promptlatch 0.2.1__tar.gz

promptlatch-0.2.1/.dockerignore

@@ -0,0 +1,15 @@
+.git
+.venv
+.pytest_cache
+.ruff_cache
+dist
+build
+*.egg-info
+__pycache__
+**/__pycache__/
+**/*.py[cod]
+node_modules
+site/screenshots
+*.log
+.env
+.env.*

promptlatch-0.2.1/.github/dependabot.yml

@@ -0,0 +1,44 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    versioning-strategy: lockfile-only
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      actions:
+        patterns: ["*"]
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    ignore:
+      - dependency-name: python
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+    open-pull-requests-limit: 5

promptlatch-0.2.1/.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - name: Install Python
+        env:
+          PYTHON_VERSION: ${{ matrix.python-version }}
+        run: uv python install "$PYTHON_VERSION"
+      - name: Sync environment
+        env:
+          PYTHON_VERSION: ${{ matrix.python-version }}
+        run: uv sync --python "$PYTHON_VERSION" --extra dev --locked
+      - run: uv run pytest
+
+  package:
+    name: package
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      - run: uv sync --extra dev --group audit --locked
+      - run: uv run scripts/check_release.py
+      - run: uv run scripts/audit_secrets.py
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run pyright src tests scripts
+      - run: uv run pip-audit
+      - run: uv build
+      - run: helm lint ./charts/promptlatch
+      - run: helm template promptlatch ./charts/promptlatch >/dev/null
+      - run: uv run scripts/check_helm.py
+      - run: docker build -t promptlatch:ci .
+      - run: docker run --rm --entrypoint promptlatch promptlatch:ci version

promptlatch-0.2.1/.github/workflows/codeql.yml

@@ -0,0 +1,32 @@
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: analyze
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # Upload CodeQL results.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        with:
+          languages: python
+          build-mode: none
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4

promptlatch-0.2.1/.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: review
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

promptlatch-0.2.1/.github/workflows/release.yml

@@ -0,0 +1,168 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish
+        required: true
+        type: string
+
+env:
+  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+  IMAGE_NAME: ghcr.io/bvolpato/promptlatch
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write # Publish provenance for release artifacts.
+      contents: read
+      id-token: write # Sign provenance through GitHub OIDC.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.RELEASE_TAG }}
+      - name: Verify release tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_REPOSITORY" != "bvolpato/promptlatch" ]; then
+            echo "release must run from bvolpato/promptlatch" >&2
+            exit 1
+          fi
+          ref_json=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG")
+          if [ "$(jq -r '.object.type' <<<"$ref_json")" != "tag" ]; then
+            echo "release tag must be annotated and signed" >&2
+            exit 1
+          fi
+          tag_sha=$(jq -r '.object.sha' <<<"$ref_json")
+          if [ "$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$tag_sha" --jq '.verification.verified')" != "true" ]; then
+            echo "release tag signature is not verified" >&2
+            exit 1
+          fi
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          if ! git merge-base --is-ancestor "$RELEASE_TAG^{commit}" origin/main; then
+            echo "release tag must point to a commit on main" >&2
+            exit 1
+          fi
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: false
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      - run: uv sync --extra dev --group audit --locked
+      - run: uv run scripts/check_release.py --tag "$RELEASE_TAG"
+      - run: uv run scripts/audit_secrets.py
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run pyright src tests scripts
+      - run: uv run pip-audit
+      - run: uv run pytest
+      - run: uv build
+      - run: helm lint ./charts/promptlatch
+      - run: helm template promptlatch ./charts/promptlatch >/dev/null
+      - run: uv run scripts/check_helm.py
+      - run: helm package charts/promptlatch --destination dist
+      - run: cd dist && sha256sum -- ./*.whl ./*.tar.gz ./*.tgz > SHA256SUMS
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-dist
+          path: dist/*
+          if-no-files-found: error
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-dist
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+
+  publish-pypi:
+    name: publish-pypi
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/promptlatch
+    permissions:
+      id-token: write # Exchange GitHub OIDC identity for a short-lived PyPI token.
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  publish:
+    name: publish
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Create or repair GitHub release assets.
+      packages: write # Push versioned GHCR image.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.RELEASE_TAG }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-dist
+          path: dist
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        id: docker-meta
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ env.RELEASE_TAG }}
+            type=semver,pattern={{version}},value=${{ env.RELEASE_TAG }}
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          provenance: mode=max
+          push: true
+          sbom: true
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$RELEASE_TAG" dist/* \
+              --repo "$GITHUB_REPOSITORY" \
+              --clobber
+            gh release edit "$RELEASE_TAG" \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "PromptLatch ${RELEASE_TAG#v}"
+          else
+            gh release create "$RELEASE_TAG" dist/* \
+              --repo "$GITHUB_REPOSITORY" \
+              --title "PromptLatch ${RELEASE_TAG#v}" \
+              --generate-notes \
+              --verify-tag
+          fi

