crackerjack 0.34.1__tar.gz → 0.34.2__tar.gz

{crackerjack-0.34.1 → crackerjack-0.34.2}/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.34.2] - 2025-09-15
+
+### Fixed
+
+- security: Suppress verbose logging and fix commit validation error (parentheses allowed)
+
 ## [0.34.0] - 2025-09-15
 
 ### Changed

{crackerjack-0.34.1 → crackerjack-0.34.2}/CLAUDE.md

@@ -347,3 +347,5 @@ from ..models.protocols import TestManagerProtocol
 - make sure to run `python -m crackerjack` after every editing/debugging cycle for quality checking
 - always put implementation plans in a md doc for review and reference
 - think when you need to think, think harder when you need to think harder
+
+# Test debug logging

{crackerjack-0.34.1 → crackerjack-0.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crackerjack
-Version: 0.34.1
+Version: 0.34.2
 Summary: Crackerjack Python project management tool
 Project-URL: documentation, https://github.com/lesleslie/crackerjack
 Project-URL: homepage, https://github.com/lesleslie/crackerjack

{crackerjack-0.34.1 → crackerjack-0.34.2}/crackerjack/services/secure_subprocess.py

@@ -318,20 +318,47 @@ class SecureSubprocessExecutor:
                 )
                 continue
 
-            if self._has_dangerous_patterns(arg, i, issues):
+            if self._has_dangerous_patterns(arg, i, issues, command):
                 continue
 
             validated_command.append(arg)
 
         return validated_command, issues
 
-    def _has_dangerous_patterns(self, arg: str, index: int, issues: list[str]) -> bool:
+    def _has_dangerous_patterns(
+        self, arg: str, index: int, issues: list[str], command: list[str]
+    ) -> bool:
         # First check if this is an allowed git pattern
         for git_pattern in self.allowed_git_patterns:
             if re.match(git_pattern, arg):
                 return False  # It's an allowed git pattern, don't flag as dangerous
 
-        # Check for dangerous patterns
+        # Special handling for git commit messages
+        if self._is_git_commit_message(index, command):
+            # For git commit messages, only check for truly dangerous patterns
+            # Parentheses are common in commit messages and should be allowed
+            safe_commit_patterns = [
+                r"[;&|`$]",  # Still dangerous in commit messages
+                r"\.\./",  # Path traversal
+                r"\$\{.*\}",  # Variable expansion
+                r"`.*`",  # Command substitution
+                r"\$\(.*\)",  # Command substitution (but allow simple parentheses)
+                r">\s*/",  # Redirection to paths
+                r"<\s*/",  # Redirection from paths
+            ]
+
+            for pattern in safe_commit_patterns:
+                if re.search(pattern, arg):
+                    # Allow simple parentheses that don't look like command substitution
+                    if pattern == r"\$\(.*\)" and not re.search(r"\$\(", arg):
+                        continue
+                    issues.append(
+                        f"Dangerous pattern '{pattern}' in argument {index}: {arg[:50]}"
+                    )
+                    return True
+            return False
+
+        # Check for dangerous patterns in other contexts
         for pattern in self.dangerous_patterns:
             if re.search(pattern, arg):
                 issues.append(
@@ -340,6 +367,18 @@ class SecureSubprocessExecutor:
                 return True
         return False
 
+    def _is_git_commit_message(self, index: int, command: list[str]) -> bool:
+        """Check if the current argument is likely a git commit message."""
+        # Check if we have a git commit command structure: git commit -m <message>
+        if (
+            len(command) >= 3
+            and command[0] == "git"
+            and command[1] == "commit"
+            and command[2] == "-m"
+        ):
+            return index == 3
+        return False
+
     def _validate_executable_permissions(
         self, validated_command: list[str], issues: list[str]
     ) -> None:

{crackerjack-0.34.1 → crackerjack-0.34.2}/crackerjack/services/security_logger.py

@@ -122,20 +122,26 @@ class SecurityLogger:
         self._setup_security_logger()
 
     def _setup_security_logger(self) -> None:
-        self.logger.setLevel(logging.DEBUG)
+        debug_enabled = os.environ.get("CRACKERJACK_DEBUG", "0") == "1"
+
+        # Set appropriate logger level based on debug mode
+        if debug_enabled:
+            self.logger.setLevel(logging.DEBUG)
+        else:
+            # Suppress all security logs during normal operation
+            self.logger.setLevel(logging.CRITICAL + 10)
 
         if not self.logger.handlers:
             console_handler = logging.StreamHandler()
 
-            debug_enabled = os.environ.get("CRACKERJACK_DEBUG", "0") == "1"
             if debug_enabled:
-                console_handler.setLevel(logging.WARNING)
+                console_handler.setLevel(logging.DEBUG)
             else:
                 # Suppress all security logs during normal operation
                 console_handler.setLevel(logging.CRITICAL + 10)
 
             formatter = logging.Formatter(
-                "%(asctime)s - SECURITY - %(levelname)s-%(message)s"
+                "%(asctime)s - SECURITY - %(levelname)s - %(message)s"
             )
             console_handler.setFormatter(formatter)
             self.logger.addHandler(console_handler)

{crackerjack-0.34.1 → crackerjack-0.34.2}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "crackerjack"
-version = "0.34.1"
+version = "0.34.2"
 description = "Crackerjack Python project management tool"
 readme = "README.md"
 authors = [