cipher-security 0.2.0__py3-none-any.whl

gateway/dashboard.py

@@ -0,0 +1,347 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""CIPHER Dashboard — cyberpunk terminal UI built with Textual.
+
+Usage:
+    cipher dashboard
+"""
+from __future__ import annotations
+
+from textual import on, work
+from textual.app import App, ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical, VerticalScroll
+from textual.css.query import NoMatches
+from textual.widgets import (
+    Footer,
+    Header,
+    Input,
+    Label,
+    Markdown,
+    Static,
+)
+
+
+# ---------------------------------------------------------------------------
+# Cyberpunk CSS
+# ---------------------------------------------------------------------------
+
+CIPHER_CSS = """
+Screen {
+    background: #0a0a0a;
+}
+
+Header {
+    background: #0d1117;
+    color: #00ff41;
+    text-style: bold;
+}
+
+Footer {
+    background: #0d1117;
+    color: #5a6480;
+}
+
+#status-panel {
+    height: 7;
+    background: #0d1117;
+    border: solid #1a1f2e;
+    padding: 0 1;
+}
+
+.status-key {
+    color: #5a6480;
+    width: 14;
+}
+
+.status-val {
+    color: #c9d1d9;
+}
+
+.status-val-good {
+    color: #00e5cc;
+}
+
+#mode-bar {
+    height: 3;
+    background: #0d1117;
+    border: solid #1a1f2e;
+    padding: 0 1;
+}
+
+.mode-label {
+    width: 12;
+    content-align: center middle;
+    text-style: bold;
+    margin: 0 1;
+}
+
+.mode-red { background: #2d0a0a; color: #ff2d2d; }
+.mode-blue { background: #0a1a2d; color: #2d9bff; }
+.mode-purple { background: #1a0a2d; color: #9b59b6; }
+.mode-privacy { background: #0a1a0d; color: #27ae60; }
+.mode-recon { background: #1a1a0a; color: #f39c12; }
+.mode-incident { background: #2d0a0a; color: #e74c3c; }
+.mode-architect { background: #0a1a2d; color: #3498db; }
+
+#response-area {
+    background: #0d1117;
+    border: solid #1a1f2e;
+    padding: 1 2;
+    overflow-y: auto;
+}
+
+#response-area Markdown {
+    background: #0d1117;
+    color: #c9d1d9;
+}
+
+#query-input {
+    dock: bottom;
+    background: #161b22;
+    color: #00ff41;
+    border: tall #00ff41;
+    padding: 0 1;
+}
+
+#query-input:focus {
+    border: tall #00ff41;
+}
+
+#welcome {
+    color: #5a6480;
+    text-align: center;
+    padding: 2;
+}
+
+.spinner-label {
+    color: #00ff41;
+    text-style: italic;
+}
+"""
+
+
+# ---------------------------------------------------------------------------
+# Dashboard App
+# ---------------------------------------------------------------------------
+
+class CipherDashboard(App):
+    """CIPHER cyberpunk terminal dashboard."""
+
+    TITLE = "CIPHER"
+    SUB_TITLE = "Security Engineering Assistant"
+    CSS = CIPHER_CSS
+
+    BINDINGS = [
+        Binding("ctrl+q", "quit", "Quit"),
+        Binding("ctrl+l", "clear", "Clear"),
+        Binding("escape", "focus_input", "Focus Input", show=False),
+    ]
+
+    def __init__(self) -> None:
+        super().__init__()
+        self._gateway = None
+        self._history: list[dict] = []
+
+    def compose(self) -> ComposeResult:
+        yield Header()
+
+        # Status panel
+        with Horizontal(id="status-panel"):
+            with Vertical():
+                yield Label("[b]Backend[/]", classes="status-key")
+                yield Label("[b]Model[/]", classes="status-key")
+                yield Label("[b]RAG[/]", classes="status-key")
+            with Vertical():
+                yield Label("loading...", id="val-backend", classes="status-val")
+                yield Label("loading...", id="val-model", classes="status-val")
+                yield Label("loading...", id="val-rag", classes="status-val")
+            with Vertical():
+                yield Label("[b]Knowledge[/]", classes="status-key")
+                yield Label("[b]Skills[/]", classes="status-key")
+                yield Label("[b]Modes[/]", classes="status-key")
+            with Vertical():
+                yield Label("loading...", id="val-knowledge", classes="status-val")
+                yield Label("loading...", id="val-skills", classes="status-val")
+                yield Label("7", id="val-modes", classes="status-val-good")
+
+        # Mode bar
+        with Horizontal(id="mode-bar"):
+            yield Label("RED", classes="mode-label mode-red")
+            yield Label("BLUE", classes="mode-label mode-blue")
+            yield Label("PURPLE", classes="mode-label mode-purple")
+            yield Label("PRIVACY", classes="mode-label mode-privacy")
+            yield Label("RECON", classes="mode-label mode-recon")
+            yield Label("INCIDENT", classes="mode-label mode-incident")
+            yield Label("ARCHITECT", classes="mode-label mode-architect")
+
+        # Response area
+        with VerticalScroll(id="response-area"):
+            yield Static(
+                "[dim]Type a security query below and press Enter.\n\n"
+                "Examples:\n"
+                '  "how do I detect Kerberoasting"\n'
+                '  "write a Sigma rule for lateral movement via PsExec"\n'
+                '  "GDPR breach notification requirements"\n'
+                '  "[MODE: RED] exploit AS-REP roasting"\n\n'
+                "Ctrl+L to clear, Ctrl+Q to quit.[/]",
+                id="welcome",
+            )
+
+        # Query input
+        yield Input(placeholder="Enter security query...", id="query-input")
+
+        yield Footer()
+
+    def on_mount(self) -> None:
+        """Load status on startup."""
