agentsecure 0.1.7__tar.gz → 0.1.8__tar.gz

{agentsecure-0.1.7/agentsecure.egg-info → agentsecure-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsecure
-Version: 0.1.7
+Version: 0.1.8
 Summary: Local-first security runtime for AI coding agents
 Home-page: https://github.com/ShellFrameAI/agentsecure-community
 Author: ShellFrame AI
@@ -76,6 +76,17 @@ python3 -m agentsecure run claude
 
 Keep real secrets in one local AgentSecure vault:
 
+```bash
+agentsecure secrets import .env
+agentsecure run -- claude
+```
+
+`secrets import` is the easiest migration path. It scans the dotenv file, stores discovered real secret values in the local vault, assigns those aliases to the current project, writes a private backup under `~/.agentsecure/backups/`, and replaces the values in `.env` with non-secret `AGENTSECURE_ALIAS_...` placeholders.
+
+Use `--dry-run` to preview the import, or `--keep-file` if you want to store aliases without rewriting `.env`.
+
+For manual control, add one alias at a time:
+
 ```bash
 printf '%s' "$DATABASE_URL" | agentsecure secrets add dev_db \
   --env-name DATABASE_URL \

{agentsecure-0.1.7 → agentsecure-0.1.8}/README.md

@@ -50,6 +50,17 @@ python3 -m agentsecure run claude
 
 Keep real secrets in one local AgentSecure vault:
 
+```bash
+agentsecure secrets import .env
+agentsecure run -- claude
+```
+
+`secrets import` is the easiest migration path. It scans the dotenv file, stores discovered real secret values in the local vault, assigns those aliases to the current project, writes a private backup under `~/.agentsecure/backups/`, and replaces the values in `.env` with non-secret `AGENTSECURE_ALIAS_...` placeholders.
+
+Use `--dry-run` to preview the import, or `--keep-file` if you want to store aliases without rewriting `.env`.
+
+For manual control, add one alias at a time:
+
 ```bash
 printf '%s' "$DATABASE_URL" | agentsecure secrets add dev_db \
   --env-name DATABASE_URL \

{agentsecure-0.1.7 → agentsecure-0.1.8}/agentsecure/__init__.py

@@ -1,3 +1,3 @@
 """AgentSecure local-first security runtime."""
 
-__version__ = "0.1.7"
+__version__ = "0.1.8"

{agentsecure-0.1.7 → agentsecure-0.1.8}/agentsecure/cli/main.py

@@ -5,6 +5,7 @@ import ipaddress
 import json
 import os
 import queue
+import re
 import shutil
 import socket
 import subprocess
@@ -14,6 +15,7 @@ import threading
 import time
 import uuid
 from typing import Any, Dict, List, Optional
+from urllib.parse import urlsplit
 from urllib.request import Request, urlopen
 
 from agentsecure import __version__
@@ -256,6 +258,13 @@ def build_parser() -> argparse.ArgumentParser:
     use_secret_parser = secrets_subparsers.add_parser("use", help="Assign aliases to this project")
     use_secret_parser.add_argument("alias_ids", nargs="+")
     use_secret_parser.add_argument("--project", default="", help="Project name for audit metadata")
+    import_secret_parser = secrets_subparsers.add_parser("import", help="Move secrets from a dotenv file into the local vault")
+    import_secret_parser.add_argument("path", nargs="?", default=".env", help="Dotenv file to import, default .env")
+    import_secret_parser.add_argument("--project", default="", help="Project name for audit metadata")
+    import_secret_parser.add_argument("--approved-host", action="append", default=[], help="Additional host allowed to receive imported secrets")
+    import_secret_parser.add_argument("--keep-file", action="store_true", help="Do not rewrite the dotenv file after importing")
+    import_secret_parser.add_argument("--no-backup", action="store_true", help="Do not store a local backup before rewriting")
+    import_secret_parser.add_argument("--dry-run", action="store_true", help="Show what would be imported without writing changes")
 
     subparsers.add_parser("discover", help="Discover likely local secrets")
     subparsers.add_parser("suggest", help="Suggest env and network policy for discovered secrets")
@@ -1149,6 +1158,8 @@ def handle_secret_aliases(args: argparse.Namespace) -> int:
         return list_secret_aliases(args)
     if args.secrets_command == "use":
         return use_secret_aliases(args)
+    if args.secrets_command == "import":
+        return import_secret_aliases(args)
     sys.stderr.write("agentsecure: missing secrets subcommand\n")
     return 2
 
