crux-inject 0.1.0__tar.gz

crux_inject-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Akash Bhujbal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crux_inject-0.1.0/PKG-INFO

@@ -0,0 +1,207 @@
+Metadata-Version: 2.4
+Name: crux-inject
+Version: 0.1.0
+Summary: CRUX — Credential Runtime Unified eXecutor. Securely inject credentials into any AI tool.
+Author-email: Akash Bhujbal <akashbhujbal100@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/akashbhujbalwebsite/crux
+Project-URL: Issues, https://github.com/akashbhujbalwebsite/crux/issues
+Keywords: credentials,security,ai,cli,secrets,injection
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer<1.0.0,>=0.12.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: cryptography<51.0.0,>=42.0.0
+Requires-Dist: keyring<26.0.0,>=25.0.0
+Requires-Dist: secretstorage<4.0.0,>=3.3.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: pytest-cov>=5.0.0; extra == "dev"
+Dynamic: license-file
+
+# CRUX — Credential Runtime Unified eXecutor
+
+> Store credentials encrypted on your machine. Auto-inject into any AI tool. Credentials never appear in chat transcripts.
+
+---
+
+## The Problem
+
+Every day, developers paste passwords, API keys, and server credentials directly into AI chat tools to get help with tasks.
+
+```
+❌ You type in chat: "my server password is MyP@ssw0rd123, can you SSH in?"
+```
+
+That credential is now in the conversation — stored on Anthropic/OpenAI servers, visible in your transcript forever.
+
+**Real numbers (2026):**
+- 29 million secrets leaked on GitHub in 2025 — 34% YoY increase
+- 1.27 million AI-specific keys exposed (OpenAI, Anthropic, Hugging Face)
+- 3.2% secret-leak rate in AI-assisted commits vs 1.5% baseline
+
+---
+
+## The Solution
+
+CRUX stores your credentials encrypted locally and auto-injects them as environment variables into any AI tool.
+
+```
+✅ You say in chat: "SSH into $VM_USER@$VM_IP using $VM_PASS"
+```
+
+Claude/ChatGPT sees the variable names — never the actual values.
+
+---
+
+## Install
+
+**Linux / macOS (recommended):**
+```bash
+pipx install crux-inject
+crux install
+source ~/.bashrc
+```
+
+> **Ubuntu/Debian users:** `pip install` is blocked system-wide by default. Use `pipx` instead.
+> Install pipx first if needed: `sudo apt install pipx && pipx ensurepath`
+
+**Inside a virtual environment:**
+```bash
+pip install crux-inject
+```
+
+> **Platform support:** Linux and macOS only. Windows users: use WSL2.
+
+---
+
+## Quick Start
+
+**1. Add credentials for a profile:**
+```bash
+crux add --profile my-server
+
+# Adding credentials → profile: my-server
+#   Key name: VM_IP
+#   Value: 10.0.1.100
+#   Key name: VM_USER
+#   Value: admin
+#   Key name: VM_PASS
+#   Value: ••••••••••
+```
+
+**2. Switch to that profile:**
+```bash
+crux use my-server
+source ~/.bashrc
+```
+
+**3. Your creds are now live as env vars:**
+```bash
+echo $VM_IP      # 10.0.1.100
