agentsecure 0.1.6__tar.gz → 0.1.7__tar.gz

{agentsecure-0.1.6/agentsecure.egg-info → agentsecure-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsecure
-Version: 0.1.6
+Version: 0.1.7
 Summary: Local-first security runtime for AI coding agents
 Home-page: https://github.com/ShellFrameAI/agentsecure-community
 Author: ShellFrame AI
@@ -34,7 +34,7 @@ Dynamic: license-file
 
 AI coding agents run where developer secrets already live: `.env` files, shell environments, MCP configs, local credentials, and project settings. GitGuardian's 2026 State of Secrets Sprawl report found [28.65 million new hardcoded secrets in public GitHub commits in 2025](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/) and [24,008 unique secrets in MCP-related configuration files, including 2,117 valid credentials](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/). Reported testing has also shown agent tools reading `.env` files despite ignore-file expectations; [The Register reproduced Claude Code reading `.env` with `.claudeignore` and `.gitignore` entries present](https://www.theregister.com/2026/01/28/claude_code_ai_secrets_files/), while [Anthropic's current docs recommend explicit file-access deny rules for sensitive files](https://code.claude.com/docs/en/configuration).
 
-AgentSecure Community is a local-first CLI for AI coding-agent workflows. It demonstrates a simple idea: ignore files are not a secret boundary, so the agent should see virtual or masked secrets instead of raw `.env` values.
+AgentSecure Community is a local-first CLI for AI coding-agent workflows. It demonstrates a simple idea: ignore files are not a secret boundary, so real secrets should live in AgentSecure's local vault, projects should reference aliases, and the agent should receive temporary virtual tokens instead of raw `.env` values.
 
 The community release is intentionally scoped to local CLI, local command guard, basic policy config, local secret virtualization, and tests. Hosted cloud sync, enterprise policy management, billing/licensing, and sensitive commercial detection logic are not part of this release.
 
@@ -72,6 +72,31 @@ Then run your agent:
 python3 -m agentsecure run claude
 ```
 
+## Where Secrets Go
+
+Keep real secrets in one local AgentSecure vault:
+
+```bash
+printf '%s' "$DATABASE_URL" | agentsecure secrets add dev_db \
+  --env-name DATABASE_URL \
+  --provider database \
+  --approved-host db.example.com \
+  --real-secret-stdin
+
+agentsecure secrets use dev_db
+agentsecure run -- claude
+```
+
+What this does:
+
+- The real value is stored locally under `~/.agentsecure/vault/`.
+- `agentsecure.json` stores only alias metadata such as `dev_db`, `DATABASE_URL`, provider, and approved hosts.
+- At run time, AgentSecure creates a short-lived fake token such as `virt_database_...`.
+- The gateway swaps that fake token for the real secret only for the approved host.
+- The fake token is revoked after the run.
+
+Do not put real secrets in project `.env` files. Use `.env` for non-secret config or fake placeholders that are safe for an agent to read.
+
 ## What The Demo Shows
 
 The built-in demo creates a temporary local project with fake secrets, applies a small sample policy, simulates a command reading `.env`, and prints what the agent would see:
@@ -105,12 +130,12 @@ This creates `agentsecure.json`, local private state under `.agentsecure/`, and
 agentsecure policy validate
 ```
 
-Create a fake `.env` for testing:
+Create a fake `.env` for testing. This file must not contain real credentials:
 
 ```bash
 cat > .env <<'EOF'
-OPENAI_API_KEY=sk-demo-local-secret-do-not-use
-DATABASE_URL_PROD=postgres://demo:demo-password@example.invalid/app
+OPENAI_API_KEY=fake-openai-key-for-demo-only
+DATABASE_URL_PROD=postgres://fake:fake-password@example.invalid/app
 EOF
 ```
 
@@ -120,13 +145,25 @@ Discover likely secrets:
 agentsecure discover
 ```
 
+For real credentials, use the vault/alias flow:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | agentsecure secrets add openai_dev \
+  --env-name OPENAI_API_KEY \
+  --provider openai \
+  --approved-host api.openai.com \
+  --real-secret-stdin
+
+agentsecure secrets use openai_dev
+```
+
 Run a command through the local guard:
 