@@ -1242,6 +1253,204 @@ def use_secret_aliases(args: argparse.Namespace) -> int:
     return 0
 
 
+def import_secret_aliases(args: argparse.Namespace) -> int:
+    dotenv_path = os.path.abspath(args.path)
+    if not os.path.exists(dotenv_path):
+        sys.stderr.write("agentsecure: dotenv file not found: %s\n" % args.path)
+        return 2
+    source_dir = os.path.dirname(dotenv_path) or "."
+    source_name = os.path.basename(dotenv_path)
+    discoveries = DotenvSecretScanner(source_dir, [source_name]).scan()
+    discoveries = [secret for secret in discoveries if secret.source == source_name]
+    if not discoveries:
+        print(
+            json.dumps(
+                {
+                    "imported": [],
+                    "dotenv": args.path,
+                    "message": "No secrets found",
+                },
+                indent=2,
+                sort_keys=True,
+            )
+        )
+        return 0
+
+    imports = []
+    for secret in discoveries:
+        alias_id = _alias_id_for_env_name(secret.name)
+        approved_hosts = _approved_hosts_for_import(secret, args.approved_host)
+        imports.append(
+            {
+                "alias_id": alias_id,
+                "env_name": secret.name,
+                "provider": secret.provider_hint,
+                "approved_hosts": approved_hosts,
+                "placeholder": _alias_placeholder(alias_id),
+            }
+        )
+
+    if args.dry_run:
+        print(
+            json.dumps(
+                {
+                    "dotenv": args.path,
+                    "imported": imports,
+                    "would_rewrite_dotenv": not args.keep_file,
+                    "dry_run": True,
+                },
+                indent=2,
+                sort_keys=True,
+            )
+        )
+        return 0
+
+    service = _secret_alias_service(args.config)
+    try:
+        for secret, item in zip(discoveries, imports):
+            service.add_alias(
+                alias_id=item["alias_id"],
+                real_secret=secret.value,
+                env_name=secret.name,
+                provider=secret.provider_hint,
+                approved_hosts=item["approved_hosts"],
+                name=secret.name,
+            )
+        assigned = service.assign_to_project(
+            args.config,
+            [item["alias_id"] for item in imports],
+            project=args.project or os.path.basename(os.getcwd()) or "default",
+        )
+    except SecretAliasError as exc:
+        sys.stderr.write("agentsecure: %s\n" % exc)
+        return 2
+
+    backup_path = ""
+    if not args.keep_file:
+        if not args.no_backup:
+            try:
+                backup_path = _backup_dotenv_to_vault(dotenv_path, args.config)
+            except OSError as exc:
+                sys.stderr.write("agentsecure: failed to back up dotenv file: %s\n" % exc)
+                return 1
+        try:
+            _rewrite_dotenv_with_alias_placeholders(dotenv_path, {item["env_name"]: item["placeholder"] for item in imports})
+        except OSError as exc:
+            sys.stderr.write("agentsecure: failed to rewrite dotenv file: %s\n" % exc)
+            return 1
+
+    print(
+        json.dumps(
+            {
+                "dotenv": args.path,
+                "backup": backup_path,
+                "rewritten": not args.keep_file,
+                "imported": [
+                    {
+                        "alias_id": item.alias_id,
+                        "env_name": item.env_name,
+                        "provider": item.provider,