+echo $VM_USER    # admin
+```
+
+**4. Launch any AI tool with creds injected:**
+```bash
+crux run claude
+```
+
+Now tell Claude: *"SSH into $VM_USER@$VM_IP and check disk space"* — Claude runs the command, your password never enters the chat.
+
+---
+
+## Commands
+
+| Command | What it does |
+|---------|-------------|
+| `crux install` | One-time setup — adds shell hook to `~/.bashrc` |
+| `crux add --profile <name>` | Add credentials interactively (hidden input) |
+| `crux list` | Show all profiles and their key names |
+| `crux use <profile>` | Switch active profile |
+| `crux run <tool>` | Launch any tool with credentials injected |
+| `crux remove <key> --profile <name>` | Delete a credential |
+| `crux status` | Show current active profile and keys |
+| `crux doctor` | Health check — CRUX setup + AI tools |
+
+---
+
+## AI Tool Support
+
+| You type | CRUX resolves to |
+|----------|-----------------|
+| `crux run claude` | `claude` |
+| `crux run cursor` | `cursor-agent` |
+| `crux run gemini` | `gemini-cli` |
+| `crux run copilot` | `copilot` |
+| `crux run <anything>` | any binary in PATH |
+
+---
+
+## Multi-Profile Workflow
+
+Working across multiple environments? Create a profile per environment:
+
+```bash
+crux add --profile server-prod
+crux add --profile server-staging
+crux add --profile aws-dev
+
+crux list
+# Profiles: server-prod (active), server-staging, aws-dev
+
+crux use server-staging
+source ~/.bashrc
+crux run claude       # Claude now gets staging creds
+```
+
+---
+
+## How It Works
+
+CRUX adds a shell hook to `~/.bashrc`:
+
+```bash
+eval "$(crux _hook)"
+```
+
+On every terminal open, this hook:
+1. Exports credentials from the active profile as `export KEY=value`
+2. Adds all credential key names to `HISTIGNORE` so they never appear in shell history
+3. Runs `ulimit -c 0` to disable core dumps (prevents credentials leaking in crash files)
+
+Credentials are stored encrypted at `~/.crux/store.enc` using **Fernet (AES-128)**. The encryption key is stored in your OS keyring (Linux Secret Service / macOS Keychain) with a file-based fallback at `~/.crux/.key` for headless servers.
+
+---
+
+## Security
+
+**What CRUX protects:**
+- Credentials never typed into AI chat
+- Credentials never in shell history
+- Credentials never in core dump files
+- Encrypted at rest (AES-128 Fernet)
+- OS keyring integration for key storage
+
+**Golden Rules:**
+1. Never ask AI to *reveal* a credential — ask it to *use* it: `ssh into $VM_USER@$VM_IP`
+2. Rotate credentials you shared in AI chat before using CRUX
+3. Use `sshpass -e` not `sshpass -p` (avoids password visible in `ps aux`)
+4. Use `sudo -E` to preserve env vars when sudoing
+5. Never commit `~/.crux/` to git — excluded by default in `.gitignore`
+
+See [SECURITY.md](SECURITY.md) for full details.
+
+---
+
+## Requirements
+
+- Python 3.10+
+- Linux / macOS
+
+---
+
+## License
+
+MIT © 2026 Akash Bhujbal