promptlatch-0.2.1/.gitignore

@@ -0,0 +1,16 @@
+.DS_Store
+.pytest_cache/
+.ruff_cache/
+.venv/
+__pycache__/
+*.egg-info/
+dist/
+build/
+.coverage
+htmlcov/
+node_modules/
+site/screenshots/
+*.log
+.env
+.env.*
+!.env.example

promptlatch-0.2.1/AGENTS.md

@@ -0,0 +1,15 @@
+Cut verbosity. Use concise, direct status and docs.
+
+Rules:
+- Drop articles, filler, pleasantries, hedging.
+- Fragments OK. Technical terms exact. Code blocks unchanged.
+- No em dashes.
+
+Python one-off scripts:
+- Use `uv` script metadata.
+- Run with `uv run scripts/name.py`.
+- Do not ask users to install packages globally.
+
+Testing:
+- Verify functional changes with tests.
+- Use browser checks for static site changes when practical.

promptlatch-0.2.1/AGENTS_DEPLOY.md

@@ -0,0 +1,48 @@
+# Deploy
+
+PromptLatch ships through signed Git tag, GitHub Actions, Homebrew tap, GitHub Pages, and local user service.
+
+## Release
+
+1. Keep same version in `pyproject.toml`, `src/promptlatch/version.py`, Helm chart metadata, Helm image tag, docs, site, and `uv.lock`.
+2. Run `AGENTS_TESTING.md` checks.
+3. Confirm GitHub repository is `bvolpato/promptlatch`; release workflow rejects any
+   other namespace so image and asset URLs cannot diverge.
+4. Commit and push release metadata to `main`.
+5. Wait for `ci` and `codeql` on pushed commit.
+6. Create and push signed tag:
+
+```bash
+VERSION=0.2.1
+git tag -s "v${VERSION}" -m "PromptLatch ${VERSION}"
+git push origin "v${VERSION}"
+```
+
+Tag triggers `.github/workflows/release.yml`. Workflow publishes Python distributions to PyPI,
+GitHub assets, and GHCR image.
+
+## Homebrew
+
+After release assets exist, update `Formula/promptlatch.rb` in
+`/home/bruno/githubworkspace/homebrew-tap` with release source URL, checksum, and Python
+resources. Reject generated resource versions uploaded less than three days ago; use tested
+`uv.lock` version until cooldown expires. Test formula before signed commit and push.
+
+## GitHub Pages
+
+Publish exact contents of `site/` to root of `gh-pages`, commit, and push. Pages source is `gh-pages` branch root.
+
+## Local service
+
+Restart installed source service after release. It listens on `127.0.0.1:8000`:
+
+```bash
+systemctl --user restart promptlatch.service
+```
+
+OpenCode uses `promptlatch-local` on `127.0.0.1:8787`. Recreate that container from released
+GHCR image with loopback binding, `unless-stopped`, raw-request debug off, and configured target
+base URL matching OpenCode `X-Target-Base-URL`. Keep upstream key in OpenCode header config; do not
+put it in container environment.
+
+Never persist or print upstream credentials during deployment checks.

promptlatch-0.2.1/AGENTS_MONITOR.md

@@ -0,0 +1,39 @@
+# Monitor
+
+Verify each published surface after deployment.
+
+## GitHub
+
+- `ci`, `codeql`, and `release` workflows passed for release commit/tag.
+- Release includes wheel, source archive, Helm chart, and `SHA256SUMS`.
+- Downloaded assets match `SHA256SUMS`; build provenance verifies.
+- Dependabot, secret-scanning, and code-scanning alerts remain empty.
+
+## Container and Helm
+
+```bash
+docker pull ghcr.io/bvolpato/promptlatch:0.2.1
+docker run --rm --entrypoint promptlatch ghcr.io/bvolpato/promptlatch:0.2.1 version
+helm lint ./charts/promptlatch
+```
+
+## Homebrew and site
+
+- `brew info bvolpato/tap/promptlatch` reports release version.
+- Formula install/test passes.
+- `https://bvolpato.github.io/promptlatch/` matches `site/` and loads assets.
+
+## Local service
+
+```bash
+systemctl --user is-enabled promptlatch.service
+systemctl --user is-active promptlatch.service
+curl --retry 10 --retry-connrefused --retry-delay 1 -fsS http://127.0.0.1:8000/healthz
+curl --retry 10 --retry-connrefused --retry-delay 1 -fsS http://127.0.0.1:8000/openapi.json | jq -r .info.version
+docker exec promptlatch-local promptlatch version
+curl --retry 10 --retry-connrefused --retry-delay 1 -fsS http://127.0.0.1:8787/healthz
+```
+
+Both health endpoints must report redaction enabled, `detect-secrets`, and `telemetry:false`.
+Both runtimes must report release version. `promptlatch-local` must bind loopback, restart unless
+stopped, and run with raw-request debug off.

