agentsecure 0.1.2__tar.gz → 0.1.4__tar.gz

{agentsecure-0.1.2/agentsecure.egg-info → agentsecure-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsecure
-Version: 0.1.2
+Version: 0.1.4
 Summary: Local-first security runtime for AI coding agents
 Home-page: https://github.com/ShellFrameAI/agentsecure-community
 Author: ShellFrame AI
@@ -18,11 +18,10 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Security
 Classifier: Environment :: Console
 Classifier: Operating System :: OS Independent
-Requires-Python: >=3.6
+Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: dataclasses; python_version < "3.7"
 Dynamic: license-file
 
 # AgentSecure Community
@@ -77,12 +76,18 @@ Why:
 
 ## Quickstart In A Project
 
-Create a local config:
+Create a local config and repo guidance file:
 
 ```bash
 agentsecure init
 ```
 
+This creates `agentsecure.json`, local private state under `.agentsecure/`, and `AGENTSECURE.md`. Review the Markdown file before running agents:
+
+```bash
+agentsecure policy validate
+```
+
 Create a fake `.env` for testing:
 
 ```bash
@@ -108,6 +113,52 @@ By default, `--protect-all` virtualizes discovered secrets. The command output s
 
 Denied values are removed only when policy sets `mode: "deny"` for that environment variable. The built-in `agentsecure demo` includes that policy for `DATABASE_URL_PROD` so you can see both behaviors: virtualize and deny.
 
+## Provider Proxy Preview
+
+Virtual secrets keep real values out of the agent context. Provider proxy mode goes one step further for tools and SDKs that honor `OPENAI_BASE_URL`: the agent gets a virtual key and a local base URL, while AgentSecure injects the real key only when forwarding to the configured provider.
+
+Configure OpenAI from `agentsecure.json.provider_catalog.openai`:
+
+```bash
+agentsecure proxy setup openai
+```
+
+Then run the agent:
+
+```bash
+agentsecure run --protect-all -- codex
+```
+
+The agent-visible environment includes:
+
+```text
+OPENAI_API_KEY=virt_openai_...
+OPENAI_BASE_URL=http://127.0.0.1:8765/providers/openai/v1
+```
+
+AgentSecure forwards provider calls to the configured upstream:
+
+```json
+{
+  "provider_proxy": {
+    "providers": {
+      "openai": {
+        "upstream": "https://api.openai.com",
+        "local_path": "/providers/openai"
+      }
+    }
+  }
+}
+```
+
+Run the proxy proof:
+
+```bash
+agentsecure receipts --proxy
+```
+
+Provider proxy mode is local-only. It is not a system-wide proxy, not TLS MITM, and not browser-wide interception. Tools must use the provider base URL environment variable.
+
 ## What It Demonstrates
 
 - Discover likely secrets in `.env` files and environment variables.
@@ -121,7 +172,7 @@ Command-guard mode is a usability guard, not a hard sandbox. A determined proces
 
 ## Example Policy
 
-See [examples/agentsecure.community.json](examples/agentsecure.community.json) and [examples/.env.example](examples/.env.example).
+See [examples/agentsecure.community.json](examples/agentsecure.community.json), [examples/AGENTSECURE.md](examples/AGENTSECURE.md), and [examples/.env.example](examples/.env.example).
 
 Minimal policy shape:
 
@@ -150,6 +201,7 @@ Minimal policy shape:
 