crux_inject-0.1.0/README.md

@@ -0,0 +1,185 @@
+# CRUX — Credential Runtime Unified eXecutor
+
+> Store credentials encrypted on your machine. Auto-inject into any AI tool. Credentials never appear in chat transcripts.
+
+---
+
+## The Problem
+
+Every day, developers paste passwords, API keys, and server credentials directly into AI chat tools to get help with tasks.
+
+```
+❌ You type in chat: "my server password is MyP@ssw0rd123, can you SSH in?"
+```
+
+That credential is now in the conversation — stored on Anthropic/OpenAI servers, visible in your transcript forever.
+
+**Real numbers (2026):**
+- 29 million secrets leaked on GitHub in 2025 — 34% YoY increase
+- 1.27 million AI-specific keys exposed (OpenAI, Anthropic, Hugging Face)
+- 3.2% secret-leak rate in AI-assisted commits vs 1.5% baseline
+
+---
+
+## The Solution
+
+CRUX stores your credentials encrypted locally and auto-injects them as environment variables into any AI tool.
+
+```
+✅ You say in chat: "SSH into $VM_USER@$VM_IP using $VM_PASS"
+```
+
+Claude/ChatGPT sees the variable names — never the actual values.
+
+---
+
+## Install
+
+**Linux / macOS (recommended):**
+```bash
+pipx install crux-inject
+crux install
+source ~/.bashrc
+```
+
+> **Ubuntu/Debian users:** `pip install` is blocked system-wide by default. Use `pipx` instead.
+> Install pipx first if needed: `sudo apt install pipx && pipx ensurepath`
+
+**Inside a virtual environment:**
+```bash
+pip install crux-inject
+```
+
+> **Platform support:** Linux and macOS only. Windows users: use WSL2.
+
+---
+
+## Quick Start
+
+**1. Add credentials for a profile:**
+```bash
+crux add --profile my-server
+
+# Adding credentials → profile: my-server
+#   Key name: VM_IP
+#   Value: 10.0.1.100
+#   Key name: VM_USER
+#   Value: admin
+#   Key name: VM_PASS
+#   Value: ••••••••••
+```
+
+**2. Switch to that profile:**
+```bash
+crux use my-server
+source ~/.bashrc
+```
+
+**3. Your creds are now live as env vars:**
+```bash
+echo $VM_IP      # 10.0.1.100
+echo $VM_USER    # admin
+```
+
+**4. Launch any AI tool with creds injected:**
+```bash
+crux run claude
+```
+
+Now tell Claude: *"SSH into $VM_USER@$VM_IP and check disk space"* — Claude runs the command, your password never enters the chat.
+
+---
+
+## Commands
+
+| Command | What it does |
+|---------|-------------|
+| `crux install` | One-time setup — adds shell hook to `~/.bashrc` |
+| `crux add --profile <name>` | Add credentials interactively (hidden input) |
+| `crux list` | Show all profiles and their key names |
+| `crux use <profile>` | Switch active profile |
+| `crux run <tool>` | Launch any tool with credentials injected |
+| `crux remove <key> --profile <name>` | Delete a credential |
+| `crux status` | Show current active profile and keys |
+| `crux doctor` | Health check — CRUX setup + AI tools |
+
+---
+
+## AI Tool Support
+
+| You type | CRUX resolves to |
+|----------|-----------------|
+| `crux run claude` | `claude` |
+| `crux run cursor` | `cursor-agent` |
+| `crux run gemini` | `gemini-cli` |
+| `crux run copilot` | `copilot` |
+| `crux run <anything>` | any binary in PATH |
+
+---
+
+## Multi-Profile Workflow
+
+Working across multiple environments? Create a profile per environment:
+
+```bash
+crux add --profile server-prod
+crux add --profile server-staging
+crux add --profile aws-dev
+
+crux list
+# Profiles: server-prod (active), server-staging, aws-dev
+
+crux use server-staging
+source ~/.bashrc
+crux run claude       # Claude now gets staging creds
+```
+
+---
+
+## How It Works
+
+CRUX adds a shell hook to `~/.bashrc`:
+
+```bash
+eval "$(crux _hook)"
+```
+
+On every terminal open, this hook:
+1. Exports credentials from the active profile as `export KEY=value`
+2. Adds all credential key names to `HISTIGNORE` so they never appear in shell history
+3. Runs `ulimit -c 0` to disable core dumps (prevents credentials leaking in crash files)
+
+Credentials are stored encrypted at `~/.crux/store.enc` using **Fernet (AES-128)**. The encryption key is stored in your OS keyring (Linux Secret Service / macOS Keychain) with a file-based fallback at `~/.crux/.key` for headless servers.
+
+---
+
+## Security
+
+**What CRUX protects:**
+- Credentials never typed into AI chat
+- Credentials never in shell history
+- Credentials never in core dump files
+- Encrypted at rest (AES-128 Fernet)
+- OS keyring integration for key storage
+
+**Golden Rules:**
+1. Never ask AI to *reveal* a credential — ask it to *use* it: `ssh into $VM_USER@$VM_IP`
+2. Rotate credentials you shared in AI chat before using CRUX
+3. Use `sshpass -e` not `sshpass -p` (avoids password visible in `ps aux`)
+4. Use `sudo -E` to preserve env vars when sudoing
+5. Never commit `~/.crux/` to git — excluded by default in `.gitignore`
+
+See [SECURITY.md](SECURITY.md) for full details.
+
+---
+
+## Requirements
+
+- Python 3.10+
+- Linux / macOS
+
+---
+
+## License
+
+MIT © 2026 Akash Bhujbal

