cli-mem 0.3.4__tar.gz → 0.3.5__tar.gz

{cli_mem-0.3.4 → cli_mem-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cli-mem
-Version: 0.3.4
+Version: 0.3.5
 Summary: Privacy-first CLI that turns shell history into searchable memory
 Project-URL: GitHub, https://github.com/matinsaurralde/mem
 Author: Matias Insaurralde

{cli_mem-0.3.4 → cli_mem-0.3.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-mem"
-version = "0.3.4"
+version = "0.3.5"
 description = "Privacy-first CLI that turns shell history into searchable memory"
 license = "MIT"
 readme = "README.md"

{cli_mem-0.3.4 → cli_mem-0.3.5}/src/mem/__init__.py

@@ -1,3 +1,3 @@
 """mem — your shell history, understood."""
 
-__version__ = "0.3.4"
+__version__ = "0.3.5"

{cli_mem-0.3.4 → cli_mem-0.3.5}/src/mem/variables.py

@@ -313,6 +313,41 @@ def _normalize_var_name(name: str) -> str:
     return result.strip("_")
 
 
+def _extract_value_from_syntax(original_value: str, cmd: str) -> str:
+    """Extract the actual secret value from flag=value or KEY=value syntax.
+
+    The AI sometimes returns 'GITHUB_TOKEN=ghp_abc...' or '--password=secret'
+    as the original_value. We need just the secret part so that .replace()
+    doesn't destroy the command structure.
+    """
+    # Pattern: --flag=value or -f=value (CLI flag syntax)
+    flag_match = re.match(r"^--?[a-zA-Z][\w-]*=(.+)$", original_value)
+    if flag_match:
+        value = flag_match.group(1)
+        if value in cmd:
+            return value
+
+    # Pattern: ENV_VAR=value (environment variable assignment)
+    env_match = re.match(r"^[A-Z][A-Z0-9_]+=(.+)$", original_value)
+    if env_match:
+        value = env_match.group(1)
+        if value in cmd:
+            return value
+
+    return original_value
+
+
+def _looks_like_hostname(value: str) -> bool:
+    """Check if a value looks like a hostname or domain, not a credential."""
+    # Hostnames: words joined by dots, no special chars typical of secrets
+    if re.match(r"^[a-zA-Z0-9]([a-zA-Z0-9-]*\.)+[a-zA-Z]{2,}$", value):
+        return True
+    # IP addresses
+    if re.match(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$", value):
+        return True
+    return False
+
+
 def _deduplicate_detections(
     detections: list[tuple[str, str, str]],
     cmd: str,
@@ -325,30 +360,39 @@ def _deduplicate_detections(
     - Very short values (< 8 chars, not plausible secrets)
     - Duplicate original_value entries
     - Values that are substrings of other detected values
+
+    Also extracts the actual secret from flag=value syntax when the AI
+    returns the whole expression as original_value.
     """
     result: list[tuple[str, str, str]] = []
     seen_values: set[str] = set()
 
     for original_value, suggested_name, reason in detections:
+        # Extract actual value from flag=value or ENV=value syntax
+        value = _extract_value_from_syntax(original_value, cmd)
+
         # Skip hallucinated values not in the command
-        if original_value not in cmd:
+        if value not in cmd:
             continue
         # Skip URLs
-        if original_value.startswith(("http://", "https://")):
+        if value.startswith(("http://", "https://")):
+            continue
+        # Skip hostnames and IP addresses
+        if _looks_like_hostname(value):
             continue
         # Skip very short values
-        if len(original_value) < 8:
+        if len(value) < 8:
             continue
         # Skip duplicates
-        if original_value in seen_values:
+        if value in seen_values:
             continue
         # Normalize suggested name to UPPER_SNAKE_CASE
         normalized = _normalize_var_name(suggested_name)
         if not re.match(r"^[A-Z][A-Z0-9_]+$", normalized):
             continue
 
-        seen_values.add(original_value)
-        result.append((original_value, normalized, reason))
+        seen_values.add(value)
+        result.append((value, normalized, reason))
 
