@aictrl/hush 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of Your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,112 @@
+<p align="center">
+  <img src="logo.svg" width="400" alt="hush Logo" />
+</p>
+
+**hush** is a Semantic Security Gateway for AI agents.
+ It acts as a local proxy between your AI tools (like Claude Code, Cursor, or custom CLI agents) and LLM providers (Anthropic, OpenAI).
+
+Hush ensures that sensitive data—like emails, IP addresses, and secrets—never leaves your machine by redacting it from prompts and tool outputs before they hit the cloud.
+
+## Why Hush?
+
+When an AI agent runs a local tool (like `snow` or `ls`), it often returns PII (Personally Identifiable Information) to the terminal. Without Hush, this sensitive data is sent directly to the LLM provider for processing.
+
+Hush intercepts this traffic, replaces PII with persistent tokens, and stores the original values in a local `TokenVault`.
+
+## Features
+
+- **Semantic Redaction:** Automatically identifies and masks PII (emails, IPs, secrets, credit cards) using high-entropy random tokens (e.g., `[HUSH_EML_8a2b3c]`).
+- **Local Rehydration:** Automatically restores original values in the LLM's response locally. You see the real data; the cloud provider only sees tokens.
+- **Live Protection Dashboard:** Run with `--dashboard` to see a real-time TUI showing PII being blocked and intercepted.
+- **Zero-Trust Architecture:** Local-only processing. PII never leaves your machine. Bindings default to `127.0.0.1`.
+- **Streaming Support:** Robust rehydration for SSE (Server-Sent Events) even when tokens are split across network chunks.
+
+## Getting Started
+
+### Installation
+
+```bash
+npm install -g @aictrl/hush
+```
+
+### Usage
+
+1.  **Start the hush Gateway:**
+    ```bash
+    hush --dashboard
+    ```
+    hush will start listening on `http://127.0.0.1:4000`.
+
+2.  **Point your AI tool to the Gateway:**
+
+    For **Claude Code**:
+    ```bash
+    export ANTHROPIC_BASE_URL=http://127.0.0.1:4000
+    claude
+    ```
+
+    For **OpenAI-based tools**:
+    ```bash
+    export OPENAI_BASE_URL=http://127.0.0.1:4000/v1
+    ```
+
+    For **Google Gemini**:
+    ```bash
+    # For the Google Generative AI SDK
+    export GOOGLE_GENERATIVE_AI_BASE_URL=http://127.0.0.1:4000
+
+    # For the Gemini CLI
+    export CODE_ASSIST_ENDPOINT=http://127.0.0.1:4000
+    ```
+
+## Configuration
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `PORT` | The port the gateway listens on. | `4000` |
+| `HUSH_HOST` | The host interface to bind to. | `127.0.0.1` |
+| `HUSH_AUTH_TOKEN` | If set, the proxy requires `Authorization: Bearer <token>` | `undefined` |
+| `HUSH_DASHBOARD` | Set to `true` to enable the TUI dashboard. | `false` |
+
+## How it Works
+
+1.  **Intercept:** Hush sits locally on your machine as an HTTP proxy.
+2.  **Redact:** Before a request is forwarded to Anthropic/OpenAI, Hush scans the message content for sensitive data and swaps it for tokens (e.g., `[USER_EMAIL_1]`).
+3.  **Vault:** The original data is saved in a local, in-memory `TokenVault`.
+4.  **Forward:** The redacted request is sent to the LLM provider.
+5.  **Rehydrate:** When the LLM responds, Hush re-inserts the original values from the vault before showing the response to you.
+
+## Development
+
+### Prerequisites
+
+- Node.js 18+
+- npm
+
+### Setup
+
+```bash
+git clone https://github.com/aictrl-dev/hush.git
+cd hush
+npm install
+```
+
+### Testing
+
+```bash
+npm test
+```
+
+### Building
+
+```bash
+npm run build
+```
+
+## Contributing
+
+We welcome contributions! Please see our [CONTRIBUTING.md](CONTRIBUTING.md) for details.