crux_inject-0.1.0/crux/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

crux_inject-0.1.0/crux/aliases.py

@@ -0,0 +1,43 @@
+import shutil
+
+# Friendly name → list of real binary names to try (in order)
+AI_ALIASES: dict[str, list[str]] = {
+    "claude":      ["claude"],
+    "chatgpt":     ["codex", "chatgpt"],
+    "codex":       ["codex"],
+    "gemini":      ["gemini", "antigravity"],
+    "antigravity": ["antigravity"],
+    "copilot":     ["copilot", "gh-copilot"],
+    "cursor":      ["cursor-agent", "agent", "cursor"],
+}
+
+INSTALL_GUIDES: dict[str, str] = {
+    "claude":       "npm install -g @anthropic-ai/claude-code",
+    "codex":        "See https://learn.chatgpt.com/docs/codex/cli",
+    "gemini":       "npm install -g @google/gemini-cli",
+    "antigravity":  "npm install -g @google/antigravity-cli",
+    "copilot":      "npm install -g @github/copilot",
+    "cursor-agent": "curl https://cursor.com/install -fsS | bash",
+}
+
+
+def resolve_command(name: str) -> str | None:
+    """Resolve a friendly name or direct command to the actual binary in PATH."""
+    candidates = AI_ALIASES.get(name.lower(), [name])
+    for cmd in candidates:
+        if shutil.which(cmd):
+            return cmd
+    return None
+
+
+def get_install_guide(name: str) -> str:
+    key = name.lower()
+    candidates = AI_ALIASES.get(key, [key])
+    for c in candidates:
+        if c in INSTALL_GUIDES:
+            return INSTALL_GUIDES[c]
+    return f"Install '{name}' and make sure it is in your PATH"
+
+
+def get_all_known_tools() -> dict[str, list[str]]:
+    return AI_ALIASES

crux_inject-0.1.0/crux/doctor.py

@@ -0,0 +1,78 @@
+import shutil
+from pathlib import Path
+from crux.keyring_manager import is_keyring_available
+from crux.store import STORE_FILE, CRUX_DIR
+from crux.aliases import INSTALL_GUIDES
+
+SHELL_CONFIGS = [
+    Path.home() / ".bashrc",
+    Path.home() / ".zshrc",
+    Path.home() / ".config/fish/config.fish",
+]
+
+HOOK_MARKER = "crux _hook"
+
+AI_TOOLS: dict[str, dict] = {
+    "claude": {
+        "commands": ["claude"],
+        "install": INSTALL_GUIDES["claude"],
+    },
+    "codex (ChatGPT)": {
+        "commands": ["codex"],
+        "install": INSTALL_GUIDES["codex"],
+    },
+    "gemini": {
+        "commands": ["gemini", "antigravity"],
+        "install": INSTALL_GUIDES["gemini"],
+    },
+    "copilot": {
+        "commands": ["copilot"],
+        "install": INSTALL_GUIDES["copilot"],
+    },
+    "cursor": {
+        "commands": ["cursor-agent", "agent"],
+        "install": INSTALL_GUIDES["cursor-agent"],
+    },
+}
+
+
+def check_all() -> dict:
+    results: dict = {}
+
+    # Shell hook check
+    hook_found = False
+    for config in SHELL_CONFIGS:
+        if config.exists() and HOOK_MARKER in config.read_text():
+            hook_found = True
+            break
+    results["shell_hook"] = hook_found
+
+    # OS keyring
+    results["os_keyring"] = is_keyring_available()
+
+    # Store file
+    results["store"] = STORE_FILE.exists()
+
+    # Directory permissions
+    if CRUX_DIR.exists():
+        perms = oct(CRUX_DIR.stat().st_mode)[-3:]
+        results["permissions"] = perms == "700"
+    else:
+        results["permissions"] = False
+
+    # AI tool binaries
+    tool_results: dict = {}
+    for tool_name, info in AI_TOOLS.items():
+        found_cmd = None
+        for cmd in info["commands"]:
+            if shutil.which(cmd):
+                found_cmd = cmd
+                break
+        tool_results[tool_name] = {
+            "found": found_cmd is not None,
+            "command": found_cmd,
+            "install": info["install"],
+        }
+    results["tools"] = tool_results
+
+    return results

