janus-sec 0.1.0__tar.gz

janus_sec-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,30 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package and test dependencies
+        run: |
+          pip install -e .
+          pip install pytest pytest-asyncio
+
+      - name: Run tests
+        run: pytest -v

janus_sec-0.1.0/.gitignore

@@ -0,0 +1,218 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml

janus_sec-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 A Sivasubramanian Manoj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

janus_sec-0.1.0/PKG-INFO

@@ -0,0 +1,168 @@
+Metadata-Version: 2.4
+Name: janus-sec
+Version: 0.1.0
+Summary: A terminal-first credential exposure auditor
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.10
+Requires-Dist: textual>=0.58
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Description-Content-Type: text/markdown
+
+# janus-sec
+
+![Tests](https://github.com/A-S-Manoj/janus-sec/actions/workflows/tests.yml/badge.svg)
+
+**A terminal-first credential exposure auditor.**
+
+Your SSH keys, AWS credentials, and kube config are only as safe as their file
+permissions. A `chmod 644` typo, a bad tarball extraction, or a cloud sync
+tool can quietly leave a private key readable by every user on your machine
+— and there's usually no warning until something goes wrong.
+
+`janus-sec` scans the credential files you already have, tells you exactly
+what's wrong and why it matters, and fixes it with one confirmed keystroke.
+Nothing leaves your machine — no network calls, no file content is ever
+read, no `sudo`.
+
+```
+$ janus-sec
+Scanned 4 file(s), 8 not present.
+
+[HIGH] /home/user/.ssh/id_rsa
+    Issue:  world_readable (mode 644)
+    Why:    This file is readable by any local user on this machine.
+            Credential files should only be readable by their owner.
+    Fix:    chmod 600 /home/user/.ssh/id_rsa
+
+[MEDIUM] /home/user/.aws/credentials
+    Issue:  group_readable (mode 640)
+    Why:    This file is readable by group 'docker', which is not your
+            primary group. Other accounts in that group can read this file.
+    Fix:    chmod 600 /home/user/.aws/credentials
+
+2 finding(s) total, 1 HIGH risk.
+```
+
+## Why this exists
+
+The underlying check here is genuinely simple — `find ~/.ssh -perm /077`
+does most of the mechanical work in one line. That's not the point.
+The gap `janus-sec` closes isn't "how do I check this," it's "I never
+thought to check this, and if I did, I wouldn't trust a one-off command
+to tell me what to do about it or keep a record that I did it."
+
+Concretely, what a one-liner doesn't give you:
+- **An explanation.** `-rw-r--r--` means nothing to most people at a
+  glance. "This private key is readable by any local user on this
+  machine" changes behavior.
+- **The right fix for each file type.** SSH keys, `known_hosts`, AWS
+  credentials, and kube configs don't all want the same target mode.
+- **A safe way to apply it.** Confirmation by default, `--dry-run` to
+  preview, and a re-check immediately before writing (the file you
+  looked at when scanning might not be the file you're about to change).
+- **A record.** An append-only audit log of every fix, so "what did I
+  change and when" has a real answer.
+- **A CI gate.** `--ci` exits non-zero on any HIGH-risk finding, so this
+  can fail a pipeline, not just print a warning nobody reads.
+
+## What it checks
+
+| Check | Risk | Auto-fix? |
+|---|---|---|
+| World-readable / world-writable | HIGH | Yes |
+| Owned by a different user | HIGH | No — would require `sudo`, out of scope |
+| Group-readable (non-primary group) | MEDIUM | Yes |
+| Symlink pointing outside its expected directory | MEDIUM | No — target choice is a judgment call |
+
+Scans by default: `~/.ssh/*`, `~/.aws/*`, `~/.kube/config`, `~/.npmrc`,
+`~/.git-credentials`, `~/.docker/config.json`. Missing files are silently
+skipped, not errors — most people won't have all of these.
+
+## Safety properties
+
+- **No network access, ever.**
+- **Never reads file contents** — only metadata (permissions, ownership).
+  It can't tell you if a secret has leaked; it tells you if the file is
+  more exposed than it should be.
+- **Never elevates privileges.** No `sudo`, no `chown`. If a fix would
+  require that, `janus-sec` reports the problem and stops — it doesn't
+  attempt it.
+- **Every fix requires confirmation** (or an explicit `--yes` for
+  scripted use), and `--dry-run` previews changes with zero side effects.
+- **Append-only audit log** of every fix applied, at
+  `~/.local/state/janus-sec/audit.log`.
+
+## Install
+
+Not yet published to PyPI — install from source for now:
+
+```bash
+git clone https://github.com/A-S-Manoj/janus-sec.git
+cd janus-sec
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e .
+```
+
+## Usage
+
+```bash
+# Scan (also the default with no arguments - read-only, safe to run any time)
+janus-sec
+janus-sec scan
+
+# Interactive TUI
+janus-sec tui
+
+# Machine-readable output
+janus-sec scan --format json
+
+# CI mode: exit 1 if any HIGH-risk finding exists
+janus-sec scan --ci
+
+# Fix everything fixable, with confirmation
+janus-sec fix
+
+# Fix one specific file
+janus-sec fix ~/.ssh/id_rsa
+
+# Preview fixes without changing anything
+janus-sec fix --dry-run
+
+# Skip the confirmation prompt (for scripts)
+janus-sec fix --yes
+```
+
+## Configuration
+
+`~/.config/janus-sec/config.toml` (optional — everything works with no
+config file at all):
+
+```toml
+# Suppress a specific check on a specific file - not the whole file,
+# just that one issue, so other real problems on it still get caught.
+[[ignore]]
+path = "/home/user/.ssh/known_hosts"
+check_type = "group_readable"
+note = "shared dev box, group access is intentional"
+
+# Treat a group as known-safe, machine-wide.
+[[allowlist]]
+group = "wheel"
+action = "suppress"   # or "downgrade_to_low"
+note = "trusted admin group on my machines"
+```
+
+## Development
+
+Same setup as above, plus test dependencies:
+
+```bash
+pip install pytest pytest-asyncio
+pytest -v
+```
+
+## License
+
+MIT