+
+## License
+
+This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { app } from './index.js';
+import { createLogger } from './lib/logger.js';
+const log = createLogger('hush-cli');
+const PORT = process.env.PORT || 4000;
+app.listen(PORT, () => {
+    log.info(`Hush Semantic Gateway is listening on http://localhost:${PORT}`);
+    log.info(`To use with Claude Code: export ANTHROPIC_BASE_URL=http://localhost:${PORT}`);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;AAEtC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACpB,GAAG,CAAC,IAAI,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;IAC3E,GAAG,CAAC,IAAI,CAAC,uEAAuE,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export declare const app: import("express-serve-static-core").Express;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,GAAG,6CAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,210 @@
+import express from 'express';
+import cors from 'cors';
+import { createLogger } from './lib/logger.js';
+import { Redactor } from './middleware/redactor.js';
+import { TokenVault } from './vault/token-vault.js';
+import { Dashboard } from './lib/dashboard.js';
+const log = createLogger('hush-proxy');
+const redactor = new Redactor();
+const vault = new TokenVault();
+// Lazy-initialize dashboard to ensure it captures flags set by CLI or ENV
+let _dashboard = null;
+function getDashboard() {
+    if (_dashboard)
+        return _dashboard;
+    if (process.env.HUSH_DASHBOARD === 'true' || process.argv.includes('--dashboard')) {
+        _dashboard = new Dashboard();
+    }
+    return _dashboard;
+}
+// Force immediate initialization if dashboard flag is present
+getDashboard();
+export const app = express();
+// Security: Bind only to localhost by default to prevent network exposure
+const BIND_ADDRESS = process.env.HUSH_HOST || '127.0.0.1';
+// Security: Optional Bearer Token for the proxy itself
+const HUSH_TOKEN = process.env.HUSH_AUTH_TOKEN;
+app.use(cors({ origin: 'http://localhost' })); // Restrict CORS
+app.use(express.json({ limit: '50mb' }));
+/**
+ * Security Middleware: Local Proxy Authentication
+ */
+app.use((req, res, next) => {
+    if (req.path === '/health')
+        return next();
+    if (HUSH_TOKEN) {
+        const authHeader = req.headers['x-hush-token'] || req.headers['authorization'];
+        const providedToken = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+        if (!providedToken || (providedToken !== HUSH_TOKEN && providedToken !== `Bearer ${HUSH_TOKEN}`)) {
+            log.warn({ ip: req.ip }, 'Unauthorized access attempt');
+            return res.status(401).json({ error: 'Unauthorized: Invalid HUSH_AUTH_TOKEN' });
+        }
+    }
+    next();
+});
+/**
+ * Helper to handle proxying with optional streaming
+ */
+async function proxyRequest(req, res, targetUrl, headers) {
+    const startTime = performance.now();
+    const dashboard = getDashboard();
+    // 1. Redact Request Body (Prompts, Tool Results)
+    const { content: redactedBody, tokens, hasRedacted } = redactor.redact(req.body);
+    const redactionDuration = Math.round(performance.now() - startTime);
+    // Log all requests to dashboard
+    if (dashboard) {
+        dashboard.logRequest(req.path, redactionDuration);
+    }
+    if (hasRedacted) {
+        log.info({ path: req.path, tokenCount: tokens.size, duration: redactionDuration }, 'Redacted sensitive data from request');
+        vault.saveTokens(tokens);
+        // Log redaction events
+        if (dashboard) {
+            tokens.forEach((value, token) => {
+                const type = token.split('_')[1] ?? 'UNK'; // Extract type from [HUSH_TYPE_ID]
+                dashboard.logRedaction(type, token);
+            });
+        }
+    }
+    try {
+        const response = await fetch(targetUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...headers,
+            },
+            body: JSON.stringify(redactedBody),
+            signal: AbortSignal.timeout(30000), // 30s timeout
+        });
+        // Handle Upstream Errors (4xx, 5xx)
+        if (!response.ok) {