+                        "approved_hosts": item.approved_hosts,
+                    }
+                    for item in assigned
+                ],
+                "real_secrets_stored": "local_vault",
+            },
+            indent=2,
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+def _alias_id_for_env_name(env_name: str) -> str:
+    normalized = re.sub(r"[^a-z0-9._-]+", "_", str(env_name).strip().lower())
+    normalized = normalized.strip("._-")
+    return normalized or "secret"
+
+
+def _alias_placeholder(alias_id: str) -> str:
+    return "AGENTSECURE_ALIAS_%s" % re.sub(r"[^A-Z0-9]+", "_", alias_id.upper()).strip("_")
+
+
+def _approved_hosts_for_import(secret: DiscoveredSecret, extra_hosts: List[str]) -> List[str]:
+    hosts = []
+    inferred = _host_from_secret_value(secret.value)
+    if inferred:
+        hosts.append(inferred)
+    provider_hosts = {
+        "openai": "api.openai.com",
+        "anthropic": "api.anthropic.com",
+        "github": "api.github.com",
+        "stripe": "api.stripe.com",
+    }
+    provider_host = provider_hosts.get(secret.provider_hint)
+    if provider_host:
+        hosts.append(provider_host)
+    hosts.extend(extra_hosts or [])
+    result = []
+    seen = set()
+    for host in hosts:
+        normalized = str(host).strip().lower().rstrip(".")
+        if normalized and normalized not in seen:
+            result.append(normalized)
+            seen.add(normalized)
+    return result
+
+
+def _host_from_secret_value(value: str) -> str:
+    try:
+        parsed = urlsplit(str(value).strip())
+    except ValueError:
+        return ""
+    return (parsed.hostname or "").strip().lower().rstrip(".")
+
+
+def _backup_dotenv_to_vault(dotenv_path: str, config_path: str) -> str:
+    backup_dir = os.path.join(agentsecure_home(), "backups", project_id_for_path(config_path))
+    os.makedirs(backup_dir, exist_ok=True)
+    backup_path = os.path.join(
+        backup_dir,
+        "%s.%s.bak" % (os.path.basename(dotenv_path), time.strftime("%Y%m%d%H%M%S")),
+    )
+    shutil.copy2(dotenv_path, backup_path)
+    os.chmod(backup_path, 0o600)
+    return backup_path
+
+
+def _rewrite_dotenv_with_alias_placeholders(dotenv_path: str, placeholders: Dict[str, str]) -> None:
+    with open(dotenv_path, "r") as handle:
+        lines = handle.readlines()
+    rewritten = []
+    for line in lines:
+        parsed_name = _dotenv_line_name(line)
+        if parsed_name and parsed_name in placeholders:
+            prefix = line.split("=", 1)[0].rstrip()
+            newline = "\n" if line.endswith("\n") else ""
+            rewritten.append("%s=%s%s" % (prefix, placeholders[parsed_name], newline))
+        else:
+            rewritten.append(line)
+    fd, temp_path = tempfile.mkstemp(prefix=".agentsecure-dotenv-", dir=os.path.dirname(dotenv_path) or ".")
+    try:
+        with os.fdopen(fd, "w") as handle:
+            handle.writelines(rewritten)
+        shutil.copymode(dotenv_path, temp_path)
+        os.replace(temp_path, dotenv_path)
+    finally:
+        if os.path.exists(temp_path):
+            os.unlink(temp_path)
+
+
+def _dotenv_line_name(line: str) -> str:
+    stripped = line.strip()
+    if not stripped or stripped.startswith("#") or "=" not in stripped:
+        return ""
+    name = stripped.split("=", 1)[0].strip()
+    if name.startswith("export "):
+        name = name[len("export ") :].strip()
+    return name
+
+
 def _secret_alias_service(config_path: str) -> SecretAliasService:
     home = agentsecure_home()
     return SecretAliasService(