promptlatch-0.2.1/AGENTS_TESTING.md

@@ -0,0 +1,31 @@
+# Testing
+
+Run from repository root. Never use real credentials in tests or logs.
+
+```bash
+uv sync --extra dev --group audit --locked
+uv run scripts/check_release.py
+uv run scripts/audit_secrets.py
+uv run ruff check .
+uv run ruff format --check .
+uv run pyright src tests scripts
+uv run pytest
+uv run pip-audit
+uv build
+helm lint ./charts/promptlatch
+helm template promptlatch ./charts/promptlatch >/dev/null
+uv run scripts/check_helm.py
+docker build -t promptlatch:release-check .
+docker run --rm --entrypoint promptlatch promptlatch:release-check version
+```
+
+Before release, also run checks under Python 3.12, 3.13, and 3.14:
+
+```bash
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py312 uv sync --python 3.12 --extra dev --locked
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py312 uv run pytest
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py313 uv sync --python 3.13 --extra dev --locked
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py313 uv run pytest
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py314 uv sync --python 3.14 --extra dev --locked
+UV_PROJECT_ENVIRONMENT=/tmp/promptlatch-py314 uv run pytest
+```

promptlatch-0.2.1/CONTRIBUTING.md

@@ -0,0 +1,70 @@
+# Contributing
+
+Changes to redaction, forwarding, config, logs, or tracing need an explicit privacy review.
+
+## Setup
+
+```bash
+uv sync --extra dev --group audit --locked
+uv run promptlatch doctor
+```
+
+## Checks
+
+```bash
+uv run scripts/audit_secrets.py
+uv run ruff check .
+uv run pytest
+uv build
+```
+
+## Release
+
+Release tags create GitHub releases through `.github/workflows/release.yml`.
+
+```bash
+VERSION=0.2.1
+uv run scripts/check_release.py --tag "v${VERSION}"
+uv run scripts/audit_secrets.py
+uv run ruff check .
+uv run pytest
+uv build
+git tag -s "v${VERSION}" -m "PromptLatch ${VERSION}"
+git push origin main "v${VERSION}"
+```
+
+Before tagging, keep these versions identical:
+
+- `pyproject.toml`
+- `src/promptlatch/version.py`
+- `charts/promptlatch/Chart.yaml`
+- `charts/promptlatch/values.yaml`
+- `uv.lock`
+
+Release workflow reruns checks, builds source, wheel, and Helm artifacts, writes
+`SHA256SUMS`, attests build provenance, publishes SBOM-backed container image, and
+uploads release assets.
+
+If publishing fails after release creation, fix workflow on `main` and rerun
+existing immutable tag:
+
+```bash
+gh workflow run release.yml --ref main -f tag="v${VERSION}"
+```
+
+## Secret hygiene
+
+- Do not put real secrets, customer prompts, credentials, or private config in issues, tests, docs, commits, or screenshots.
+- Use split fixture strings like `"sk-" + "FixtureToken..."` when tests need provider-shaped values.
+- Prefer full masking in examples: `[REDACTED_SECRET]`.
+- Run secret audit before opening a pull request.
+
+## Redaction rules
+
+- Keep detection local and deterministic. Do not add model calls.
+- Do not enable entropy-only detectors without tightly bounded false positives.
+- Tests for new provider patterns must prove full redaction and comma-separated redaction.
+
+## Emergency request tracing
+
+`promptlatch serve --debug-requests` logs raw request bodies. Use only with local fixture values.

promptlatch-0.2.1/Dockerfile

@@ -0,0 +1,20 @@
+FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim@sha256:e5b65587bce7de595f299855d7385fe7fca39b8a74baa261ba1b7147afa78e58 AS builder
+
+WORKDIR /app
+COPY pyproject.toml uv.lock README.md ./
+COPY src ./src
+RUN uv sync --no-dev --no-editable --locked
+
+FROM python:3.12-slim@sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PROMPTLATCH_HOST=0.0.0.0 \
+    PROMPTLATCH_PORT=8000
+
+WORKDIR /app
+RUN groupadd --gid 10001 promptlatch \
+    && useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin promptlatch
+COPY --from=builder --chown=promptlatch:promptlatch /app /app
+USER 10001:10001
+EXPOSE 8000
+CMD ["promptlatch", "serve", "--host", "0.0.0.0", "--port", "8000"]

promptlatch-0.2.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PromptLatch contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.