+            log.error({ status: response.status, path: req.path }, 'Upstream provider returned an error');
+            const errorData = await response.text();
+            return res.status(response.status).send(errorData);
+        }
+        // Case A: Streaming
+        if (req.body.stream && response.body) {
+            log.info({ path: req.path }, 'Starting stream proxy');
+            res.setHeader('Content-Type', 'text/event-stream');
+            res.setHeader('Cache-Control', 'no-cache');
+            res.setHeader('Connection', 'keep-alive');
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder();
+            // Security: Use stateful rehydrator to handle tokens split across chunks
+            const rehydrateChunk = vault.createStreamingRehydrator();
+            try {
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    const chunk = decoder.decode(value, { stream: true });
+                    const rehydratedChunk = rehydrateChunk(chunk);
+                    if (rehydratedChunk) {
+                        const canWrite = res.write(rehydratedChunk);
+                        // Handle backpressure
+                        if (!canWrite) {
+                            await new Promise((resolve) => res.once('drain', resolve));
+                        }
+                    }
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            res.end();
+            return;
+        }
+        // Case B: Regular JSON
+        const data = await response.json();
+        const rehydratedData = vault.rehydrate(data);
+        res.status(response.status).json(rehydratedData);
+    }
+    catch (error) {
+        log.error({ err: error, path: req.path }, 'Failed to forward request');
+        res.status(500).json({ error: 'Gateway forwarding failed' });
+    }
+}
+/**
+ * Handle Anthropic /messages proxy
+ */
+app.post('/v1/messages', async (req, res) => {
+    const apiKey = req.headers['x-api-key'];
+    if (!apiKey)
+        return res.status(401).json({ error: 'Missing Anthropic API Key' });
+    await proxyRequest(req, res, 'https://api.anthropic.com/v1/messages', {
+        'x-api-key': apiKey,
+        'anthropic-version': req.headers['anthropic-version'] || '2023-06-01',
+    });
+});
+/**
+ * Handle OpenAI /chat/completions proxy
+ */
+app.post('/v1/chat/completions', async (req, res) => {
+    const auth = req.headers['authorization'];
+    if (!auth)
+        return res.status(401).json({ error: 'Missing OpenAI Authorization' });
+    await proxyRequest(req, res, 'https://api.openai.com/v1/chat/completions', {
+        'Authorization': auth,
+    });
+});
+/**
+ * Handle ZhipuAI GLM API proxy (OpenCode + GLM-5)
+ * Supports: /api/paas/v4/chat/completions
+ * Used by OpenCode when configured with baseURL: http://127.0.0.1:4000/api/paas/v4
+ */
+app.post('/api/paas/v4/chat/completions', async (req, res) => {
+    const auth = req.headers['authorization'];
+    if (!auth)
+        return res.status(401).json({ error: 'Missing ZhipuAI Authorization' });
+    await proxyRequest(req, res, 'https://api.z.ai/api/paas/v4/chat/completions', {
+        'Authorization': auth,
+    });
+});
+/**
+ * Handle Google Gemini API proxy
+ * Supports: /v1beta/models/{model}:generateContent
+ */
+app.post('/v1beta/models/:modelAndAction', async (req, res) => {
+    const apiKey = req.headers['x-goog-api-key'] || req.query.key;
+    if (!apiKey)
+        return res.status(401).json({ error: 'Missing Google API Key' });
+    const targetUrl = `https://generativelanguage.googleapis.com/v1beta/models/${req.params.modelAndAction}${req.url.includes('?') ? '?' + req.url.split('?')[1] : ''}`;
+    await proxyRequest(req, res, targetUrl, {
+        'x-goog-api-key': apiKey,
+    });
+});
+// Health check (must be before catch-all)
+app.get('/health', (req, res) => {
+    const response = { status: 'running' };
+    if (process.env.DEBUG === 'true') {
+        response.vaultSize = vault.size;
+    }
+    res.json(response);
+});
+/**
+ * Catch-all Handler: Forward any other requests to Google
+ * This ensures login and metadata calls work correctly.
