}[^;&|]*\s\$\{?[A-Za-z_]\w*\}?(?:\/[^\s;&|]*)?(?=\s|$)`,
+    },
+    {
+        id: "core/pipe-to-shell",
+        category: "danger",
+        severity: "high",
+        title: "Download piped straight into a shell",
+        advice: "Download the script, read it, then run it.",
+        pattern: R `\b(?:curl|wget)\b[^;&]*(?<!\|)\|(?!\|)\s*(?:sudo\s+(?:-\S+\s+)*)?(?:ba|z|da|k)?sh\b`,
+    },
+    {
+        id: "core/shell-from-download",
+        category: "danger",
+        severity: "high",
+        title: "Shell running a download without review",
+        advice: "Download the script, read it, then run it.",
+        pattern: R `\b(?:ba|z|da|k)?sh\s+(?:-c\s+)?["']?(?:<\(|\$\()\s*(?:curl|wget)\b`,
+    },
+    {
+        id: "core/dd-to-device",
+        category: "danger",
+        severity: "high",
+        title: "dd writing to a device",
+        advice: "Confirm the target with lsblk first. A wrong of= destroys that disk.",
+        pattern: R `\bdd(?=\s)[^;&|]*\sof=\/dev\/(?!(?:null|zero|stdout|stderr|tty)\b)\S+`,
+    },
+    {
+        id: "core/mkfs-device",
+        category: "danger",
+        severity: "high",
+        title: "mkfs on a device",
+        advice: "Confirm the device with lsblk first. This erases the filesystem.",
+        pattern: R `\bmkfs(?:\.\w+)?(?=\s)[^;&|]*\s\/dev\/\S+`,
+    },
+    {
+        id: "core/fork-bomb",
+        category: "danger",
+        severity: "high",
+        title: "Fork bomb",
+        advice: "This command exhausts the machine's processes. Do not run it.",
+        pattern: R `:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:`,
+    },
+    {
+        id: "core/sudo-redirect",
+        category: "danger",
+        severity: "medium",
+        title: "sudo with an output redirect",
+        advice: "The redirect runs as you, not root. Use `| sudo tee FILE` or `sudo sh -c '...'`.",
+        pattern: R `\bsudo\s[^;&|<"']*?(?<![\d&>])>{1,2}(?!&)\s*(?!\/dev\/null\b)[^\s&>]`,
+    },
+    {
+        id: "core/bearer-token",
+        category: "secret",
+        severity: "high",
+        title: "Authorization: Bearer token",
+        advice: "Rotate the token and remove this entry from your history.",
+        pattern: R `Authorization:\s*Bearer\s+(?<secret>[A-Za-z0-9._~+\/=-]{8,})`,
+        flags: "i",
+    },
+    {
+        id: "core/basic-auth-header",
+        category: "secret",
+        severity: "high",
+        title: "Authorization: Basic credentials",
+        advice: "Rotate the credentials and remove this entry from your history.",
+        pattern: R `Authorization:\s*Basic\s+(?<secret>[A-Za-z0-9+\/=]{8,})`,
+        flags: "i",
+    },
+    {
+        id: "core/password-flag",
+        category: "secret",
+        severity: "high",
+        title: "Password passed as a flag",
+        advice: "Rotate the password. Use a prompt, an env file or a credential helper instead.",
+        pattern: R `(?:^|\s)--(?:password|passwd|pass|pwd)(?:=|\s+)["']?${VALUE}`,
+        flags: "i",
+    },
+    {
+        id: "core/mysql-password",
+        category: "secret",
+        severity: "high",
+        title: "MySQL password on the command line (-p<password>)",
+        advice: "Rotate the password. Use -p alone to be prompted, or a ~/.my.cnf file.",
+        pattern: R `\b(?:mysql|mysqldump|mysqladmin|mariadb)\b[^;&|]*\s-p${VALUE}`,
+    },
+    {
+        id: "core/sshpass-password",
+        category: "secret",
+        severity: "high",
+        title: "sshpass password on the command line",
+        advice: "Rotate the password and switch to SSH keys.",
+        pattern: R `\bsshpass\b[^;&|]*\s-p\s*["']?${VALUE}`,
+    },
+    {
+        id: "core/curl-user-password",
+        category: "secret",
+        severity: "high",
+        title: "curl --user with a password",
+        advice: "Rotate the password. Use a ~/.netrc file or a token from an env var.",
+        pattern: R `\bcurl\b[^;&|]*\s(?:-u|--user)(?:=|\s+)["']?[^:\s"']+:(?<secret>[^\s"'$][^\s"']*)`,
+    },
+    {
+        id: "core/export-secret",
+        category: "secret",
+        severity: "high",
+        title: "Secret exported in a command",
+        advice: "Rotate the value. Load secrets from a file or a secret manager instead of typing them.",
+        pattern: R `\bexport\s+${SECRET_NAME}=["']?${VALUE}`,
+        flags: "i",
+    },
+    {
+        id: "core/fish-set-secret",
+        category: "secret",
+        severity: "high",
+        title: "Secret set in a fish command",
+        advice: "Rotate the value. Load secrets from a file or a secret manager instead of typing them.",
+        pattern: R `(?:^|[;&|]\s*)set\s+(?:-\S+\s+)*${SECRET_NAME}\s+["']?${FISH_VALUE}`,
+        flags: "i",
+    },
+    {
+        id: "core/quoted-secret-assignment",
+        category: "secret",
+        severity: "high",
+        title: "Quoted secret assigned to a token, password or key",
+        advice: "Rotate the value. Keep secrets out of commands, SQL and JSON typed in the shell.",
+        pattern: R `[A-Za-z0-9_]*(?:token|secret|passw(?:or)?d|api_?key|access_?key|private_?key)["']?\s*[=:]\s*["'](?<secret>[^"'\s$<{][^"']{5,})["']`,
+        flags: "i",
+    },
+    {
+        id: "core/private-key-header",
+        category: "secret",
+        severity: "high",
+        title: "Private key pasted into a command",
+        advice: "Treat the key as compromised: replace it and remove this entry from your history.",
+        pattern: R `-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----`,
+    },
+    {
+        id: "core/url-credentials",
+        category: "secret",
+        severity: "high",
+        title: "Password inside a URL",
+        advice: "Rotate the password and remove this entry from your history.",
+        pattern: R `\b[a-z][a-z0-9+.-]*:\/\/[^\s:\/@"']+:(?<secret>[^\s@\/"'$][^\s@\/"']*)@`,
+        flags: "i",
+    },
+];