{agentsecure-0.1.7 → agentsecure-0.1.8/agentsecure.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsecure
-Version: 0.1.7
+Version: 0.1.8
 Summary: Local-first security runtime for AI coding agents
 Home-page: https://github.com/ShellFrameAI/agentsecure-community
 Author: ShellFrame AI
@@ -76,6 +76,17 @@ python3 -m agentsecure run claude
 
 Keep real secrets in one local AgentSecure vault:
 
+```bash
+agentsecure secrets import .env
+agentsecure run -- claude
+```
+
+`secrets import` is the easiest migration path. It scans the dotenv file, stores discovered real secret values in the local vault, assigns those aliases to the current project, writes a private backup under `~/.agentsecure/backups/`, and replaces the values in `.env` with non-secret `AGENTSECURE_ALIAS_...` placeholders.
+
+Use `--dry-run` to preview the import, or `--keep-file` if you want to store aliases without rewriting `.env`.
+
+For manual control, add one alias at a time:
+
 ```bash
 printf '%s' "$DATABASE_URL" | agentsecure secrets add dev_db \
   --env-name DATABASE_URL \

{agentsecure-0.1.7 → agentsecure-0.1.8}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = agentsecure
-version = 0.1.7
+version = 0.1.8
 description = Local-first security runtime for AI coding agents
 long_description = file: README.md
 long_description_content_type = text/markdown

agentsecure-0.1.8/tests/test_secret_aliases.py

@@ -0,0 +1,186 @@
+import json
+import os
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from io import StringIO
+
+from agentsecure.cli.main import main
+from agentsecure.core.config import JsonConfigLoader
+from agentsecure.core.container import Container
+
+
+class SecretAliasesCliTest(unittest.TestCase):
+    def test_import_dotenv_moves_secrets_to_vault_and_rewrites_file(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            project_dir = os.path.join(temp_dir, "project")
+            home_dir = os.path.join(temp_dir, "home")
+            os.makedirs(project_dir)
+            config_path = os.path.join(project_dir, "agentsecure.json")
+            env_path = os.path.join(project_dir, ".env")
+            real_url = "postgres://user:password@dev.example.invalid/mydb"
+            real_key = "sk_test_dummy_value_do_not_use"
+            with open(env_path, "w") as handle:
+                handle.write("DATABASE_URL=%s\n" % real_url)
+                handle.write("STRIPE_API_KEY=%s\n" % real_key)
+                handle.write("DEBUG=true\n")
+
+            old_cwd = os.getcwd()
+            old_home = os.environ.get("AGENTSECURE_HOME")
+            os.environ["AGENTSECURE_HOME"] = home_dir
+            try:
+                os.chdir(project_dir)
+                output = StringIO()
+                with redirect_stdout(output):
+                    self.assertEqual(0, main(["--config", config_path, "secrets", "import", ".env"]))
+
+                result = json.loads(output.getvalue())
+                self.assertTrue(result["rewritten"])
+                self.assertEqual("local_vault", result["real_secrets_stored"])
+                self.assertTrue(os.path.exists(result["backup"]))
+                self.assertTrue(result["backup"].startswith(home_dir))
+
+                with open(env_path, "r") as handle:
+                    dotenv_text = handle.read()
+                self.assertIn("DATABASE_URL=AGENTSECURE_ALIAS_DATABASE_URL", dotenv_text)
+                self.assertIn("STRIPE_API_KEY=AGENTSECURE_ALIAS_STRIPE_API_KEY", dotenv_text)
+                self.assertIn("DEBUG=true", dotenv_text)
+                self.assertNotIn(real_url, dotenv_text)
+                self.assertNotIn(real_key, dotenv_text)
+
+                with open(config_path, "r") as handle:
+                    raw = json.load(handle)
+                raw_text = json.dumps(raw)
+                self.assertNotIn(real_url, raw_text)
+                self.assertNotIn(real_key, raw_text)
+                self.assertEqual(
+                    ["database_url", "stripe_api_key"],
+                    [item["alias_id"] for item in raw["secret_aliases"]],
+                )
+                self.assertIn("dev.example.invalid", raw["network"]["allow_domains"])
+                self.assertIn("api.stripe.com", raw["network"]["allow_domains"])
+
+                with open(result["backup"], "r") as handle:
+                    backup_text = handle.read()
+                self.assertIn(real_url, backup_text)
+                self.assertIn(real_key, backup_text)
+            finally:
+                os.chdir(old_cwd)
+                if old_home is None:
+                    os.environ.pop("AGENTSECURE_HOME", None)
+                else:
+                    os.environ["AGENTSECURE_HOME"] = old_home
+
+    def test_import_dotenv_dry_run_does_not_write(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            project_dir = os.path.join(temp_dir, "project")
