pentect 0.0.26 → 0.0.28

package/README.md

@@ -1,173 +1,36 @@
-# Pentect
+<p align="center">
+  <a href="https://pentect.dev/">
+    <img src="website/public/pentect-logo-transparent.png" width="96" alt="Pentect">
+  </a>
+</p>
 
-Pentect is a local security boundary for AI coding tools. It replaces secrets
-and sensitive data with opaque handles before requests reach a model provider,
-then resolves those handles only at trusted client tool boundaries.
+<h1 align="center">Pentect</h1>
 
-Pentect currently supports Codex CLI, Claude Code, OpenCode, Pi, Codex App, and
-Claude Desktop. It also provides standalone masking commands and sandboxed
-WebAssembly plugins.
+<p align="center">AI can use your secrets without ever seeing them.</p>
 
-> Pentect is pre-1.0 security software. Unknown provider formats are blocked by
-> default, but no filter can promise perfect detection. Keep provider and tool
-> permissions narrow and review the documented limitations before production
-> use.
+<p align="center">
+  <a href="https://pentect.dev/">Documentation</a> ·
+  <a href="https://pentect.dev/start/install/">Install</a> ·
+  <a href="https://pentect.dev/start/quick-start/">Quick start</a>
+</p>
 
-## Install
+<p align="center">
+  <a href="https://github.com/EdamAme-x/pentect/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/EdamAme-x/pentect/ci.yml?branch=main&label=CI" alt="CI"></a>
+  <a href="https://github.com/EdamAme-x/pentect/releases/latest"><img src="https://img.shields.io/github/v/release/EdamAme-x/pentect" alt="Latest release"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/github/license/EdamAme-x/pentect" alt="MIT License"></a>
+</p>
 
-Windows PowerShell:
+Pentect is a local security boundary between supported AI clients and their
+providers. Start with the [documentation](https://pentect.dev/).
 
-```powershell
-irm https://pentect.dev/install | iex
-```
+## Repository guides
 
-Linux and macOS:
+- [Compatibility](COMPATIBILITY.md)
+- [Plugins](PLUGINS.md)
+- [Security](SECURITY.md)
+- [Contributing](CONTRIBUTING.md)
+- [Third-party notices](THIRD_PARTY_LICENSES.txt)
 
-```sh
-curl -fsSL https://pentect.dev/install.sh | sh
-```
+## License
 
-The installers detect the platform, download a GitHub Release asset, and verify
-its SHA-256 checksum. Run `pentect doctor` after installation. Version-specific
-installation is supported with `-Version X.Y.Z` in PowerShell or
-`--version X.Y.Z` for `install.sh`.
-
-Package managers are also supported:
-
-```sh
-# Homebrew (macOS or Linux)
-brew install EdamAme-x/pentect/pentect
-
-# Nix
-nix profile install github:EdamAme-x/pentect
-
-# Nix, temporary shell
-nix shell github:EdamAme-x/pentect
-
-# Nix, pinned to a Pentect release
-nix profile install github:EdamAme-x/pentect/nix-vX.Y.Z
-
-# npm (downloads a checksummed release binary)
-npm install --global pentect
-
-# Cargo (builds from source)
-cargo install --git https://github.com/EdamAme-x/pentect --locked pentect-cli
-```
-
-Debian and Ubuntu users can configure the signed Pentect repository and install
-the package with one command:
-
-```sh
-curl -fsSL https://pentect.dev/install-apt.sh | sudo sh
-```
-
-When installed by Homebrew, Nix, or apt, use that package manager to update or
-remove Pentect. The CLI detects managed installations and will not overwrite
-package-owned files.
-
-## Use
-
-Launch a supported CLI through Pentect:
-
-```text
-pentect codex
-pentect claude
-pentect opencode --model openai/gpt-5
-pentect pi --model openai/gpt-5
-```
-
-Use a Responses- or Messages-compatible gateway without changing permanent
-client configuration:
-
-```text
-pentect codex --upstream http://127.0.0.1:8080/openai/v1
-pentect claude --upstream http://127.0.0.1:8080/anthropic
-pentect opencode --model anthropic/claude-sonnet --upstream http://127.0.0.1:8080/openai/v1
-pentect pi --model anthropic/claude-sonnet --upstream http://127.0.0.1:8080/openai/v1
-```
-
-Launch a desktop app only when explicitly requested:
-
-```text
-pentect codex app
-pentect claude app
-```
-
-These commands protect Codex mode and supported Claude Desktop Chat, Code, and
-attachment traffic; they do not claim coverage for every Chat, Work, Cowork,
-Voice, or future opaque route.
-
-Mask text from stdin while preserving opaque handles:
-
-```sh
-cat .env | pentect mask
-cat terraform.tfvars | pentect mask
-```
-
-PowerShell:
-
-```powershell
-Get-Content .env -Raw | pentect mask
-```
-
-Common maintenance commands:
-
-```text
-pentect doctor [--json | --fix [--yes]]
-pentect update [VERSION] [--check | --force]
-pentect uninstall
-pentect log [--json]
-```
-
-## What is protected
-
-- Prompts and local tool results sent through supported model gateways
-- Completed model tool-call arguments, resolved only for the local client tool
-- dotenv, Terraform, Kubernetes, kubeconfig, AWS, npm, PyPI, JSON, and other
-  recognized structured configuration
-- Inline images and documents that Pentect can inspect safely
-- Supported UTF-8 Files API uploads
-
-Binary uploads that Pentect cannot inspect or safely rewrite are blocked. File
-IDs and remote URLs are accepted only when Pentect can establish safe coverage;
-otherwise the configured unscanned-content policy applies.
-
-Unknown provider endpoints, content blocks, and malformed provider JSON are
-blocked by default. A user may explicitly select compatibility mode in the
-global configuration, but project configuration cannot weaken this policy.
-
-See [compatibility](COMPATIBILITY.md) for the release-tested client matrix.
-
-## Plugins
-
-Plugins are either declarative regex rules or portable WebAssembly middleware.
-Wasm plugins run without WASI, filesystem, environment, process, or raw socket
-access. Network destinations and payload-changing permissions require explicit
-approval.
-
-```text
-pentect plugins new NAME
-pentect plugins dev PATH
-pentect plugins publish PATH
-pentect plugins add github:@owner/repository/path
-pentect plugins list
-pentect plugins inspect NAME
-pentect plugins test NAME
-pentect plugins update NAME
-```
-
-See [PLUGINS.md](PLUGINS.md) for plugin authoring and security details.
-The Rust SDK is published as
-[`pentect-plugin`](https://crates.io/crates/pentect-plugin).
-The first-party catalog includes a one-file regex example and an optional
-[OpenAI Privacy Filter adapter](https://pentect.dev/plugins/official/).
-
-## Security and development
-
-Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
-Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md).
-
-Pentect is licensed under the [MIT License](LICENSE).
-Third-party notices, including the bundled OCR model attribution, are available
-in [`THIRD_PARTY_LICENSES.txt`](THIRD_PARTY_LICENSES.txt) and are attached to
-each GitHub Release.
+[MIT](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pentect",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "type": "module",
   "description": "Local secret masking boundary for AI agents",
   "license": "MIT",