 ```bash
 agentsecure init
+agentsecure policy validate
 agentsecure status
 agentsecure doctor
 agentsecure discover
@@ -157,6 +209,9 @@ agentsecure suggest
 agentsecure env
 agentsecure keys list
 agentsecure network list
+agentsecure proxy setup openai
+agentsecure proxy doctor
+agentsecure receipts --proxy
 ```
 
 Run an agent or command through local command guard:
@@ -221,6 +276,12 @@ python3 scripts/secret_scan.py .
 
 CI runs tests across supported Python versions and runs the local secret scan.
 
+## AGENTSECURE.md
+
+`AGENTSECURE.md` is a small repo-level policy guidance file for humans and AI coding agents. In the community release, AgentSecure creates it and validates that it does not contain raw secrets or unsupported raw-secret passthrough modes.
+
+Supported community secret modes in the Markdown guidance are `virtualize` and `deny`. Do not use `allow` or `allow_real` for secrets. The Markdown file is guidance plus local validation; it is not a full sandbox by itself.
+
 ## Public Release Boundary
 
 This community release does not include hosted backend integration, enterprise policy sync, billing/licensing, production secrets, internal endpoints, or sensitive commercial heuristics. See [OPEN_SOURCE_PLAN.md](OPEN_SOURCE_PLAN.md) and [OPEN_SOURCE_READINESS_REPORT.md](OPEN_SOURCE_READINESS_REPORT.md) for the public/private boundary.

{agentsecure-0.1.2 → agentsecure-0.1.4}/README.md

@@ -50,12 +50,18 @@ Why:
 
 ## Quickstart In A Project
 
-Create a local config:
+Create a local config and repo guidance file:
 
 ```bash
 agentsecure init
 ```
 
+This creates `agentsecure.json`, local private state under `.agentsecure/`, and `AGENTSECURE.md`. Review the Markdown file before running agents:
+
+```bash
+agentsecure policy validate
+```
+
 Create a fake `.env` for testing:
 
 ```bash
@@ -81,6 +87,52 @@ By default, `--protect-all` virtualizes discovered secrets. The command output s
 
 Denied values are removed only when policy sets `mode: "deny"` for that environment variable. The built-in `agentsecure demo` includes that policy for `DATABASE_URL_PROD` so you can see both behaviors: virtualize and deny.
 
+## Provider Proxy Preview
+
+Virtual secrets keep real values out of the agent context. Provider proxy mode goes one step further for tools and SDKs that honor `OPENAI_BASE_URL`: the agent gets a virtual key and a local base URL, while AgentSecure injects the real key only when forwarding to the configured provider.
+
+Configure OpenAI from `agentsecure.json.provider_catalog.openai`:
+
+```bash
+agentsecure proxy setup openai
+```
+
+Then run the agent:
+
+```bash
+agentsecure run --protect-all -- codex
+```
+
+The agent-visible environment includes:
+
+```text
+OPENAI_API_KEY=virt_openai_...
+OPENAI_BASE_URL=http://127.0.0.1:8765/providers/openai/v1
+```
+
+AgentSecure forwards provider calls to the configured upstream:
+
+```json
+{
+  "provider_proxy": {
+    "providers": {
+      "openai": {
+        "upstream": "https://api.openai.com",
+        "local_path": "/providers/openai"
+      }
+    }
+  }
+}
+```
+
+Run the proxy proof:
+
+```bash
+agentsecure receipts --proxy
+```
+
+Provider proxy mode is local-only. It is not a system-wide proxy, not TLS MITM, and not browser-wide interception. Tools must use the provider base URL environment variable.
+
 ## What It Demonstrates
 
 - Discover likely secrets in `.env` files and environment variables.
@@ -94,7 +146,7 @@ Command-guard mode is a usability guard, not a hard sandbox. A determined proces
 
 ## Example Policy
 
-See [examples/agentsecure.community.json](examples/agentsecure.community.json) and [examples/.env.example](examples/.env.example).
+See [examples/agentsecure.community.json](examples/agentsecure.community.json), [examples/AGENTSECURE.md](examples/AGENTSECURE.md), and [examples/.env.example](examples/.env.example).
 
 Minimal policy shape:
 
@@ -123,6 +175,7 @@ Minimal policy shape:
 
 ```bash
 agentsecure init
+agentsecure policy validate
 agentsecure status
 agentsecure doctor
 agentsecure discover
@@ -130,6 +183,9 @@ agentsecure suggest
 agentsecure env
 agentsecure keys list
 agentsecure network list
+agentsecure proxy setup openai
+agentsecure proxy doctor
+agentsecure receipts --proxy
 ```
 
 Run an agent or command through local command guard:
@@ -194,6 +250,12 @@ python3 scripts/secret_scan.py .
 