+ */
+app.all('/*path', async (req, res) => {
+    const targetBase = 'https://generativelanguage.googleapis.com';
+    const targetUrl = `${targetBase}${req.url}`;
+    log.info({ path: req.path, method: req.method }, 'Forwarding unknown endpoint to Google');
+    try {
+        const headers = { ...req.headers };
+        delete headers.host;
+        delete headers.connection;
+        const response = await fetch(targetUrl, {
+            method: req.method,
+            headers,
+            body: ['POST', 'PUT', 'PATCH'].includes(req.method) ? JSON.stringify(req.body) : undefined,
+            signal: AbortSignal.timeout(30000),
+        });
+        const data = await response.text();
+        res.status(response.status).send(data);
+    }
+    catch (error) {
+        log.error({ err: error, path: req.path }, 'Catch-all forwarding failed');
+        res.status(500).json({ error: 'Gateway forwarding failed' });
+    }
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AACvC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;AAChC,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;AAE/B,0EAA0E;AAC1E,IAAI,UAAU,GAAqB,IAAI,CAAC;AACxC,SAAS,YAAY;IACnB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,UAAU,GAAG,IAAI,SAAS,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8DAA8D;AAC9D,YAAY,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AAE7B,0EAA0E;AAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC;AAE1D,uDAAuD;AACvD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAE/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB;AAC/D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAEzC;;GAEG;AACH,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,EAAE,CAAC;IAE1C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/E,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAE7E,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,KAAK,UAAU,IAAI,aAAa,KAAK,UAAU,UAAU,EAAE,CAAC,EAAE,CAAC;YACjG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAqB,EACrB,SAAiB,EACjB,OAA+B;IAE/B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IAEjC,iDAAiD;IACjD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IAEpE,gCAAgC;IAChC,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC3H,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEzB,uBAAuB;QACvB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,mCAAmC;gBAC9E,SAAU,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO;aACX;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,cAAc;SACnD,CAAC,CAAC;QAEH,oCAAoC;QACpC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC9F,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACtD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAE1C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAElC,yEAAyE;YACzE,MAAM,cAAc,GAAG,KAAK,CAAC,yBAAyB,EAAE,CAAC;YAEzD,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAEhB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBAE9C,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;wBAC5C,sBAAsB;wBACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;wBAC7D,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAEjF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,uCAAuC,EAAE;QACpE,WAAW,EAAE,MAAgB;QAC7B,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAW,IAAI,YAAY;KAChF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAElF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,4CAA4C,EAAE;QACzE,eAAe,EAAE,IAAc;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAEnF,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,+CAA+C,EAAE;QAC5E,eAAe,EAAE,IAAc;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAE9E,MAAM,SAAS,GAAG,2DAA2D,GAAG,CAAC,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAEpK,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE;QACtC,gBAAgB,EAAE,MAAgB;KACnC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0CAA0C;AAC1C,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC9B,MAAM,QAAQ,GAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QACjC,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,UAAU,GAAG,2CAA2C,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IAE5C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,uCAAuC,CAAC,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,OAAO,GAAQ,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC;QACpB,OAAO,OAAO,CAAC,UAAU,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YACtC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/lib/dashboard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * hush 🛡️ Dashboard v2 - Terminal Edition
+ * Aligned with the official brand book and dashboard mockup.
+ */
+export declare class Dashboard {
+    private screen;
+    private grid;
+    private log;
+    private piiBreakdown;
+    private vaultGauge;
+    private latencySpark;
+    private statBoxes;
+    private stats;
+    constructor();
+    logRedaction(type: string, token: string): void;
+    logRequest(path: string, durationMs?: number): void;
+    private getTypeColor;
+    private updateUI;
+    private render;
+    /**
+     * Get current dashboard statistics (for testing and programmatic access).
+     */
+    getStats(): {
+        redactedCount: number;
+        requestCount: number;
+        leaks: number;
+        types: Map<string, number>;
+        latency: number[];
+    };
+}
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/lib/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/lib/dashboard.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,IAAI,CAAe;IAG3B,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,UAAU,CAAM;IACxB,OAAO,CAAC,YAAY,CAAM;IAG1B,OAAO,CAAC,SAAS,CAKf;IAGF,OAAO,CAAC,KAAK,CAMX;;IA0EK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAWxC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU;IAStD,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,MAAM;IAId;;OAEG;IACI,QAAQ;;;;;;;CAShB"}