feat(toolsearch): make cloud-platform credential decoders discoverable by full name#102
Merged
Merged
Conversation
…e by full name kubeconfig_decode and gcp_service_account_decode are secret-bearing config decoders (Kubernetes cluster credentials, GCP service-account keys) — prime loot-triage targets — but they name themselves by the platform contraction. A probe against the live tool_search handler showed "kubernetes config", "k8s credentials", and "google cloud service account" surfaced NEITHER: the tool tokens are "kubeconfig" / "gcp", which an operator's full-word phrasing never matches. Same family-discoverability gap the v0.729 automotive / v0.738 financial / v0.739 cellular / v0.740 AirTag synonym clusters fixed. Adds a cloud-platform synonym cluster to internal/toolsearch: - "kubernetes" -> kubeconfig - "k8s" -> kubeconfig - "google" -> gcp - "gcloud" -> gcp All platform-specific (low collision); a probe confirmed "crack wifi password" and "decode a tcp packet" surface no cloud-credential decoder. (ethereum / aws / azure phrasings already resolve and are unchanged.) Verification: a new regression test (TestToolSearch_CloudCredentialDiscoverability) pins the three recovered queries; existing discoverability tests pass. task test (full short suite) 398 ok / 0 fail; task eval 12/12; golangci-lint 0 issues; go vet clean; go build ./... clean. Wired: internal/toolsearch/search.go, internal/tools/tool_search_test.go.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the cloud-platform credential decoders discoverable by an operator's full-word phrasing.
kubeconfig_decode(Kubernetes cluster creds) andgcp_service_account_decode(GCP service-account keys) are prime loot-triage targets, but they name themselves by the platform contraction — so a probe against the livetool_searchhandler showed these surfaced neither:kubernetes configkubeconfig_decodek8s credentialskubeconfig_decodegoogle cloud service accountgcp_service_account_decodeFifth instalment of the family-discoverability work (automotive v0.729, financial v0.738, cellular v0.739, AirTag v0.740).
How
Adds to
internal/toolsearch:kubernetes/k8s→kubeconfig,google/gcloud→gcp. Platform-specific (low collision); verifiedcrack wifi password/decode a tcp packetsurface no cloud-credential decoder. (ethereum / aws / azure phrasings already resolve — unchanged.)Verification
TestToolSearch_CloudCredentialDiscoverabilitypins the three recovered queries; existing discoverability tests pass.task test— full short suite, 398 ok / 0 fail;task eval12/12;golangci-lint0 issues;go vetclean;go build ./...clean.