@c6o/czproxy 0.1.0 → 0.1.1

package/README.md

@@ -0,0 +1,188 @@
+# czproxy — Secure Credentials for AI Agents and Developer Tools
+
+A local Rust proxy that transparently injects API credentials into outbound HTTP/HTTPS requests. Your applications and AI agents never hold real secrets — they just make normal HTTP calls through the proxy.
+
+## The Problem
+
+AI agents and developer tools need real credentials to call APIs, databases, and cloud services. Today, most teams pass these as environment variables or `.env` files. Every secret is one log statement, one compromised dependency, or one careless commit away from exposure.
+
+## How czproxy Solves It
+
+czproxy runs locally and intercepts outbound HTTPS traffic. When a request matches a configured route, the proxy injects the real credential — fetched from 1Password at startup. If the app sent an auth header, it gets stripped and replaced. If it didn't, one gets added. The application never sees the real secret.
+
+```
+Your App  ──HTTPS_PROXY──▶  czproxy  ──real credentials──▶  api.stripe.com
+                                     (from 1Password)
+```
+
+No code changes. No SDK wrappers. No secret-fetching boilerplate. Just set two environment variables and your existing HTTP client works. If an SDK requires an API key to initialize, pass any dummy value — czproxy replaces it at the network layer.
+
+## Quick Start
+
+### 1. Install
+
+```bash
+npm install -g @c6o/czproxy
+```
+
+Requires macOS (ARM64/x64) or Linux (x64/ARM64). The npm package wraps a compiled Rust binary — no runtime dependencies.
+
+### 2. Initialize
+
+```bash
+czproxy init
+```
+
+This generates a `proxy.yaml` scaffold and detects your project's runtime (Node.js, Python, Go, etc.) to print the right setup instructions.
+
+### 3. Configure Routes
+
+Edit `proxy.yaml` to map hostnames to 1Password secret references. This file is safe to commit — it contains no secrets.
+
+```yaml
+listen: "127.0.0.1:6790"
+
+tls:
+  enabled: true
+  ca_cert_path: "./ca-cert.pem"
+  ca_key_path: "./ca-key.pem"
+
+routes:
+  - name: stripe
+    match:
+      host: api.stripe.com
+    auth:
+      type: bearer
+      secret:
+        source: 1password
+        vault: Engineering
+        item: Stripe API Key
+        field: secret_key
+
+  - name: openai
+    match:
+      host: api.openai.com
+    auth:
+      type: bearer
+      secret:
+        source: 1password
+        vault: Engineering
+        item: OpenAI API
+        field: credential
+```
+
+### 4. Trust the Proxy CA
+
+```bash
+czproxy trust
+```
+
+This generates a local CA certificate and key (if they don't already exist) and adds the CA to your system trust store (macOS Keychain or Linux ca-certificates).
+
+For Node.js (which doesn't use the system trust store):
+
+```bash
+export NODE_EXTRA_CA_CERTS=./ca-cert.pem
+```
+
+### 5. Run
+
+```bash
+# Start the proxy
+czproxy start
+
+# In another terminal (or use a Procfile):
+HTTPS_PROXY=http://127.0.0.1:6790 npm run dev
+```
+
+Or with a Procfile (foreman/overmind):
+
+```
+proxy: czproxy start
+web: czproxy wait && npm run dev
+```
+
+That's it. Your app makes normal API calls. czproxy intercepts them and injects real credentials from 1Password. The app never sees, stores, or logs a single secret.
+
+## Using with AI Agents
+
+### OpenClaw
+
+```bash
+# Start czproxy, then run your agent
+czproxy start &
+czproxy wait
+HTTPS_PROXY=http://127.0.0.1:6790 openclaw agent start
+```
+
+Your OpenClaw agent calls APIs normally. czproxy handles the real auth transparently — no credentials needed in the agent's environment.
+
+### Claude Code
+
+When `HTTPS_PROXY` is set in your shell, Claude Code inherits it automatically. Run `czproxy trust` to add the CA system-wide, and set `NODE_EXTRA_CA_CERTS` for Node.js-based tools.
+
+For MCP servers:
+
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "npx",
+      "args": ["-y", "@some/mcp-server"],
+      "env": {
+        "NODE_OPTIONS": "--import @c6o/czproxy/register"
+      }
+    }
+  }
+}
+```
+
+## Community Edition
+
+- Local proxy for individual developers
+- 1Password integration
+- Unlimited routes and services
+- macOS and Linux support
+- TLS interception with auto-generated CA
+
+## Enterprise Edition
+
+Need more? Codezero Enterprise adds:
+
+- **Vault integrations**: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault
+- **Identity binding**: OIDC/SSO integration, per-identity credential scoping
+- **Policy enforcement**: OPA-based access policies
+- **Audit logging**: Full trail of who accessed what, when
+- **Remote gateway**: Secrets never reach the developer's machine
+- **Multi-team administration**: Centralized credential governance
+
+## CLI Reference
+
+| Command | Description |
+|---------|-------------|
+| `czproxy start` | Start the proxy (foreground) |
+| `czproxy init` | Generate proxy.yaml scaffold with runtime-specific instructions |
+| `czproxy trust` | Add proxy CA to system trust store |
+| `czproxy untrust` | Remove proxy CA from system trust store |
+| `czproxy wait` | Poll health endpoint until ready (for Procfiles/scripts) |
+| `czproxy launchd` | Generate/install macOS launchd plist |
+| `czproxy systemd` | Generate/install Linux systemd unit |
+
+## Security
+
+czproxy is designed for credential security from the ground up:
+
+- **No telemetry** or phone-home code
+- **Never logs** secret values (secrets are wrapped in a `Secret` type that prints `****` on Debug/Display)
+- **Binds loopback only** (`127.0.0.1`) — refuses to start on `0.0.0.0`
+- Secrets are **zeroed from memory** on drop (via `zeroize`)
+- Runs **entirely locally** (Community edition makes no network calls except to configured upstreams and 1Password CLI)
+- `proxy.yaml` contains **only vault references**, never secret values
+
+Report security issues to security@codezero.io.
+
+## License
+
+Codezero Commercial License. See [LICENSE](https://github.com/c6o/czproxy/blob/main/LICENSE) for details.
+
+Community edition is free for individual developer use. Enterprise edition requires a commercial license.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c6o/czproxy",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "bin": {
     "czproxy": "bin.mjs"
@@ -10,15 +10,16 @@
   },
   "files": [
     "bin.mjs",
-    "register.mjs"
+    "register.mjs",
+    "README.md"
   ],
   "dependencies": {
     "undici": "^7.22.0"
   },
   "optionalDependencies": {
-    "@c6o/czproxy-darwin-arm64": "0.1.0",
-    "@c6o/czproxy-darwin-x64": "0.1.0",
-    "@c6o/czproxy-linux-x64": "0.1.0",
-    "@c6o/czproxy-linux-arm64": "0.1.0"
+    "@c6o/czproxy-darwin-arm64": "0.1.1",
+    "@c6o/czproxy-darwin-x64": "0.1.1",
+    "@c6o/czproxy-linux-x64": "0.1.1",
+    "@c6o/czproxy-linux-arm64": "0.1.1"
   }
 }