 CI runs tests across supported Python versions and runs the local secret scan.
 
+## AGENTSECURE.md
+
+`AGENTSECURE.md` is a small repo-level policy guidance file for humans and AI coding agents. In the community release, AgentSecure creates it and validates that it does not contain raw secrets or unsupported raw-secret passthrough modes.
+
+Supported community secret modes in the Markdown guidance are `virtualize` and `deny`. Do not use `allow` or `allow_real` for secrets. The Markdown file is guidance plus local validation; it is not a full sandbox by itself.
+
 ## Public Release Boundary
 
 This community release does not include hosted backend integration, enterprise policy sync, billing/licensing, production secrets, internal endpoints, or sensitive commercial heuristics. See [OPEN_SOURCE_PLAN.md](OPEN_SOURCE_PLAN.md) and [OPEN_SOURCE_READINESS_REPORT.md](OPEN_SOURCE_READINESS_REPORT.md) for the public/private boundary.

{agentsecure-0.1.2 → agentsecure-0.1.4}/agentsecure/__init__.py

@@ -1,4 +1,3 @@
 """AgentSecure local-first security runtime."""
 
-__version__ = "0.1.0"
-
+__version__ = "0.1.4"

{agentsecure-0.1.2 → agentsecure-0.1.4}/agentsecure/cli/main.py

@@ -14,6 +14,7 @@ import time
 from typing import Any, Dict, List, Optional
 from urllib.request import Request, urlopen
 
+from agentsecure import __version__
 from agentsecure.cloud import CloudError, CloudRuntimeService
 from agentsecure.api.server import LocalApiServer
 from agentsecure.api.services import ApiServices
@@ -32,6 +33,8 @@ from agentsecure.cli.project import (
     show_status,
     uninstall_agentsecure,
 )
+from agentsecure.cli.proxy import add_proxy_subparser, handle_proxy
+from agentsecure.cli.receipts import handle_receipts
 from agentsecure.cli.secrets import (
     discover_secrets,
     handle_keys,
@@ -47,6 +50,7 @@ from agentsecure.cli.settings import (
     handle_setup,
 )
 from agentsecure.client.wrappers import AgentWrapperInstaller, SUPPORTED_AGENTS
+from agentsecure.core.agentsecure_md import AGENTSECURE_MD, agentsecure_md_status
 from agentsecure.core.command_metadata import safe_command_metadata
 from agentsecure.core.config import ConfigError, JsonConfigLoader, JsonConfigWriter
 from agentsecure.core.config_profiles import (
@@ -57,6 +61,7 @@ from agentsecure.core.capabilities import broker_url_for_env
 from agentsecure.core.container import Container
 from agentsecure.core.key_service import KeyManagementError, KeyManagementService
 from agentsecure.core.models import AgentSecureConfig, DiscoveredSecret, ProcessRequest, SecretReplacement
+from agentsecure.core.provider_proxy import configured_provider_base_url, provider_base_local_path
 from agentsecure.core.product import ProductService
 from agentsecure.core.time import DurationError
 from agentsecure.daemon.commands import CommandExecutor, CommandPoller
@@ -116,6 +121,10 @@ def main(argv: Optional[List[str]] = None) -> int:
         return handle_files(args)
     if args.command == "network":
         return handle_network(args)
+    if args.command == "proxy":
+        return handle_proxy(args)
+    if args.command == "receipts":
+        return handle_receipts(args)
     if args.command == "policy":
         return handle_policy(args)
     if args.command == "setup":
@@ -138,6 +147,7 @@ def main(argv: Optional[List[str]] = None) -> int:
 
