cli-mem 0.3.2__tar.gz → 0.3.3__tar.gz

{cli_mem-0.3.2 → cli_mem-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cli-mem
-Version: 0.3.2
+Version: 0.3.3
 Summary: Privacy-first CLI that turns shell history into searchable memory
 Project-URL: GitHub, https://github.com/matinsaurralde/mem
 Author: Matias Insaurralde

{cli_mem-0.3.2 → cli_mem-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-mem"
-version = "0.3.2"
+version = "0.3.3"
 description = "Privacy-first CLI that turns shell history into searchable memory"
 license = "MIT"
 readme = "README.md"

{cli_mem-0.3.2 → cli_mem-0.3.3}/src/mem/__init__.py

@@ -1,3 +1,3 @@
 """mem — your shell history, understood."""
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"

{cli_mem-0.3.2 → cli_mem-0.3.3}/src/mem/cli.py

@@ -431,11 +431,19 @@ def save(
             err_console.print(f"\n  Detected possible credential: {reason}")
             proposed = command.replace(original_value, f"${suggested_name}")
             err_console.print(f"  Suggested: {proposed}")
-            var_name = click.prompt(
-                "  Variable name",
-                default=suggested_name,
-                err=True,
-            )
+            # Prompt for variable name with validation loop
+            while True:
+                var_name = click.prompt(
+                    "  Variable name",
+                    default=suggested_name,
+                    err=True,
+                )
+                if _re.match(r"^[A-Z][A-Z0-9_]+$", var_name):
+                    break
+                err_console.print(
+                    f"  Invalid name '{var_name}'. "
+                    "Must be UPPERCASE letters, digits, underscores (min 2 chars)."
+                )
             if click.confirm("  Save with variable?", default=True, err=True):
                 command = command.replace(original_value, f"${var_name}")
 

{cli_mem-0.3.2 → cli_mem-0.3.3}/src/mem/variables.py

@@ -261,6 +261,109 @@ def check_resolution_status(
     return result
 
 
+# Minimum token length that could plausibly be a hardcoded credential.
+# Real secrets (JWTs, API keys, base64 strings) are almost always 16+ chars.
+_MIN_CREDENTIAL_TOKEN_LEN = 16
+
+
+def _command_may_contain_credentials(cmd: str) -> bool:
+    """Quick heuristic to skip AI detection on simple commands.
+
+    Returns True only if the command plausibly contains hardcoded secrets.
+    Avoids sending trivial commands (echo, ls, cd) to the on-device model.
+    """
+    import shlex
+
+    # Known credential-context keywords — if present, always check
+    _CREDENTIAL_KEYWORDS = {
+        "bearer",
+        "authorization",
+        "password",
+        "token",
+        "secret",
+        "api_key",
+        "apikey",
+        "private_key",
+        "access_key",
+    }
+    lower = cmd.lower()
+    if any(kw in lower for kw in _CREDENTIAL_KEYWORDS):
+        return True
+
+    # Check for any token long enough to be a credential
+    try:
+        tokens = shlex.split(cmd)
+    except ValueError:
+        tokens = cmd.split()
+    return any(len(t.strip("'\"")) >= _MIN_CREDENTIAL_TOKEN_LEN for t in tokens)
+
+
+def _normalize_var_name(name: str) -> str:
+    """Normalize a suggested variable name to UPPER_SNAKE_CASE.
+
+    Handles CamelCase, mixed-case, and invalid characters from AI output.
+    """
+    # Convert CamelCase to UPPER_SNAKE
+    result = re.sub(r"(?<=[a-z])(?=[A-Z])", "_", name)
+    result = result.upper()
+    # Strip invalid characters
+    result = re.sub(r"[^A-Z0-9_]", "_", result)
+    # Collapse multiple underscores
+    result = re.sub(r"_+", "_", result)
+    return result.strip("_")
+
+
+def _deduplicate_detections(
+    detections: list[tuple[str, str, str]],
+    cmd: str,
+) -> list[tuple[str, str, str]]:
+    """Filter out invalid and duplicate credential detections.
+
+    Removes:
+    - Values not actually present in the command (AI hallucinations)
+    - URLs and hostnames (not credentials)
+    - Very short values (< 8 chars, not plausible secrets)
+    - Duplicate original_value entries
+    - Values that are substrings of other detected values
+    """
+    result: list[tuple[str, str, str]] = []
+    seen_values: set[str] = set()
+
+    for original_value, suggested_name, reason in detections:
+        # Skip hallucinated values not in the command
+        if original_value not in cmd:
+            continue
+        # Skip URLs
+        if original_value.startswith(("http://", "https://")):
+            continue
+        # Skip very short values
+        if len(original_value) < 8:
+            continue
+        # Skip duplicates
+        if original_value in seen_values:
+            continue
+        # Normalize suggested name to UPPER_SNAKE_CASE
+        normalized = _normalize_var_name(suggested_name)
+        if not re.match(r"^[A-Z][A-Z0-9_]+$", normalized):
+            continue
+
+        seen_values.add(original_value)
+        result.append((original_value, normalized, reason))
+
+    # Remove values that are substrings of other detected values
+    filtered: list[tuple[str, str, str]] = []
+    for i, (val_i, name_i, reason_i) in enumerate(result):
+        is_subset = any(
+            val_i in val_j and val_i != val_j
+            for j, (val_j, _, _) in enumerate(result)
+            if i != j
+        )
+        if not is_subset:
+            filtered.append((val_i, name_i, reason_i))
+
+    return filtered
+
+
 def _apple_fm_available() -> bool:
     """Check if Apple Foundation Models SDK is available."""
     try:
@@ -282,10 +385,19 @@ async def _detect_credentials_async(cmd: str) -> list[tuple[str, str, str]]:
 