+            home_dir = os.path.join(temp_dir, "home")
+            os.makedirs(project_dir)
+            config_path = os.path.join(project_dir, "agentsecure.json")
+            env_path = os.path.join(project_dir, ".env")
+            real_url = "postgres://user:password@dev.example.invalid/mydb"
+            with open(env_path, "w") as handle:
+                handle.write("DATABASE_URL=%s\n" % real_url)
+
+            old_cwd = os.getcwd()
+            old_home = os.environ.get("AGENTSECURE_HOME")
+            os.environ["AGENTSECURE_HOME"] = home_dir
+            try:
+                os.chdir(project_dir)
+                output = StringIO()
+                with redirect_stdout(output):
+                    self.assertEqual(0, main(["--config", config_path, "secrets", "import", ".env", "--dry-run"]))
+                result = json.loads(output.getvalue())
+                self.assertTrue(result["dry_run"])
+                self.assertFalse(os.path.exists(config_path))
+                with open(env_path, "r") as handle:
+                    self.assertIn(real_url, handle.read())
+            finally:
+                os.chdir(old_cwd)
+                if old_home is None:
+                    os.environ.pop("AGENTSECURE_HOME", None)
+                else:
+                    os.environ["AGENTSECURE_HOME"] = old_home
+
+    def test_project_assignment_stores_only_alias_metadata(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            project_dir = os.path.join(temp_dir, "project")
+            home_dir = os.path.join(temp_dir, "home")
+            os.makedirs(project_dir)
+            config_path = os.path.join(project_dir, "agentsecure.json")
+            old_cwd = os.getcwd()
+            old_home = os.environ.get("AGENTSECURE_HOME")
+            os.environ["AGENTSECURE_HOME"] = home_dir
+            try:
+                os.chdir(project_dir)
+                os.environ["TEST_REAL_DATABASE_URL"] = "database-secret-value-for-test"
+                with redirect_stdout(StringIO()):
+                    self.assertEqual(
+                        0,
+                        main(
+                            [
+                                "--config",
+                                config_path,
+                                "secrets",
+                                "add",
+                                "dev_db",
+                                "--env-name",
+                                "DATABASE_URL",
+                                "--provider",
+                                "database",
+                                "--approved-host",
+                                "db.example.com",
+                                "--real-secret-env",
+                                "TEST_REAL_DATABASE_URL",
+                            ]
+                        ),
+                    )
+                    self.assertEqual(0, main(["--config", config_path, "secrets", "use", "dev_db"]))
+
+                with open(config_path, "r") as handle:
+                    raw = json.load(handle)
+                self.assertEqual("dev_db", raw["secret_aliases"][0]["alias_id"])
+                self.assertNotIn("database-secret-value-for-test", json.dumps(raw))
+                self.assertIn("db.example.com", raw["network"]["allow_domains"])
+
+                config = JsonConfigLoader().load(config_path)
+                from agentsecure.core.secret_aliases import SecretAliasService, local_secret_alias_store_for_home, project_id_for_path
+                from agentsecure.implementations.grant_store import local_grant_store_for_config
+                from agentsecure.implementations.secret_store_factory import encrypted_secret_store_for_vault
+
+                class MemoryAudit:
+                    def record(self, event_type, details):
+                        pass
+
+                bindings = SecretAliasService(
+                    local_secret_alias_store_for_home(home_dir),
+                    encrypted_secret_store_for_vault(),
+                    local_grant_store_for_config(config_path),
+                    MemoryAudit(),
+                ).prepare_run_bindings(config.secret_aliases, "2h", project_id_for_path(config_path), "run_1")
+                container = Container.from_config_path(config_path, runtime_bindings=bindings, run_id="run_1")
+                token = bindings[0].virtual_token
+                self.assertEqual(
+                    "database-secret-value-for-test",
+                    container.token_resolver.resolve(
+                        token,
+                        {"host": "db.example.com", "project_id": container.project_id, "run_id": "run_1"},
+                    ),
+                )
+                self.assertIsNone(
+                    container.token_resolver.resolve(
+                        token,