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="agentsecure")
+    parser.add_argument("--version", action="version", version="agentsecure %s" % __version__)
     parser.add_argument(
         "--config",
         default="agentsecure.json",
@@ -225,6 +235,9 @@ def build_parser() -> argparse.ArgumentParser:
     network_remove_parser = network_subparsers.add_parser("remove", help="Remove domains from credential allowlist")
     network_remove_parser.add_argument("domains", nargs="+")
 
+    add_proxy_subparser(subparsers)
+    receipts_parser = subparsers.add_parser("receipts", help="Run replayable AgentSecure proof receipts")
+    receipts_parser.add_argument("--proxy", action="store_true", help="Run provider proxy receipts")
     add_policy_subparser(subparsers)
 
     setup_parser = subparsers.add_parser("setup", help="Install local protected agent command wrappers")
@@ -254,6 +267,10 @@ def build_parser() -> argparse.ArgumentParser:
 
 
 def run_agent(args: argparse.Namespace) -> int:
+    policy_doc = agentsecure_md_status(AGENTSECURE_MD)
+    if policy_doc.get("exists"):
+        state = "valid" if policy_doc.get("ok") else "needs review"
+        print("AgentSecure policy guidance: %s (%s)" % (AGENTSECURE_MD, state), flush=True)
     cloud = CloudRuntimeService() if _cloud_features_enabled() else None
     if cloud:
         _apply_cloud_runtime_defaults(args, cloud)
@@ -266,6 +283,7 @@ def run_agent(args: argparse.Namespace) -> int:
         if isinstance(replacements, int):
             return replacements
     container = Container.from_config_path(args.config)
+    replacements.extend(_configured_secret_replacements(container, replacements))
     run_cwd = os.getcwd()
     workspace_session = None
     materializer = WorkspaceMaterializer(_workspace_base_for_runtime(run_cwd, args.runtime))
@@ -346,6 +364,7 @@ def run_agent(args: argparse.Namespace) -> int:
     env = os.environ.copy()
     for env_name in container.config.env_policy.rules:
         env.pop(env_name, None)
+    _strip_backing_secret_environment(env, container)
     env.update(container.virtual_env_provider.build_environment())
     if args.runtime == "command-guard":
         CommandGuardWrapperInstaller(args.config).install(env)
@@ -354,6 +373,7 @@ def run_agent(args: argparse.Namespace) -> int:
         env["AGENTSECURE_SESSION_ID"] = session_id
     proxy_url = _proxy_url(gateway_host, gateway_port, session_id)
     _apply_proxy_environment(env, proxy_url)
+    _apply_provider_proxy_environment(env, container, gateway_host, gateway_port)
     command_metadata = safe_command_metadata(argv)
     container.audit_logger.record(
         "agent_started",
@@ -625,6 +645,7 @@ def _start_local_gateway_thread(container: Container, host: str, port: int):
         container.token_resolver,
         container.audit_logger,
         container.bindings,
+        container.config.provider_proxy,
     )
 
     def run_gateway_thread() -> None:
@@ -809,6 +830,59 @@ def _apply_proxy_environment(env, proxy_url: str) -> None:
     env["no_proxy"] = no_proxy
 