     session = fm.LanguageModelSession()
     prompt = (
-        "Analyze this shell command and identify any sensitive values "
-        "(API tokens, passwords, secrets, keys, long base64 strings). "
-        "For each one, suggest a descriptive variable name based on the "
-        "context of the command.\n\n"
+        "Analyze this shell command and find ONLY hardcoded sensitive values "
+        "that should be replaced with environment variables.\n\n"
+        "ONLY flag these types of values:\n"
+        "- API tokens or keys (long alphanumeric/base64 strings like eyJhbG..., sk-...)\n"
+        "- Passwords passed inline (after --password, -p, etc.)\n"
+        "- Bearer tokens in Authorization headers\n"
+        "- Database connection strings with embedded passwords\n\n"
+        "DO NOT flag:\n"
+        "- URLs, hostnames, or IP addresses\n"
+        "- The command name or subcommands\n"
+        "- Short strings, regular arguments, or file paths\n"
+        "- Port numbers or known constants\n\n"
+        "If the command contains NO credentials, return an EMPTY list with no entries.\n\n"
         f"Command: {cmd}"
     )
 
@@ -302,9 +414,14 @@ def detect_credentials(cmd: str) -> list[tuple[str, str, str]]:
     if not _apple_fm_available():
         return []
 
+    # Pre-filter: skip commands unlikely to contain credentials
+    if not _command_may_contain_credentials(cmd):
+        return []
+
     try:
         import asyncio
 
-        return asyncio.run(_detect_credentials_async(cmd))
+        raw = asyncio.run(_detect_credentials_async(cmd))
+        return _deduplicate_detections(raw, cmd)
     except Exception:
         return []