package/dist/risks/packs/docker.js

@@ -0,0 +1,27 @@
+const R = String.raw;
+export const docker = [
+    {
+        id: "docker/run-privileged",
+        category: "danger",
+        severity: "high",
+        title: "docker run --privileged",
+        advice: "A privileged container can take over the host. Add only the capabilities you need (--cap-add).",
+        pattern: R `\bdocker\s+(?:container\s+)?run\b[^;&|]*\s--privileged(?:=true)?(?=\s|$)`,
+    },
+    {
+        id: "docker/mount-socket",
+        category: "danger",
+        severity: "medium",
+        title: "Docker socket mounted into a container",
+        advice: "Anything in the container can control the host's Docker. Avoid it unless required.",
+        pattern: R `\bdocker\s+(?:container\s+)?run\b[^;&|]*\s(?:-v|--volume)[=\s]+\/var\/run\/docker\.sock`,
+    },
+    {
+        id: "docker/login-password",
+        category: "secret",
+        severity: "high",
+        title: "docker login with a password flag",
+        advice: "Rotate the password. Use --password-stdin instead.",
+        pattern: R `\bdocker\s+login\b[^;&|]*\s(?:-p|--password)[=\s]+["']?(?<secret>[^\s"'$-][^\s"']*)`,
+    },
+];

package/dist/risks/packs/git.js

@@ -0,0 +1,27 @@
+const R = String.raw;
+export const git = [
+    {
+        id: "git/force-push-main",
+        category: "danger",
+        severity: "high",
+        title: "Force push to main or master",
+        advice: "Rewriting a shared branch can lose teammates' commits. Use a feature branch or --force-with-lease on a topic branch.",
+        pattern: R `\bgit\s+push\b(?=[^;&|]*\s(?:-[a-zA-Z]*f[a-zA-Z]*|--force(?:-with-lease)?)(?:=\S+)?(?=\s|$))[^;&|]*\s\+?(?:\S*:)?(?:main|master)(?=\s|$)`,
+    },
+    {
+        id: "git/force-push-main-refspec",
+        category: "danger",
+        severity: "high",
+        title: "Force push to main or master (+refspec)",
+        advice: "A leading + forces the push. Avoid force-pushing shared branches.",
+        pattern: R `\bgit\s+push\b[^;&|]*\s\+(?:\S*:)?(?:main|master)(?=\s|$)`,
+    },
+    {
+        id: "git/github-token",
+        category: "secret",
+        severity: "high",
+        title: "GitHub token",
+        advice: "Revoke the token at github.com/settings/tokens and remove this entry from your history.",
+        pattern: R `\b(?<secret>(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})`,
+    },
+];

package/dist/risks/packs/index.js

@@ -0,0 +1,18 @@
+import { cloud } from "./cloud.js";
+import { core } from "./core.js";
+import { docker } from "./docker.js";
+import { git } from "./git.js";
+import { kubectl } from "./kubectl.js";
+import { systemd } from "./systemd.js";
+/**
+ * All packs. Specific packs come before `core` so that when two rules match
+ * the same secret, the more specific title wins.
+ */
+export const packs = [
+    { name: "cloud", patterns: cloud },
+    { name: "git", patterns: git },
+    { name: "docker", patterns: docker },
+    { name: "kubectl", patterns: kubectl },
+    { name: "systemd", patterns: systemd },
+    { name: "core", patterns: core },
+];