crux_inject-0.1.0/crux/injector.py

@@ -0,0 +1,99 @@
+import os
+import re
+import subprocess
+from crux.store import get_active_profile, get_profile_creds
+from crux.aliases import resolve_command
+
+# Key names must be safe shell identifiers — alphanumeric + underscore + hyphen only
+_SAFE_KEY_RE = re.compile(r'^[A-Za-z0-9_-]+$')
+
+
+def _sanitize_value(value: str) -> str:
+    """
+    Strip null bytes and control characters that could break shell export statements.
+    Newlines are replaced with a space — credentials should never contain them.
+    """
+    value = value.replace('\x00', '')          # strip null bytes
+    value = re.sub(r'[\r\n]', ' ', value)      # collapse newlines → space
+    value = re.sub(r'[\x01-\x1f\x7f]', '', value)  # strip other control chars
+    return value
+
+
+def _shell_single_quote(value: str) -> str:
+    """
+    Wrap value in single quotes with proper escaping.
+    Inside single quotes nothing is interpreted — the only character
+    that can break out is ' itself, which we replace with '\''.
+    """
+    return "'" + value.replace("'", "'\\''") + "'"
+
+
+def inject_and_run(command: str, args: tuple) -> tuple:
+    """
+    Inject credentials from the active profile as env vars and run the command.
+    Returns (subprocess.CompletedProcess | None, error_string | None).
+    """
+    profile = get_active_profile()
+
+    if not profile:
+        return None, "no_profile"
+
+    creds = get_profile_creds(profile)
+
+    if not creds:
+        return None, "empty_profile"
+
+    resolved = resolve_command(command)
+    if not resolved:
+        return None, f"not_found:{command}"
+
+    # Merge: system env + sanitized profile credentials
+    env = os.environ.copy()
+    env.update({k: _sanitize_value(v) for k, v in creds.items()})
+
+    full_cmd = [resolved] + list(args)
+
+    try:
+        result = subprocess.run(full_cmd, env=env)
+        return result, None
+    except FileNotFoundError:
+        return None, f"not_found:{resolved}"
+    except KeyboardInterrupt:
+        return None, "interrupted"
+
+
+def get_hook_exports() -> str:
+    """
+    Output shell export statements for the active profile.
+    Called by the shell hook: eval "$(crux _hook)"
+
+    Also outputs:
+    - HISTIGNORE patterns for every credential key (fix 1)
+    - ulimit -c 0 to disable core dumps (fix 4)
+    """
+    profile = get_active_profile()
+    if not profile:
+        return ""
+
+    creds = get_profile_creds(profile)
+    if not creds:
+        return ""
+
+    lines = []
+
+    # Export each credential — sanitized + single-quote escaped
+    for key, value in creds.items():
+        if not _SAFE_KEY_RE.match(key):
+            continue  # skip any key that somehow has unsafe characters
+        safe_value = _shell_single_quote(_sanitize_value(value))
+        lines.append(f"export {key}={safe_value}")
+
+    # Fix 1: Dynamically extend HISTIGNORE with every credential key name
+    # so commands containing these var names are never saved to history
+    histignore_patterns = ":".join(f"*{key}*" for key in creds.keys())
+    lines.append(f'export HISTIGNORE="${{HISTIGNORE}}:{histignore_patterns}"')
+
+    # Fix 4: Disable core dumps to prevent credentials leaking into crash files
+    lines.append("ulimit -c 0")
+
+    return "\n".join(lines)

crux_inject-0.1.0/crux/keyring_manager.py

@@ -0,0 +1,58 @@
+import os
+from pathlib import Path
+from cryptography.fernet import Fernet
+
+CRUX_DIR = Path.home() / ".crux"
+KEY_FILE = CRUX_DIR / ".key"
+SERVICE_NAME = "crux-cli"
+USERNAME = "master-key"
+
+
+def get_key() -> bytes:
+    """Get encryption key from OS keyring, fallback to file."""
+    try:
+        import keyring
+        key = keyring.get_password(SERVICE_NAME, USERNAME)
+        if key:
+            return key.encode()
+    except Exception as e:
+        import sys
+        print(f"[crux] OS keyring unavailable ({e}), using file-based fallback.", file=sys.stderr)
+
+    # Fallback: file-based key
+    if KEY_FILE.exists():
+        return KEY_FILE.read_bytes()
+
+    # Generate new key if nothing found
+    return _generate_key()
+
+
+def set_key(key: bytes):
+    """Store encryption key in OS keyring, fallback to file."""
+    try:
+        import keyring
+        keyring.set_password(SERVICE_NAME, USERNAME, key.decode())
+        return
+    except Exception as e:
+        import sys
+        print(f"[crux] OS keyring write failed ({e}), storing key in file.", file=sys.stderr)
+
+    # Fallback: file-based key
+    CRUX_DIR.mkdir(mode=0o700, exist_ok=True)
+    KEY_FILE.write_bytes(key)
+    KEY_FILE.chmod(0o600)
+
+
+def _generate_key() -> bytes:
+    key = Fernet.generate_key()
+    set_key(key)
+    return key
+
+
+def is_keyring_available() -> bool:
+    try:
+        import keyring
+        keyring.get_password("crux-test", "crux-test")
+        return True
+    except Exception:
+        return False