+        self._load_status()
+        self.query_one("#query-input", Input).focus()
+
+    @work(thread=True)
+    def _load_status(self) -> None:
+        """Load system status in background thread."""
+        try:
+            from gateway.config import load_config
+            cfg = load_config()
+            self.call_from_thread(self._update_label, "val-backend", cfg.backend, good=True)
+            model = cfg.ollama_model if cfg.backend == "ollama" else cfg.claude_model
+            self.call_from_thread(self._update_label, "val-model", model, good=True)
+        except Exception:
+            self.call_from_thread(self._update_label, "val-backend", "not configured", good=False)
+            self.call_from_thread(self._update_label, "val-model", "—", good=False)
+
+        try:
+            from gateway.retriever import Retriever
+            r = Retriever()
+            self.call_from_thread(self._update_label, "val-rag", f"{r.count:,} chunks", good=True)
+        except Exception:
+            self.call_from_thread(self._update_label, "val-rag", "unavailable", good=False)
+
+        try:
+            from gateway.prompt import REPO_ROOT
+            kb = REPO_ROOT / "knowledge"
+            count = len(list(kb.glob("*.md"))) if kb.is_dir() else 0
+            self.call_from_thread(self._update_label, "val-knowledge", f"{count} docs", good=True)
+            skills = REPO_ROOT / "skills"
+            scount = len(list(skills.rglob("SKILL.md"))) if skills.is_dir() else 0
+            self.call_from_thread(self._update_label, "val-skills", str(scount), good=True)
+        except Exception:
+            pass
+
+    def _update_label(self, label_id: str, text: str, good: bool = True) -> None:
+        try:
+            label = self.query_one(f"#{label_id}", Label)
+            cls = "status-val-good" if good else "status-val"
+            label.update(text)
+            label.set_classes(cls)
+        except NoMatches:
+            pass
+
+    @on(Input.Submitted, "#query-input")
+    def on_query_submit(self, event: Input.Submitted) -> None:
+        """Handle query submission."""
+        query = event.value.strip()
+        if not query:
+            return
+
+        event.input.value = ""
+        self._send_query(query)
+
+    @work(thread=True)
+    def _send_query(self, query: str) -> None:
+        """Send query to gateway in background thread."""
+        # Show user query
+        self.call_from_thread(self._append_message, "user", query)
+        self.call_from_thread(self._append_message, "system", "Thinking...")