     # Remove values that are substrings of other detected values
     filtered: list[tuple[str, str, str]] = []
@@ -387,17 +431,26 @@ async def _detect_credentials_async(cmd: str) -> list[tuple[str, str, str]]:
     prompt = (
         "Analyze this shell command and find ONLY hardcoded sensitive values "
         "that should be replaced with environment variables.\n\n"
+        "RULES FOR original_value:\n"
+        "- Return ONLY the literal secret value, not the flag or key name.\n"
+        "- For --password=mysecret, return 'mysecret' not '--password=mysecret'.\n"
+        "- For GITHUB_TOKEN=ghp_abc, return 'ghp_abc' not 'GITHUB_TOKEN=ghp_abc'.\n"
+        "- For postgres://user:pass@host, return 'pass' not the full URL.\n\n"
+        "RULES FOR suggested_name:\n"
+        "- Derive the name from the service or tool in the command.\n"
+        "- Examples: STRIPE_API_KEY, GITHUB_TOKEN, REDIS_PASSWORD, DB_PASSWORD.\n"
+        "- NEVER use generic prefixes like ACME_.\n\n"
         "ONLY flag these types of values:\n"
-        "- API tokens or keys (long alphanumeric/base64 strings like eyJhbG..., sk-...)\n"
-        "- Passwords passed inline (after --password, -p, etc.)\n"
+        "- API tokens or keys (long alphanumeric/base64 strings)\n"
+        "- Passwords passed inline (after --password, -p, -a, etc.)\n"
         "- Bearer tokens in Authorization headers\n"
-        "- Database connection strings with embedded passwords\n\n"
+        "- Embedded passwords in connection strings\n\n"
         "DO NOT flag:\n"
-        "- URLs, hostnames, or IP addresses\n"
-        "- The command name or subcommands\n"
+        "- URLs, hostnames, IP addresses, or domain names\n"
+        "- The command name, subcommands, or usernames\n"
         "- Short strings, regular arguments, or file paths\n"
-        "- Port numbers or known constants\n\n"
-        "If the command contains NO credentials, return an EMPTY list with no entries.\n\n"
+        "- Port numbers, known constants, or registry addresses\n\n"
+        "If NO credentials found, return an EMPTY list.\n\n"
         f"Command: {cmd}"
     )
 

{cli_mem-0.3.4 → cli_mem-0.3.5}/tests/test_groups.py

@@ -1858,3 +1858,110 @@ class TestDeduplicateDetections:
         detections = [(token, "AcmeApiToken", "JWT")]
         result = _deduplicate_detections(detections, cmd)
         assert result[0][1] == "ACME_API_TOKEN"
+
+    def test_extracts_value_from_flag_syntax(self):
+        """Bug A: AI returns '--password=secret' instead of just 'secret'."""
+        from mem.variables import _deduplicate_detections
+
+        cmd = "mysql -u admin --password=S3cretP@ssw0rd123 mydb"
+        detections = [("--password=S3cretP@ssw0rd123", "DB_PASSWORD", "password")]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "S3cretP@ssw0rd123"
+
+    def test_extracts_value_from_env_var_syntax(self):
+        """Bug A: AI returns 'GITHUB_TOKEN=ghp_abc...' instead of just the token."""
+        from mem.variables import _deduplicate_detections
+
+        token = "ghp_abcdefghijklmnopqrstuvwxyz123456"
+        cmd = f"GITHUB_TOKEN={token} gh pr create"
+        detections = [(f"GITHUB_TOKEN={token}", "GITHUB_TOKEN", "API token")]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == token
+
+    def test_filters_hostnames(self):
+        """Bug C: hostnames like registry.ghcr.io are not credentials."""
+        from mem.variables import _deduplicate_detections
+
+        cmd = "docker login -u deploy -p secret123456789 registry.ghcr.io"
+        detections = [
+            ("secret123456789", "REGISTRY_TOKEN", "token"),
+            ("registry.ghcr.io", "REGISTRY_URL", "hostname"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "secret123456789"
+
+    def test_filters_ip_addresses(self):
+        from mem.variables import _deduplicate_detections
+
+        cmd = "redis-cli -h 10.0.1.50 -a MyR3d1sPassword123 PING"
+        detections = [
+            ("MyR3d1sPassword123", "REDIS_PASSWORD", "password"),
+            ("10.0.1.50", "REDIS_HOST", "IP address"),
+        ]
+        result = _deduplicate_detections(detections, cmd)
+        assert len(result) == 1
+        assert result[0][0] == "MyR3d1sPassword123"
+
+
+class TestExtractValueFromSyntax:
+    """Unit tests for _extract_value_from_syntax."""
+
+    def test_cli_flag_long(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "mysql --password=secret123 mydb"
+        assert _extract_value_from_syntax("--password=secret123", cmd) == "secret123"
+
+    def test_cli_flag_short(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "tool -p=myvalue123 arg"
+        assert _extract_value_from_syntax("-p=myvalue123", cmd) == "myvalue123"
+
+    def test_env_var_assignment(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "GITHUB_TOKEN=ghp_abc123 gh pr create"
+        assert _extract_value_from_syntax("GITHUB_TOKEN=ghp_abc123", cmd) == "ghp_abc123"
+
+    def test_plain_value_unchanged(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "curl -H 'Bearer eyJtoken'"
+        assert _extract_value_from_syntax("eyJtoken", cmd) == "eyJtoken"
+
+    def test_value_not_in_cmd_returns_original(self):
+        from mem.variables import _extract_value_from_syntax
+
+        cmd = "echo hello"
+        assert _extract_value_from_syntax("--flag=nothere", cmd) == "--flag=nothere"
+
+
+class TestLooksLikeHostname:
+    def test_domain(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("registry.ghcr.io") is True
+
+    def test_subdomain(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("api.prod.internal.company.com") is True
+
+    def test_ip_address(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("10.0.1.50") is True
+
+    def test_token_not_hostname(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("eyJhbGciOiJIUzI1NiJ9") is False
+
+    def test_password_not_hostname(self):
+        from mem.variables import _looks_like_hostname
+
+        assert _looks_like_hostname("S3cretP@ssw0rd") is False