 
+def _apply_provider_proxy_environment(env, container: Container, gateway_host: str, gateway_port: int) -> None:
+    if not container.config.provider_proxy.enabled:
+        return
+    raw = dict(container.config.raw)
+    gateway = dict(raw.get("gateway", {}))
+    gateway["host"] = gateway_host
+    gateway["port"] = gateway_port
+    raw["gateway"] = gateway
+    for provider in container.config.provider_proxy.providers.values():
+        provider_data = {
+            "local_path": provider_base_local_path(provider.local_path, provider.allow_paths),
+        }
+        env[provider.base_url_env] = configured_provider_base_url(raw, provider_data)
+
+
+def _strip_backing_secret_environment(env, container: Container) -> None:
+    for binding in container.config.secrets:
+        if binding.real_secret_env:
+            env.pop(binding.real_secret_env, None)
+
+
+def _configured_secret_replacements(container: Container, existing: List[SecretReplacement]) -> List[SecretReplacement]:
+    existing_names = set(replacement.name for replacement in existing)
+    replacements = []
+    for binding in container.config.secrets:
+        if binding.env_name in existing_names:
+            continue
+        real_value = container.token_resolver.resolve(binding.virtual_token) or ""
+        if not real_value:
+            continue
+        rule = container.config.env_policy.rule_for(binding.env_name)
+        if rule.mode == "deny":
+            replacements.append(
+                SecretReplacement(
+                    source="configured",
+                    name=binding.env_name,
+                    real_value=real_value,
+                    virtual_value="",
+                    action="remove",
+                )
+            )
+        elif rule.mode != "broker":
+            replacements.append(
+                SecretReplacement(
+                    source="configured",
+                    name=binding.env_name,
+                    real_value=real_value,
+                    virtual_value=binding.virtual_token,
+                )
+            )
+    return replacements
+
+
 def _merge_no_proxy(existing: str) -> str:
     defaults = [
         "localhost",
@@ -825,6 +899,8 @@ def _merge_no_proxy(existing: str) -> str:
         if not value:
             continue
         key = value.lower()
+        if key == "*":
+            continue
         if key not in seen:
             values.append(value)
             seen.add(key)

{agentsecure-0.1.2 → agentsecure-0.1.4}/agentsecure/cli/policy.py

@@ -2,6 +2,7 @@ import argparse
 import json
 import sys
 
+from agentsecure.core.agentsecure_md import AGENTSECURE_MD, validate_agentsecure_md
 from agentsecure.core.config import ConfigError
 from agentsecure.core.policy_mutation import LocalPolicyMutationService
 
@@ -14,11 +15,17 @@ def add_policy_subparser(subparsers) -> None:
     policy_preview_parser.add_argument("--json-file", help="Read mutation JSON from this file instead of stdin")
     policy_apply_parser = policy_subparsers.add_parser("apply-local", help="Apply local policy changes from JSON")
     policy_apply_parser.add_argument("--json-file", help="Read mutation JSON from this file instead of stdin")
+    validate_parser = policy_subparsers.add_parser("validate", help="Validate AGENTSECURE.md policy guidance")
+    validate_parser.add_argument("--file", default=AGENTSECURE_MD, help="AGENTSECURE.md path")
 
 
 def handle_policy(args: argparse.Namespace) -> int:
-    service = LocalPolicyMutationService(args.config)
     try:
+        if args.policy_command == "validate":
+            payload = validate_agentsecure_md(args.file)
+            print(json.dumps(payload, indent=2, sort_keys=True))
+            return 0 if payload["ok"] else 1
+        service = LocalPolicyMutationService(args.config)
         if args.policy_command == "review":
             payload = service.review()
         elif args.policy_command == "preview":

{agentsecure-0.1.2 → agentsecure-0.1.4}/agentsecure/cli/project.py

@@ -4,6 +4,7 @@ import os
 import shutil
 
 from agentsecure.cli.common import scanner
+from agentsecure.core.agentsecure_md import AGENTSECURE_MD
 from agentsecure.core.product import ProductService
 from agentsecure.workspace.materializer import make_tree_writable
 
@@ -32,6 +33,14 @@ def show_status(args: argparse.Namespace) -> int:
         return 0
     print("AgentSecure status")
     print("Config: %s (%s)" % (result["config_path"], "found" if result["config_exists"] else "missing"))
+    agentsecure_md = result.get("agentsecure_md", {})
+    print(
+        "AGENTSECURE.md: %s (%s)"
+        % (
+            agentsecure_md.get("path", AGENTSECURE_MD),
+            "valid" if agentsecure_md.get("exists") and agentsecure_md.get("ok") else "missing" if not agentsecure_md.get("exists") else "needs review",
+        )
+    )
     print("Configured secrets: %s" % result["configured_secrets"])
     print("Discovered secrets: %s" % result["discovered_secrets"])
     grants = result["grants"]