key-amnesia 0.3.2__py3-none-any.whl

key_amnesia/__init__.py

@@ -0,0 +1,8 @@
+"""key-amnesia: encrypted vault with human-prompt routing and output scrubbing."""
+
+from importlib.metadata import PackageNotFoundError, version as _version
+
+try:
+    __version__ = _version("key-amnesia")
+except PackageNotFoundError:
+    __version__ = "0.0.0"

key_amnesia/__main__.py

@@ -0,0 +1,4 @@
+from key_amnesia.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

key_amnesia/audit.py

@@ -0,0 +1,55 @@
+"""JSONL audit log — never records secret values."""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterable
+
+from key_amnesia.paths import audit_log_path
+
+VALID_ROUTES = frozenset({"inline", "spawned-console", "guard-session"})
+VALID_RESULTS = frozenset({"allowed", "denied", "timeout"})
+
+
+def _utc_now_iso() -> str:
+    return datetime.now(timezone.utc).replace(microsecond=0).isoformat()
+
+
+def audit_event(
+    action: str,
+    *,
+    secret_names: Iterable[str] | None = None,
+    command: list[str] | str | None = None,
+    route: str,
+    result: str,
+    reason: str = "",
+    path: Path | None = None,
+) -> dict[str, Any]:
+    """Append one audit record. Never includes secret values or passwords."""
+    if route not in VALID_ROUTES:
+        raise ValueError(f"Invalid audit route: {route}")
+    if result not in VALID_RESULTS:
+        raise ValueError(f"Invalid audit result: {result}")
+
+    if isinstance(command, list):
+        cmd_field: str | list[str] | None = list(command)
+    else:
+        cmd_field = command
+
+    record: dict[str, Any] = {
+        "timestamp": _utc_now_iso(),
+        "action": action,
+        "secret_names": list(secret_names or []),
+        "command": cmd_field,
+        "route": route,
+        "result": result,
+        "reason": reason,
+    }
+
+    p = path or audit_log_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    with p.open("a", encoding="utf-8") as f:
+        f.write(json.dumps(record, separators=(",", ":")) + "\n")
+    return record