 ```bash
 agentsecure run --protect-all -- python3 -c 'import subprocess; print(subprocess.check_output(["cat", ".env"]).decode())'
 ```
 
-By default, `--protect-all` virtualizes discovered secrets. The command output should contain `virt_...` tokens instead of the real values. The real `.env` remains local and unchanged.
+By default, `--protect-all` virtualizes discovered values. Prefer the `agentsecure secrets add/use` flow above for real secrets because it keeps real values out of project files entirely. The command output should contain `virt_...` tokens instead of real values. The real `.env`, if you still have one, remains local and unchanged.
 
 Denied values are removed only when policy sets `mode: "deny"` for that environment variable. The built-in `agentsecure demo` includes that policy for `DATABASE_URL_PROD` so you can see both behaviors: virtualize and deny.
 
@@ -179,7 +216,8 @@ Provider proxy mode is local-only. It is not a system-wide proxy, not TLS MITM,
 ## What It Demonstrates
 
 - Discover likely secrets in `.env` files and environment variables.
-- Store real values locally under `.agentsecure/`.
+- Store reusable real secrets locally under `~/.agentsecure/vault/`.
+- Store project assignments as alias metadata in `agentsecure.json`.
 - Expose virtual values such as `OPENAI_API_KEY=virt_openai_...`.
 - Sanitize common `.env` reads through command-guard mode.
 - Remove denied env values from agent-visible output.
@@ -195,6 +233,15 @@ Minimal policy shape:
 
 ```json
 {
+  "secret_aliases": [
+    {
+      "alias_id": "openai_dev",
+      "env_name": "OPENAI_API_KEY",
+      "provider": "openai",
+      "approved_hosts": ["api.openai.com"],
+      "mode": "virtualize"
+    }
+  ],
   "env_policy": {
     "OPENAI_API_KEY": {
       "mode": "virtualize",
@@ -224,6 +271,9 @@ agentsecure doctor
 agentsecure discover
 agentsecure suggest
 agentsecure env
+agentsecure secrets add dev_db --env-name DATABASE_URL --provider database --approved-host db.example.com --real-secret-stdin
+agentsecure secrets use dev_db
+agentsecure secrets list
 agentsecure keys list
 agentsecure network list
 agentsecure proxy setup openai

{agentsecure-0.1.6 → agentsecure-0.1.7}/README.md

@@ -8,7 +8,7 @@
 
 AI coding agents run where developer secrets already live: `.env` files, shell environments, MCP configs, local credentials, and project settings. GitGuardian's 2026 State of Secrets Sprawl report found [28.65 million new hardcoded secrets in public GitHub commits in 2025](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/) and [24,008 unique secrets in MCP-related configuration files, including 2,117 valid credentials](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/). Reported testing has also shown agent tools reading `.env` files despite ignore-file expectations; [The Register reproduced Claude Code reading `.env` with `.claudeignore` and `.gitignore` entries present](https://www.theregister.com/2026/01/28/claude_code_ai_secrets_files/), while [Anthropic's current docs recommend explicit file-access deny rules for sensitive files](https://code.claude.com/docs/en/configuration).
 
-AgentSecure Community is a local-first CLI for AI coding-agent workflows. It demonstrates a simple idea: ignore files are not a secret boundary, so the agent should see virtual or masked secrets instead of raw `.env` values.
+AgentSecure Community is a local-first CLI for AI coding-agent workflows. It demonstrates a simple idea: ignore files are not a secret boundary, so real secrets should live in AgentSecure's local vault, projects should reference aliases, and the agent should receive temporary virtual tokens instead of raw `.env` values.
 
 The community release is intentionally scoped to local CLI, local command guard, basic policy config, local secret virtualization, and tests. Hosted cloud sync, enterprise policy management, billing/licensing, and sensitive commercial detection logic are not part of this release.
 