+
+        try:
+            if self._gateway is None:
+                from gateway.gateway import Gateway
+                self._gateway = Gateway()
+
+            result = self._gateway.send(query, history=self._history if self._history else None)
+
+            # Update history
+            self._history.append({"role": "user", "content": query})
+            self._history.append({"role": "assistant", "content": result})
+
+            # Remove "Thinking..." and show response
+            self.call_from_thread(self._remove_thinking)
+            self.call_from_thread(self._append_response, result)
+
+        except Exception as exc:
+            self.call_from_thread(self._remove_thinking)
+            self.call_from_thread(self._append_message, "error", f"Error: {exc}")
+
+    def _append_message(self, role: str, text: str) -> None:
+        container = self.query_one("#response-area", VerticalScroll)
+        # Remove welcome on first message
+        try:
+            welcome = self.query_one("#welcome", Static)
+            welcome.remove()
+        except NoMatches:
+            pass
+
+        if role == "user":
+            container.mount(Static(f"[bold #00ff41]> {text}[/]"))
+        elif role == "system":
+            container.mount(Static(f"[italic #5a6480]{text}[/]", classes="spinner-label"))
+        elif role == "error":
+            container.mount(Static(f"[bold #ff4d4d]{text}[/]"))
+
+        container.scroll_end()
+
+    def _remove_thinking(self) -> None:
+        try:
+            for widget in self.query(".spinner-label"):
+                widget.remove()
+        except NoMatches:
+            pass
+
+    def _append_response(self, text: str) -> None:
+        container = self.query_one("#response-area", VerticalScroll)
+
+        # Colorize mode header
+        lines = text.split("\n", 1)
+        header = lines[0]
+        body = lines[1] if len(lines) > 1 else ""
+
+        mode_colors = {
+            "RED": "#ff2d2d", "BLUE": "#2d9bff", "PURPLE": "#9b59b6",
+            "PRIVACY": "#27ae60", "RECON": "#f39c12", "INCIDENT": "#e74c3c",
+            "ARCHITECT": "#3498db",
+        }
+
+        if header.startswith("[MODE:"):
+            mode = header.split(":")[1].strip().rstrip("]").strip()
+            color = mode_colors.get(mode, "#00ff41")
+            container.mount(Static(f"[bold {color}]{header}[/]"))
+        else:
+            body = text
+
+        if body.strip():
+            container.mount(Markdown(body))
+
+        container.mount(Static("[dim]─────────────────────────────────────────[/]"))
+        container.scroll_end()
+
+    def action_clear(self) -> None:
+        """Clear response area and history."""
+        container = self.query_one("#response-area", VerticalScroll)
+        container.remove_children()
+        container.mount(Static("[dim]Cleared. Type a new query.[/]"))
+        self._history.clear()
+
+    def action_focus_input(self) -> None:
+        self.query_one("#query-input", Input).focus()
+
+
+def run_dashboard() -> None:
+    """Launch the CIPHER dashboard."""
+    app = CipherDashboard()
+    app.run()
+
+
+if __name__ == "__main__":
+    run_dashboard()

gateway/gateway.py

@@ -0,0 +1,171 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""CIPHER Gateway orchestrator.
+
+Wires config, client, prompt, mode, and retriever modules into a single send() interface.
+
+Usage:
+    from gateway import Gateway
+
+    gw = Gateway()
+    response = gw.send("how do I exploit a SQLi vulnerability")
+    print(response)  # [MODE: RED] ...
+"""
+from __future__ import annotations
+
+import logging
+
+import anthropic
+
+from gateway.client import make_client
+from gateway.config import load_config
+from gateway.mode import detect_mode, parse_keyword_table, strip_mode_prefix
+from gateway.prompt import assemble_system_prompt
+
+logger = logging.getLogger(__name__)
+
+
+def _load_retriever():
+    """Lazy-load the RAG retriever. Returns None if unavailable."""
+    try:
+        from gateway.retriever import Retriever
+        r = Retriever()
+        if r.count > 0:
+            return r
+        logger.info("Gateway: RAG collection empty — running without retrieval")
+    except Exception as exc:
+        logger.info("Gateway: RAG unavailable (%s) — running without retrieval", exc)
+    return None
+
+
+class Gateway:
+    """CIPHER gateway orchestrator.
+
+    Initialises once from config and routes every message through the
+    full pipeline: mode detection → prompt assembly → RAG retrieval → LLM call → response.
+    """
+
+    def __init__(self, backend_override: str | None = None, rag: bool = True) -> None:
+        """Initialise gateway.
+
+        Args:
+            backend_override: If provided, replaces config.backend.
+                              Useful for testing or CLI --backend flag.
+            rag: Whether to enable RAG retrieval. Defaults to True.
+        """
+        cfg = load_config()
+        if backend_override is not None:
+            # Replace backend in-place — GatewayConfig is a mutable dataclass.
+            cfg.backend = backend_override
+            logger.info("Gateway: backend overridden to %r", backend_override)
+
+        self._client, self._model = make_client(cfg)
+        logger.info("Gateway: client ready (backend=%r, model=%r)", cfg.backend, self._model)
+
+        # Cache keyword table at startup so every send() call is O(1) lookup.
+        # Parse from raw CLAUDE.md (not the stripped base prompt) since
+        # load_base_prompt() removes the Trigger Keywords section.
+        from gateway.prompt import REPO_ROOT
+        raw_claude_md = (REPO_ROOT / "CLAUDE.md").read_text(encoding="utf-8")
+        self._keyword_table: dict[str, list[str]] = parse_keyword_table(raw_claude_md)
+        logger.info("Gateway: keyword table loaded (%d modes)", len(self._keyword_table))
+
+        # RAG retriever (lazy, graceful fallback if chromadb not installed or empty).