+                        {"host": "evil.example.com", "project_id": container.project_id, "run_id": "run_1"},
+                    )
+                )
+            finally:
+                os.chdir(old_cwd)
+                os.environ.pop("TEST_REAL_DATABASE_URL", None)
+                if old_home is None:
+                    os.environ.pop("AGENTSECURE_HOME", None)
+                else:
+                    os.environ["AGENTSECURE_HOME"] = old_home
+
+
+if __name__ == "__main__":
+    unittest.main()

agentsecure-0.1.7/tests/test_secret_aliases.py

@@ -1,95 +0,0 @@
-import json
-import os
-import tempfile
-import unittest
-from contextlib import redirect_stdout
-from io import StringIO
-
-from agentsecure.cli.main import main
-from agentsecure.core.config import JsonConfigLoader
-from agentsecure.core.container import Container
-
-
-class SecretAliasesCliTest(unittest.TestCase):
-    def test_project_assignment_stores_only_alias_metadata(self):
-        with tempfile.TemporaryDirectory() as temp_dir:
-            project_dir = os.path.join(temp_dir, "project")
-            home_dir = os.path.join(temp_dir, "home")
-            os.makedirs(project_dir)
-            config_path = os.path.join(project_dir, "agentsecure.json")
-            old_cwd = os.getcwd()
-            old_home = os.environ.get("AGENTSECURE_HOME")
-            os.environ["AGENTSECURE_HOME"] = home_dir
-            try:
-                os.chdir(project_dir)
-                os.environ["TEST_REAL_DATABASE_URL"] = "database-secret-value-for-test"
-                with redirect_stdout(StringIO()):
-                    self.assertEqual(
-                        0,
-                        main(
-                            [
-                                "--config",
-                                config_path,
-                                "secrets",
-                                "add",
-                                "dev_db",
-                                "--env-name",
-                                "DATABASE_URL",
-                                "--provider",
-                                "database",
-                                "--approved-host",
-                                "db.example.com",
-                                "--real-secret-env",
-                                "TEST_REAL_DATABASE_URL",
-                            ]
-                        ),
-                    )
-                    self.assertEqual(0, main(["--config", config_path, "secrets", "use", "dev_db"]))
-
-                with open(config_path, "r") as handle:
-                    raw = json.load(handle)
-                self.assertEqual("dev_db", raw["secret_aliases"][0]["alias_id"])
-                self.assertNotIn("database-secret-value-for-test", json.dumps(raw))
-                self.assertIn("db.example.com", raw["network"]["allow_domains"])
-
-                config = JsonConfigLoader().load(config_path)
-                from agentsecure.core.secret_aliases import SecretAliasService, local_secret_alias_store_for_home, project_id_for_path
-                from agentsecure.implementations.grant_store import local_grant_store_for_config
-                from agentsecure.implementations.secret_store_factory import encrypted_secret_store_for_vault
-
-                class MemoryAudit:
-                    def record(self, event_type, details):
-                        pass
-
-                bindings = SecretAliasService(
-                    local_secret_alias_store_for_home(home_dir),
-                    encrypted_secret_store_for_vault(),
-                    local_grant_store_for_config(config_path),
-                    MemoryAudit(),
-                ).prepare_run_bindings(config.secret_aliases, "2h", project_id_for_path(config_path), "run_1")
-                container = Container.from_config_path(config_path, runtime_bindings=bindings, run_id="run_1")
-                token = bindings[0].virtual_token
-                self.assertEqual(
-                    "database-secret-value-for-test",
-                    container.token_resolver.resolve(
-                        token,
-                        {"host": "db.example.com", "project_id": container.project_id, "run_id": "run_1"},
-                    ),
-                )
-                self.assertIsNone(
-                    container.token_resolver.resolve(
-                        token,
-                        {"host": "evil.example.com", "project_id": container.project_id, "run_id": "run_1"},
-                    )
-                )
-            finally:
-                os.chdir(old_cwd)
-                os.environ.pop("TEST_REAL_DATABASE_URL", None)
-                if old_home is None:
-                    os.environ.pop("AGENTSECURE_HOME", None)
-                else:
-                    os.environ["AGENTSECURE_HOME"] = old_home
-
-
-if __name__ == "__main__":
-    unittest.main()