package/dist/risks/packs/kubectl.js

@@ -0,0 +1,35 @@
+const R = String.raw;
+export const kubectl = [
+    {
+        id: "kubectl/delete-all",
+        category: "danger",
+        severity: "high",
+        title: "kubectl delete --all",
+        advice: "Check the namespace and context first (kubectl config current-context), and use --dry-run=client.",
+        pattern: R `\bkubectl\s+delete\b[^;&|]*\s(?:--all|--all-namespaces|-A)(?=\s|$)`,
+    },
+    {
+        id: "kubectl/delete-namespace",
+        category: "danger",
+        severity: "medium",
+        title: "kubectl delete namespace",
+        advice: "Deleting a namespace removes everything inside it. Confirm the context first.",
+        pattern: R `\bkubectl\s+delete\s+(?:ns|namespaces?)\b`,
+    },
+    {
+        id: "kubectl/secret-literal",
+        category: "secret",
+        severity: "high",
+        title: "Secret value typed with --from-literal",
+        advice: "Rotate the value. Create secrets from a file or a secret manager.",
+        pattern: R `--from-literal[=\s]+["']?[^\s=]+=(?<secret>[^\s"']+)`,
+    },
+    {
+        id: "kubectl/token-flag",
+        category: "secret",
+        severity: "high",
+        title: "Token passed to kubectl",
+        advice: "Revoke the token and use a kubeconfig user entry instead.",
+        pattern: R `\bkubectl\b[^;&|]*\s--token(?:=|\s+)["']?(?<secret>[^\s"'$-][^\s"']*)`,
+    },
+];

package/dist/risks/packs/systemd.js

@@ -0,0 +1,19 @@
+const R = String.raw;
+export const systemd = [
+    {
+        id: "systemd/stop-remote-access",
+        category: "danger",
+        severity: "high",
+        title: "Stopping SSH or networking services",
+        advice: "On a remote machine this can lock you out. Keep a second session open.",
+        pattern: R `\bsystemctl\s+(?:--\S+\s+)*(?:stop|disable|mask)\s+(?:--\S+\s+)*(?:sshd?|networking|NetworkManager|systemd-networkd)(?:\.service)?(?=\s|$)`,
+    },
+    {
+        id: "systemd/isolate-rescue",
+        category: "danger",
+        severity: "medium",
+        title: "systemctl isolate to a minimal or power target",
+        advice: "This stops most services at once. Make sure you have console access.",
+        pattern: R `\bsystemctl\s+isolate\s+(?:rescue|emergency|poweroff|halt)(?:\.target)?(?=\s|$)`,
+    },
+];

package/dist/risks/report.js

@@ -0,0 +1,30 @@
+const ORDER = { high: 0, medium: 1, low: 2 };
+export function sortFindings(findings) {
+    return [...findings].sort((a, b) => ORDER[a.severity] - ORDER[b.severity] || a.entry - b.entry);
+}
+function formatFinding(finding) {
+    const when = finding.date ? ` on ${finding.date}` : "";
+    return [
+        `[${finding.severity.toUpperCase()}] ${finding.title}`,
+        `  entry #${finding.entry}${when}`,
+        `  ${finding.preview}`,
+        `  -> ${finding.advice}`,
+    ].join("\n");
+}
+const SECRET_NOTE = "Rotate every credential listed above, then remove those entries from your history file. aliasforge never edits it.";
+export function renderRisks(findings, entryCount) {
+    if (findings.length === 0)
+        return `No risky commands or secrets found in ${entryCount} history entries.`;
+    const secrets = findings.filter((f) => f.category === "secret").length;
+    const lines = [
+        `${findings.length} finding(s) in ${entryCount} history entries (${secrets} secret, ${findings.length - secrets} dangerous).`,
+        "",
+        sortFindings(findings).map(formatFinding).join("\n\n"),
+    ];
+    if (secrets > 0)
+        lines.push("", SECRET_NOTE);
+    return lines.join("\n");
+}
+export function renderRisksJson(report) {
+    return JSON.stringify({ ...report, findings: sortFindings(report.findings) }, null, 2);
+}

package/dist/risks/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "shell-aliasforge",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Mine your shell history to suggest aliases and flag risky or secret-leaking commands. Local-first, offline, zero dependencies.",
+  "license": "MIT",
+  "author": "Pratik Surve",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/prsurve/aliasforge.git"
+  },
+  "homepage": "https://github.com/prsurve/aliasforge#readme",
+  "bugs": {
+    "url": "https://github.com/prsurve/aliasforge/issues"
+  },
+  "type": "module",
+  "bin": {
+    "aliasforge": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "dev": "tsx src/cli.ts",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "keywords": [
+    "shell",
+    "alias",
+    "history",
+    "cli",
+    "bash",
+    "zsh",
+    "fish",
+    "secrets",
+    "offline"
+  ],
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.5"
+  }
+}