janus_sec-0.1.0/README.md

@@ -0,0 +1,156 @@
+# janus-sec
+
+![Tests](https://github.com/A-S-Manoj/janus-sec/actions/workflows/tests.yml/badge.svg)
+
+**A terminal-first credential exposure auditor.**
+
+Your SSH keys, AWS credentials, and kube config are only as safe as their file
+permissions. A `chmod 644` typo, a bad tarball extraction, or a cloud sync
+tool can quietly leave a private key readable by every user on your machine
+— and there's usually no warning until something goes wrong.
+
+`janus-sec` scans the credential files you already have, tells you exactly
+what's wrong and why it matters, and fixes it with one confirmed keystroke.
+Nothing leaves your machine — no network calls, no file content is ever
+read, no `sudo`.
+
+```
+$ janus-sec
+Scanned 4 file(s), 8 not present.
+
+[HIGH] /home/user/.ssh/id_rsa
+    Issue:  world_readable (mode 644)
+    Why:    This file is readable by any local user on this machine.
+            Credential files should only be readable by their owner.
+    Fix:    chmod 600 /home/user/.ssh/id_rsa
+
+[MEDIUM] /home/user/.aws/credentials
+    Issue:  group_readable (mode 640)
+    Why:    This file is readable by group 'docker', which is not your
+            primary group. Other accounts in that group can read this file.
+    Fix:    chmod 600 /home/user/.aws/credentials
+
+2 finding(s) total, 1 HIGH risk.
+```
+
+## Why this exists
+
+The underlying check here is genuinely simple — `find ~/.ssh -perm /077`
+does most of the mechanical work in one line. That's not the point.
+The gap `janus-sec` closes isn't "how do I check this," it's "I never
+thought to check this, and if I did, I wouldn't trust a one-off command
+to tell me what to do about it or keep a record that I did it."
+
+Concretely, what a one-liner doesn't give you:
+- **An explanation.** `-rw-r--r--` means nothing to most people at a
+  glance. "This private key is readable by any local user on this
+  machine" changes behavior.
+- **The right fix for each file type.** SSH keys, `known_hosts`, AWS
+  credentials, and kube configs don't all want the same target mode.
+- **A safe way to apply it.** Confirmation by default, `--dry-run` to
+  preview, and a re-check immediately before writing (the file you
+  looked at when scanning might not be the file you're about to change).
+- **A record.** An append-only audit log of every fix, so "what did I
+  change and when" has a real answer.
+- **A CI gate.** `--ci` exits non-zero on any HIGH-risk finding, so this
+  can fail a pipeline, not just print a warning nobody reads.
+
+## What it checks
+
+| Check | Risk | Auto-fix? |
+|---|---|---|
+| World-readable / world-writable | HIGH | Yes |
+| Owned by a different user | HIGH | No — would require `sudo`, out of scope |
+| Group-readable (non-primary group) | MEDIUM | Yes |
+| Symlink pointing outside its expected directory | MEDIUM | No — target choice is a judgment call |
+
+Scans by default: `~/.ssh/*`, `~/.aws/*`, `~/.kube/config`, `~/.npmrc`,
+`~/.git-credentials`, `~/.docker/config.json`. Missing files are silently
+skipped, not errors — most people won't have all of these.
+
+## Safety properties
+
+- **No network access, ever.**
+- **Never reads file contents** — only metadata (permissions, ownership).
+  It can't tell you if a secret has leaked; it tells you if the file is
+  more exposed than it should be.
+- **Never elevates privileges.** No `sudo`, no `chown`. If a fix would
+  require that, `janus-sec` reports the problem and stops — it doesn't
+  attempt it.
+- **Every fix requires confirmation** (or an explicit `--yes` for
+  scripted use), and `--dry-run` previews changes with zero side effects.
+- **Append-only audit log** of every fix applied, at
+  `~/.local/state/janus-sec/audit.log`.
+
+## Install
+
+Not yet published to PyPI — install from source for now:
+
+```bash
+git clone https://github.com/A-S-Manoj/janus-sec.git
+cd janus-sec
+python3 -m venv .venv && source .venv/bin/activate
+pip install -e .
+```
+
+## Usage
+
+```bash
+# Scan (also the default with no arguments - read-only, safe to run any time)
+janus-sec
+janus-sec scan
+
+# Interactive TUI
+janus-sec tui
+
+# Machine-readable output
+janus-sec scan --format json
+
+# CI mode: exit 1 if any HIGH-risk finding exists
+janus-sec scan --ci
+
+# Fix everything fixable, with confirmation
+janus-sec fix
+
+# Fix one specific file
+janus-sec fix ~/.ssh/id_rsa
+
+# Preview fixes without changing anything
+janus-sec fix --dry-run
+
+# Skip the confirmation prompt (for scripts)
+janus-sec fix --yes
+```
+
+## Configuration
+
+`~/.config/janus-sec/config.toml` (optional — everything works with no
+config file at all):
+
+```toml
+# Suppress a specific check on a specific file - not the whole file,
+# just that one issue, so other real problems on it still get caught.
+[[ignore]]
+path = "/home/user/.ssh/known_hosts"
+check_type = "group_readable"
+note = "shared dev box, group access is intentional"
+
+# Treat a group as known-safe, machine-wide.
+[[allowlist]]
+group = "wheel"
+action = "suppress"   # or "downgrade_to_low"
+note = "trusted admin group on my machines"
+```
+
+## Development
+
+Same setup as above, plus test dependencies:
+
+```bash
+pip install pytest pytest-asyncio
+pytest -v
+```
+
+## License
+
+MIT