{cli_mem-0.3.2 → cli_mem-0.3.3}/tests/test_groups.py

@@ -1718,3 +1718,143 @@ class TestRepoDisplayPath:
         assert FAKE_REPO in result.output
         # Sanitized name should NOT appear
         assert repo_name not in result.output
+
+
+# ---------------------------------------------------------------------------
+# Credential detection helpers (pre-filter, deduplication, normalization)
+# ---------------------------------------------------------------------------
+
+
+class TestCredentialPreFilter:
+    """Fix 4: skip AI detection on simple commands."""
+
+    def test_simple_echo_skipped(self):
+        from mem.variables import _command_may_contain_credentials
+
+        assert _command_may_contain_credentials("echo hello") is False
+
+    def test_ls_skipped(self):
+        from mem.variables import _command_may_contain_credentials
+
+        assert _command_may_contain_credentials("ls -la") is False
+
+    def test_short_command_skipped(self):
+        from mem.variables import _command_may_contain_credentials
+
+        assert _command_may_contain_credentials("cd /tmp") is False
+
+    def test_bearer_token_detected(self):
+        from mem.variables import _command_may_contain_credentials
+
+        cmd = "curl -H 'Authorization: Bearer eyJhbGciOi...' https://api.example.com"
+        assert _command_may_contain_credentials(cmd) is True
+
+    def test_long_token_detected(self):
+        from mem.variables import _command_may_contain_credentials
+
+        cmd = "curl -H 'X-Api-Key: abcdefghijklmnopqrstuvwxyz' https://api.example.com"
+        assert _command_may_contain_credentials(cmd) is True
+
+    def test_password_keyword_detected(self):
+        from mem.variables import _command_may_contain_credentials
+
+        cmd = "mysql -u root --password=secret"
+        assert _command_may_contain_credentials(cmd) is True
+
+
+class TestNormalizeVarName:
+    """AI often suggests CamelCase names — normalize to UPPER_SNAKE_CASE."""
+
+    def test_camel_case(self):
+        from mem.variables import _normalize_var_name
+
+        assert _normalize_var_name("ShellCommandExecution") == "SHELL_COMMAND_EXECUTION"
+
+    def test_already_upper_snake(self):
+        from mem.variables import _normalize_var_name
+
+        assert _normalize_var_name("ACME_API_TOKEN") == "ACME_API_TOKEN"
+
+    def test_lowercase(self):
+        from mem.variables import _normalize_var_name
+
+        assert _normalize_var_name("acme_var") == "ACME_VAR"
+
+    def test_mixed_with_invalid_chars(self):
+        from mem.variables import _normalize_var_name
+
+        assert _normalize_var_name("my-api.key") == "MY_API_KEY"
+
+
+class TestDeduplicateDetections:
+    """Fix 3: filter out hallucinations, URLs, and overlapping detections."""
+
+    def test_filters_hallucinated_values(self):
+        from mem.variables import _deduplicate_detections
+
+        cmd = "echo hello"
+        detections = [("not_in_command", "SOME_VAR", "hallucination")]
+        assert _deduplicate_detections(detections, cmd) == []
+
+    def test_filters_urls(self):
+        from mem.variables import _deduplicate_detections
+
+        cmd = "curl https://api.example.com/users"
+        detections = [
+            ("https://api.example.com/users", "API_URL", "URL endpoint"),
+        ]
+        assert _deduplicate_detections(detections, cmd) == []
+
+    def test_filters_short_values(self):
+        from mem.variables import _deduplicate_detections
+
+        cmd = "echo short"
+        detections = [("short", "MY_VAR", "too short")]
+        assert _deduplicate_detections(detections, cmd) == []
+
+    def test_keeps_valid_credential(self):
+        from mem.variables import _deduplicate_detections
+
+        token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+        cmd = f"curl -H 'Authorization: Bearer {token}' https://api.example.com"
+        detections = [(token, "ACME_API_TOKEN", "JWT token")]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == token
+        assert result[0][1] == "ACME_API_TOKEN"
+
+    def test_removes_subset_detections(self):
+        from mem.variables import _deduplicate_detections
+
+        token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+        full_header = f"Bearer {token}"
+        cmd = f"curl -H 'Authorization: {full_header}' https://api.example.com"
+        detections = [
+            (token, "API_TOKEN", "JWT token"),
+            (full_header, "AUTH_HEADER", "Bearer token"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        # Should keep only the longer one (full_header contains token)
+        assert len(result) == 1
+        assert result[0][0] == full_header
+
+    def test_deduplicates_same_value(self):
+        from mem.variables import _deduplicate_detections
+
+        token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+        cmd = f"curl -H 'Authorization: Bearer {token}'"
+        detections = [
+            (token, "TOKEN_A", "reason 1"),
+            (token, "TOKEN_B", "reason 2"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+
+    def test_normalizes_suggested_names(self):
+        from mem.variables import _deduplicate_detections
+
+        token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+        cmd = f"curl -H 'Bearer {token}'"
+        detections = [(token, "AcmeApiToken", "JWT")]
+        result = _deduplicate_detections(detections, cmd)
+        assert result[0][1] == "ACME_API_TOKEN"