+        self._retriever = _load_retriever() if rag else None
+        if self._retriever:
+            logger.info("Gateway: RAG enabled (%d chunks)", self._retriever.count)
+
+    def send(self, message: str, history: list[dict] | None = None) -> str:
+        """Send a message through the full CIPHER pipeline.
+
+        Pipeline:
+        1. Detect mode (explicit prefix or keyword scoring).
+        2. If needs_clarification → return disambiguation string (no LLM call).
+        3. Assemble system prompt for detected mode.
+        4. Strip mode prefix from message.
+        5. Build messages list (history + new user message).
+        6. Call LLM.
+        7. Prepend [MODE: X] header if missing.
+        8. Return response.
+
+        Args:
+            message: User message text. May include [MODE: X] prefix.
+            history: Optional list of prior message dicts
+                     ({"role": "user"|"assistant", "content": "..."}).
+
+        Returns:
+            Response string, always starting with [MODE: X] header.
+        """
+        # 1. Detect mode.
+        mode, needs_clarification = detect_mode(message, self._keyword_table)
+
+        # 2. Disambiguation short-circuit.
+        if needs_clarification:
+            logger.info("Gateway: mode overlap detected (%r) — requesting clarification", mode)
+            return (
+                f"Multiple modes detected ({mode}). "
+                "Are you approaching this offensively or defensively?"
+            )
+
+        logger.info("Gateway: routing to mode %r", mode)
+
+        # 3. Assemble system prompt.
+        system_prompt = assemble_system_prompt(mode)
+
+        # 3b. RAG retrieval — inject relevant knowledge chunks.
+        if self._retriever:
+            chunks = self._retriever.query(message, top_k=5)
+            if chunks:
+                from gateway.retriever import Retriever
+                context_block = Retriever.format_context(chunks)
+                if context_block:
+                    system_prompt = system_prompt + "\n\n---\n\n" + context_block
+                    logger.info(
+                        "Gateway: injected %d RAG chunks (%.1f KB)",
+                        len(chunks),
+                        len(context_block) / 1024,
+                    )
+
+        # 4. Strip mode prefix.
+        clean_message = strip_mode_prefix(message)
+
+        # 5. Prepend [MODE: X] for LLM context.
+        user_content = f"[MODE: {mode}] {clean_message}"
+
+        # 6. Build messages list.
+        messages: list[dict] = []
+        if history:
+            messages.extend(history)
+        messages.append({"role": "user", "content": user_content})
+
+        # 7. Call LLM.
+        try:
+            response = self._client.messages.create(
+                model=self._model,
+                max_tokens=4096,
+                system=system_prompt,
+                messages=messages,
+            )
+            response_text: str = response.content[0].text
+
+        except anthropic.APITimeoutError:
+            logger.error("Gateway: LLM backend timed out")
+            return "[ERROR] Backend timed out. Is the LLM backend running?"
+
+        except anthropic.APIConnectionError as exc:
+            logger.error("Gateway: cannot reach backend — %s", exc)
+            return f"[ERROR] Cannot reach backend: {exc}"
+
+        except anthropic.APIStatusError as exc:
+            logger.error("Gateway: backend returned HTTP %s — %s", exc.status_code, exc.message)
+            return f"[ERROR] Backend returned {exc.status_code}: {exc.message}"
+
+        # 8. Ensure exactly one [MODE: X] header is present.
+        if not response_text.startswith("[MODE:"):
+            response_text = f"[MODE: {mode}]\n{response_text}"
+        # Strip duplicate header if LLM echoed it twice.
+        lines = response_text.split("\n", 2)
+        if len(lines) >= 2 and lines[0].startswith("[MODE:") and lines[1].startswith("[MODE:"):
+            response_text = "\n".join([lines[0]] + lines[2:]) if len(lines) > 2 else lines[0]
+
+        return response_text

gateway/mode.py

@@ -0,0 +1,127 @@
+# Copyright (c) 2026 defconxt. All rights reserved.
+# Licensed under AGPL-3.0 — see LICENSE file for details.
+"""Mode detection for CIPHER gateway.
+
+Provides:
+- parse_keyword_table: extract mode→keywords from CLAUDE.md trigger table
+- detect_mode: route message to operating mode via explicit prefix or keyword scoring
+- strip_mode_prefix: remove [MODE: X] prefix from message text
+"""
+
+import logging
+import re
+
+logger = logging.getLogger(__name__)
+
+# Matches [MODE: X] at the start of a message, case-insensitive.