@@ -46,6 +46,31 @@ Then run your agent:
 python3 -m agentsecure run claude
 ```
 
+## Where Secrets Go
+
+Keep real secrets in one local AgentSecure vault:
+
+```bash
+printf '%s' "$DATABASE_URL" | agentsecure secrets add dev_db \
+  --env-name DATABASE_URL \
+  --provider database \
+  --approved-host db.example.com \
+  --real-secret-stdin
+
+agentsecure secrets use dev_db
+agentsecure run -- claude
+```
+
+What this does:
+
+- The real value is stored locally under `~/.agentsecure/vault/`.
+- `agentsecure.json` stores only alias metadata such as `dev_db`, `DATABASE_URL`, provider, and approved hosts.
+- At run time, AgentSecure creates a short-lived fake token such as `virt_database_...`.
+- The gateway swaps that fake token for the real secret only for the approved host.
+- The fake token is revoked after the run.
+
+Do not put real secrets in project `.env` files. Use `.env` for non-secret config or fake placeholders that are safe for an agent to read.
+
 ## What The Demo Shows
 
 The built-in demo creates a temporary local project with fake secrets, applies a small sample policy, simulates a command reading `.env`, and prints what the agent would see:
@@ -79,12 +104,12 @@ This creates `agentsecure.json`, local private state under `.agentsecure/`, and
 agentsecure policy validate
 ```
 
-Create a fake `.env` for testing:
+Create a fake `.env` for testing. This file must not contain real credentials:
 
 ```bash
 cat > .env <<'EOF'
-OPENAI_API_KEY=sk-demo-local-secret-do-not-use
-DATABASE_URL_PROD=postgres://demo:demo-password@example.invalid/app
+OPENAI_API_KEY=fake-openai-key-for-demo-only
+DATABASE_URL_PROD=postgres://fake:fake-password@example.invalid/app
 EOF
 ```
 
@@ -94,13 +119,25 @@ Discover likely secrets:
 agentsecure discover
 ```
 
+For real credentials, use the vault/alias flow:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | agentsecure secrets add openai_dev \
+  --env-name OPENAI_API_KEY \
+  --provider openai \
+  --approved-host api.openai.com \
+  --real-secret-stdin
+
+agentsecure secrets use openai_dev
+```
+
 Run a command through the local guard:
 
 ```bash
 agentsecure run --protect-all -- python3 -c 'import subprocess; print(subprocess.check_output(["cat", ".env"]).decode())'
 ```
 
-By default, `--protect-all` virtualizes discovered secrets. The command output should contain `virt_...` tokens instead of the real values. The real `.env` remains local and unchanged.
+By default, `--protect-all` virtualizes discovered values. Prefer the `agentsecure secrets add/use` flow above for real secrets because it keeps real values out of project files entirely. The command output should contain `virt_...` tokens instead of real values. The real `.env`, if you still have one, remains local and unchanged.
 
 Denied values are removed only when policy sets `mode: "deny"` for that environment variable. The built-in `agentsecure demo` includes that policy for `DATABASE_URL_PROD` so you can see both behaviors: virtualize and deny.
 
@@ -153,7 +190,8 @@ Provider proxy mode is local-only. It is not a system-wide proxy, not TLS MITM,
 ## What It Demonstrates
 
 - Discover likely secrets in `.env` files and environment variables.
-- Store real values locally under `.agentsecure/`.
+- Store reusable real secrets locally under `~/.agentsecure/vault/`.
+- Store project assignments as alias metadata in `agentsecure.json`.
 - Expose virtual values such as `OPENAI_API_KEY=virt_openai_...`.
 - Sanitize common `.env` reads through command-guard mode.
 - Remove denied env values from agent-visible output.
@@ -169,6 +207,15 @@ Minimal policy shape:
 
 ```json
 {
+  "secret_aliases": [
+    {
+      "alias_id": "openai_dev",
+      "env_name": "OPENAI_API_KEY",
+      "provider": "openai",
+      "approved_hosts": ["api.openai.com"],
+      "mode": "virtualize"
+    }
+  ],
   "env_policy": {
     "OPENAI_API_KEY": {
       "mode": "virtualize",
@@ -198,6 +245,9 @@ agentsecure doctor
 agentsecure discover
 agentsecure suggest
 agentsecure env
+agentsecure secrets add dev_db --env-name DATABASE_URL --provider database --approved-host db.example.com --real-secret-stdin
+agentsecure secrets use dev_db
+agentsecure secrets list
 agentsecure keys list
 agentsecure network list
 agentsecure proxy setup openai

{agentsecure-0.1.6 → agentsecure-0.1.7}/agentsecure/__init__.py

@@ -1,3 +1,3 @@
 """AgentSecure local-first security runtime."""
 
-__version__ = "0.1.6"
+__version__ = "0.1.7"