janus_sec-0.1.0/janus_sec/audit.py

@@ -0,0 +1,84 @@
+"""Append-only audit log of every fix applied.
+
+Deliberately plain text, one line per entry - meant to be human-readable
+(tail -f it, grep it) rather than a structured format, since machine-
+readable output already exists separately via --format json on scan.
+
+Never logs file CONTENTS, only the operation metadata: what path, what
+mode changed to what, when, and how (cli vs tui).
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+@dataclass(frozen=True, slots=True)
+class AuditLogEntry:
+    timestamp: str  # ISO 8601 UTC
+    path: str
+    before_mode_octal: str
+    after_mode_octal: str
+    applied_via: str  # "cli" | "tui"
+
+    def to_line(self) -> str:
+        return (
+            f"{self.timestamp}  chmod  {self.path}  "
+            f"{self.before_mode_octal} -> {self.after_mode_octal}  "
+            f"(via {self.applied_via})"
+        )
+
+
+def default_log_path() -> Path:
+    # XDG state directory - the conventional home for append-only logs
+    # and other "history of what happened" data, distinct from config
+    # (XDG_CONFIG_HOME) and cache (XDG_CACHE_HOME).
+    xdg_state = os.environ.get("XDG_STATE_HOME")
+    base = Path(xdg_state) if xdg_state else Path.home() / ".local" / "state"
+    return base / "janus-sec" / "audit.log"
+
+
+def append_entry(
+    path: str,
+    before_mode_octal: str,
+    after_mode_octal: str,
+    applied_via: str,
+    log_path: Path | None = None,
+) -> AuditLogEntry:
+    """Append one entry to the audit log, creating the log file/directory
+    if this is the first entry ever written.
+    """
+    if log_path is None:
+        log_path = default_log_path()
+
+    entry = AuditLogEntry(
+        timestamp=datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        path=path,
+        before_mode_octal=before_mode_octal,
+        after_mode_octal=after_mode_octal,
+        applied_via=applied_via,
+    )
+
+    log_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(log_path, "a", encoding="utf-8") as f:
+        f.write(entry.to_line() + "\n")
+
+    return entry
+
+
+def read_entries(log_path: Path | None = None) -> list[str]:
+    """Read raw log lines, most recent last (natural file order).
+    Returns an empty list if the log doesn't exist yet - no entries
+    logged is not an error.
+    """
+    if log_path is None:
+        log_path = default_log_path()
+
+    if not log_path.exists():
+        return []
+
+    with open(log_path, encoding="utf-8") as f:
+        return [line.rstrip("\n") for line in f if line.strip()]

janus_sec-0.1.0/janus_sec/checks/allowlist.toml

@@ -0,0 +1,16 @@
+# Known-benign group-ownership patterns.
+#
+# Each [[pattern]] suppresses (or downgrades) a group-readable finding
+# when the file's group matches `group` (and, if given, the OS matches
+# `os`). Left empty for now - only add entries once verified against
+# real machines, not speculatively.
+#
+# Example of the shape an entry will take, once verified:
+#
+# [[pattern]]
+# os = "linux"
+# group = "wheel"
+# action = "suppress"   # "suppress" or "downgrade_to_low"
+# note = "why this is considered safe"
+
+patterns = []