+_EXPLICIT_RE = re.compile(r"^\[MODE:\s*(\w+)\]", re.IGNORECASE)
+
+# Matches the trigger keywords table block inside CLAUDE.md.
+# Looks for a header containing "Trigger Keywords", then captures rows.
+_TABLE_HEADER_RE = re.compile(
+    r"Trigger Keywords.*?\n\|[-| ]+\|\n(.*?)(?:\n[-]+|\n\n|\Z)",
+    re.DOTALL | re.IGNORECASE,
+)
+# Individual data row: | WORD | content |
+# Skips header rows where the first cell is "Mode" (case-insensitive).
+_TABLE_ROW_RE = re.compile(r"^\|\s*(\w+)\s*\|\s*(.+?)\s*\|", re.MULTILINE)
+# Known header/separator cell values to skip.
+_SKIP_ROW_NAMES = {"MODE", "---"}
+
+
+def parse_keyword_table(claude_md_text: str) -> dict[str, list[str]]:
+    """Parse the ``| Mode | Trigger Keywords |`` table from CLAUDE.md text.
+
+    Returns a dict mapping UPPERCASE mode names to lists of lowercase,
+    stripped keyword strings. Returns empty dict if the table is absent or
+    malformed.
+    """
+    if not claude_md_text.strip():
+        return {}
+
+    # Find the trigger keywords section — everything after the separator row.
+    header_match = _TABLE_HEADER_RE.search(claude_md_text)
+    if not header_match:
+        # Try a looser parse: find any table-like block with Mode | Trigger columns.
+        # Scan line by line for rows after a header that contains "Trigger Keywords".
+        if "Trigger Keywords" not in claude_md_text:
+            logger.warning("parse_keyword_table: no 'Trigger Keywords' table found")
+            return {}
+        # Fall through to row-level scan across the full text.
+        rows_text = claude_md_text
+    else:
+        rows_text = header_match.group(0)
+
+    result: dict[str, list[str]] = {}
+    for row_match in _TABLE_ROW_RE.finditer(rows_text):
+        mode = row_match.group(1).strip().upper()
+        # Skip table header row (| Mode | Trigger Keywords |) and separators.
+        if mode in _SKIP_ROW_NAMES:
+            continue
+        raw_keywords = row_match.group(2)
+        # Skip if the "keyword" cell looks like a column header.
+        if "trigger keywords" in raw_keywords.lower():
+            continue
+        keywords = [kw.strip().lower() for kw in raw_keywords.split(",") if kw.strip()]
+        if mode and keywords:
+            result[mode] = keywords
+
+    if not result:
+        logger.warning("parse_keyword_table: table parsed to empty dict")
+
+    return result
+
+
+def detect_mode(
+    message: str,
+    keyword_table: dict[str, list[str]],
+) -> tuple[str, bool]:
+    """Detect the CIPHER operating mode for a given message.
+
+    Detection order:
+    1. Explicit ``[MODE: X]`` prefix — returns immediately, no clarification needed.
+    2. Keyword scoring — scan lowercased message against keyword_table.
+       - Single mode match → return (mode, False)
+       - Multiple mode matches → return (comma-joined sorted modes, True)
+       - No match → return ("ARCHITECT", False)
+
+    Args:
+        message: Raw user message text (may include [MODE: X] prefix).
+        keyword_table: Dict of mode→keywords from parse_keyword_table.
+
+    Returns:
+        Tuple of (mode_string, needs_clarification).
+    """
+    # 1. Check explicit prefix.
+    prefix_match = _EXPLICIT_RE.match(message)
+    if prefix_match:
+        return prefix_match.group(1).upper(), False
+
+    # 2. Keyword scoring.
+    lower_message = message.lower()
+    matched_modes: set[str] = set()
+
+    for mode, keywords in keyword_table.items():
+        for keyword in keywords:
+            if keyword in lower_message:
+                matched_modes.add(mode)
+                break  # One hit per mode is enough.
+
+    if len(matched_modes) == 0:
+        return "ARCHITECT", False
+    if len(matched_modes) == 1:
+        return matched_modes.pop(), False
+
+    # Multiple matches — needs clarification.
+    sorted_modes = ",".join(sorted(matched_modes))
+    return sorted_modes, True
+
+
+def strip_mode_prefix(message: str) -> str:
+    """Remove ``[MODE: X]`` prefix from message text.
+
+    Strips any leading whitespace after the prefix. Returns the original
+    string unchanged if no prefix is present.
+    """
+    result = _EXPLICIT_RE.sub("", message)
+    return result.lstrip()