assay-cli 3.7.0

/// Safe base patterns that always pass in strict mode
pub const SAFE_BASE_PATTERNS: &[&str] = &[
    // System essentials
    "PATH",
    "HOME",
    "USER",
    "SHELL",
    "LOGNAME",
    // Locale & terminal
    "LANG",
    "LC_*",
    "TERM",
    "COLORTERM",
    "CLICOLOR",
    "CLICOLOR_FORCE",
    "NO_COLOR",
    "FORCE_COLOR",
    // Temp directories (will be overwritten with scoped path)
    "TMPDIR",
    "TMP",
    "TEMP",
    // XDG directories
    "XDG_*",
    // Rust development
    "RUST_LOG",
    "RUST_BACKTRACE",
    "RUST_LIB_BACKTRACE",
    "CARGO_HOME",
    "CARGO_TARGET_DIR",
    "RUSTUP_HOME",
    // Editor & tools
    "EDITOR",
    "VISUAL",
    "PAGER",
    "LESS",
    "LESSCHARSET",
    // Timezone
    "TZ",
];

/// Secret patterns to scrub in Scrub mode
pub const SECRET_SCRUB_PATTERNS: &[&str] = &[
    // Generic credential patterns
    "*_TOKEN",
    "*_SECRET",
    "*_KEY",
    "*_PASSWORD",
    "*_CREDENTIAL*",
    "*_API_KEY",
    "*_APIKEY",
    "*_AUTH",
    "*_BEARER",
    // Cloud providers
    "AWS_*",
    "OPENAI_*",
    "ANTHROPIC_*",
    "AZURE_*",
    "GCP_*",
    "GOOGLE_*",
    "DIGITALOCEAN_*",
    "LINODE_*",
    "VULTR_*",
    "CLOUDFLARE_*",
    "HEROKU_*",
    "VERCEL_*",
    "NETLIFY_*",
    "FLY_*",
    // Version control & CI
    "GITHUB_*",
    "GITLAB_*",
    "BITBUCKET_*",
    "CI_*",
    "CIRCLE_*",
    "TRAVIS_*",
    "JENKINS_*",
    "BUILDKITE_*",
    "CODEBUILD_*",
    // Databases & storage
    "DATABASE_URL",
    "*_DATABASE_URL",
    "*_CONNECTION_STRING",
    "*_CONN_STR",
    "REDIS_*",
    "MONGO_*",
    "MYSQL_*",
    "POSTGRES_*",
    "PGPASSWORD",
    "PGUSER",
    // Security tools
    "SSH_*",
    "GPG_*",
    "VAULT_*",
    "KUBECONFIG",
    "DOCKER_*",
    // Package managers
    "NPM_TOKEN",
    "NPM_AUTH_TOKEN",
    "YARN_*",
    "PIP_*",
    "PYPI_*",
    "CARGO_REGISTRY_TOKEN",
    "GEM_*",
    "NUGET_*",
    // Misc
    "*_PRIVATE_KEY",
    "*_SIGNING_KEY",
    "*_ENCRYPTION_KEY",
    "SLACK_*",
    "DISCORD_*",
    "TWILIO_*",
    "SENDGRID_*",
    "STRIPE_*",
    "SENTRY_*",
    "DATADOG_*",
    "NEWRELIC_*",
];

/// Execution-influence variables (code injection risk)
pub const EXEC_INFLUENCE_PATTERNS: &[&str] = &[
    // Dynamic linker (Linux)
    "LD_PRELOAD",
    "LD_LIBRARY_PATH",
    "LD_AUDIT",
    "LD_DEBUG",
    "LD_DEBUG_OUTPUT",
    "LD_PROFILE",
    "LD_PROFILE_OUTPUT",
    "LD_BIND_NOW",
    "LD_BIND_NOT",
    "LD_DYNAMIC_WEAK",
    "LD_HWCAP_MASK",
    "LD_ORIGIN_PATH",
    "LD_ASSUME_KERNEL",
    "LD_POINTER_GUARD",
    "LD_PREFER_MAP_32BIT_EXEC",
    "LD_SHOW_AUXV",
    "LD_USE_LOAD_BIAS",
    "LD_VERBOSE",
    "LD_WARN",
    // Dynamic linker (macOS)
    "DYLD_*",
    // Python
    "PYTHONPATH",
    "PYTHONSTARTUP",
    "PYTHONHOME",
    "PYTHONUSERBASE",
    "PYTHONEXECUTABLE",
    "PYTHONWARNINGS",
    "PYTHONDONTWRITEBYTECODE",
    "PYTHONHASHSEED",
    "PYTHONINSPECT",
    "PYTHONIOENCODING",
    "PYTHONNOUSERSITE",
    "PYTHONOPTIMIZE",
    "PYTHONUNBUFFERED",
    "PYTHONVERBOSE",
    "PYTHONMALLOC",
    "PYTHONCOERCECLOCALE",
    "PYTHONDEVMODE",
    "PYTHONFAULTHANDLER",
    "PYTHONTRACEMALLOC",
    "PYTHONPROFILEIMPORTTIME",
    "PYTHONBREAKPOINT",
    // Node.js
    "NODE_OPTIONS",
    "NODE_PATH",
    "NODE_EXTRA_CA_CERTS",
    "NODE_REDIRECT_WARNINGS",
    "NODE_DEBUG",
    "NODE_DEBUG_NATIVE",
    "NODE_PENDING_DEPRECATION",
    "NODE_PENDING_PIPE_INSTANCES",
    "NODE_PRESERVE_SYMLINKS",
    "NODE_PRESERVE_SYMLINKS_MAIN",
    "NODE_REPL_EXTERNAL_MODULE",
    "NODE_REPL_HISTORY",
    "NODE_TLS_REJECT_UNAUTHORIZED",
    "NODE_V8_COVERAGE",
    // Ruby
    "RUBYOPT",
    "RUBYLIB",
    "RUBYPATH",
    "RUBYSHELL",
    "RUBY_GC_*",
    "RUBY_THREAD_*",
    // Perl
    "PERL5LIB",
    "PERL5OPT",
    "PERLLIB",
    "PERL_MM_OPT",
    "PERL_MB_OPT",
    // Java
    "JAVA_TOOL_OPTIONS",
    "_JAVA_OPTIONS",
    "JAVA_OPTIONS",
    "CLASSPATH",
    "JDK_JAVA_OPTIONS",
    // Rust
    "RUSTC_WRAPPER",
    "RUSTDOC_WRAPPER",
    "RUSTC_WORKSPACE_WRAPPER",
    "RUSTFLAGS",
    "RUSTDOCFLAGS",
    "CARGO_ENCODED_RUSTFLAGS",
    "CARGO_ENCODED_RUSTDOCFLAGS",
    "CARGO_BUILD_RUSTFLAGS",
    "CARGO_BUILD_RUSTDOCFLAGS",
    // C/C++ build
    "CC",
    "CXX",
    "CPP",
    "CFLAGS",
    "CXXFLAGS",
    "CPPFLAGS",
    "LDFLAGS",
    "LIBS",
    "AR",
    "AS",
    "LD",
    "NM",
    "OBJCOPY",
    "OBJDUMP",
    "RANLIB",
    "STRIP",
    "PKG_CONFIG",
    "PKG_CONFIG_PATH",
    "PKG_CONFIG_LIBDIR",
    "CMAKE_*",
    "MAKEFLAGS",
    "MFLAGS",
    "MAKELEVEL",
    // Shell behavior
    "BASH_ENV",
    "ENV",
    "ZDOTDIR",
    "CDPATH",
    "GLOBIGNORE",
    "BASH_XTRACEFD",
    "PS4",
    "PROMPT_COMMAND",
    "FIGNORE",
    "HOSTFILE",
    "INPUTRC",
    "MAILPATH",
    "TIMEFORMAT",
    // Git (selective: hooks can execute code)
    "GIT_EXEC_PATH",
    "GIT_TEMPLATE_DIR",
    "GIT_CONFIG_GLOBAL",
    "GIT_CONFIG_SYSTEM",
    "GIT_ASKPASS",
    "GIT_SSH",
    "GIT_SSH_COMMAND",
    "SSH_ASKPASS",
    "SUDO_ASKPASS",
    "GIT_EXTERNAL_DIFF",
    "GIT_DIFF_OPTS",
    "GIT_PAGER",
    "GIT_EDITOR",
    "GIT_SEQUENCE_EDITOR",
    // Misc execution control
    "SHELL", // Note: this is also in SAFE_BASE, strip_exec wins if conflicting
    "EXECIGNORE",
    "IFS",
];