sanity-guard 0.1.0__tar.gz

sanity_guard-0.1.0/.env.example

@@ -0,0 +1,5 @@
+# Sanity — required environment variables
+# Copy this file to .env and fill in your API key
+#
+# Get a free Groq API key at: https://console.groq.com
+GROQ_API_KEY=your_groq_api_key_here  # sanity: ignore

sanity_guard-0.1.0/.gitignore

@@ -0,0 +1,32 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.egg-info/
+dist/
+build/
+*.egg
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Environment
+.env
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+.pytest_cache/
+htmlcov/
+.coverage

sanity_guard-0.1.0/.sanity/override_log.jsonl

@@ -0,0 +1 @@
+{"timestamp": 1787317708.6539652, "files_changed": ["danger.sql"], "overridden_checks": ["dangerous_commands"]}

sanity_guard-0.1.0/PKG-INFO

@@ -0,0 +1,67 @@
+Metadata-Version: 2.4
+Name: sanity-guard
+Version: 0.1.0
+Summary: Pre-commit risk checker for AI-generated code changes
+Author: Jinang
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.1
+Requires-Dist: gitpython>=3.1
+Requires-Dist: python-dotenv>=1.0
+Requires-Dist: groq>=0.9
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Requires-Dist: pytest-cov>=4.1; extra == "dev"
+
+# Sanity - Pre-commit Risk Checker
+
+Sanity acts as a pre-commit risk checker for AI-generated code changes. It evaluates code additions for dangerous statements, exposed secrets, and scope drift, and safely blocks risky commits.
+
+## Safety Nets & Snapshots
+Whenever a commit is allowed (whether deemed safe, or overridden via `--force`), Sanity automatically creates a lightweight local git tag (e.g. `sanity-snapshot-20260823-153012`) pointing to the commit *before* the new changes. This ensures that even if an AI agent makes a destructive commit, you can easily view your history and roll it back using `sanity rollback <number>`.
+
+> **Note**: `sanity-snapshot-*` tags are intended strictly as local safety nets. Git naturally keeps tags local during a standard `git push`, so they won't clutter your remote repository unless you explicitly run `git push --tags`.
+
+## What it catches
+
+- **Mass deletions** -- flags commits that delete far more code than they add
+- **Leaked secrets** -- detects API keys, AWS credentials, private keys
+- **Dangerous commands** -- catches `rm -rf`, `DROP TABLE`, force-push scripts
+- **Scope creep** -- uses LLM analysis to verify changes match the stated task
+- **Auto-snapshots** -- every commit gets a safety snapshot for easy rollback
+
+## Quick start
+
+```bash
+# Install
+pip install -e .
+
+# Set up your Groq API key (free tier)
+cp .env.example .env
+# Edit .env with your key from https://console.groq.com
+
+# Install the pre-commit hook in your repo
+sanity init
+
+# Manually check staged changes
+sanity check
+
+# Rollback to a previous safe state
+sanity rollback
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `sanity init` | Install pre-commit hook in current repo |
+| `sanity check` | Run safety checks on staged diff |
+| `sanity rollback` | Revert to a previous safe snapshot |
+| `sanity config` | Configure thresholds and toggle checks |
+
+## Requirements
+
+- Python 3.11+
+- Git
+- Groq API key (free, no credit card needed)

sanity_guard-0.1.0/README.md

@@ -0,0 +1,51 @@
+# Sanity - Pre-commit Risk Checker
+
+Sanity acts as a pre-commit risk checker for AI-generated code changes. It evaluates code additions for dangerous statements, exposed secrets, and scope drift, and safely blocks risky commits.
+
+## Safety Nets & Snapshots
+Whenever a commit is allowed (whether deemed safe, or overridden via `--force`), Sanity automatically creates a lightweight local git tag (e.g. `sanity-snapshot-20260823-153012`) pointing to the commit *before* the new changes. This ensures that even if an AI agent makes a destructive commit, you can easily view your history and roll it back using `sanity rollback <number>`.
+
+> **Note**: `sanity-snapshot-*` tags are intended strictly as local safety nets. Git naturally keeps tags local during a standard `git push`, so they won't clutter your remote repository unless you explicitly run `git push --tags`.
+
+## What it catches
+
+- **Mass deletions** -- flags commits that delete far more code than they add
+- **Leaked secrets** -- detects API keys, AWS credentials, private keys
+- **Dangerous commands** -- catches `rm -rf`, `DROP TABLE`, force-push scripts
+- **Scope creep** -- uses LLM analysis to verify changes match the stated task
+- **Auto-snapshots** -- every commit gets a safety snapshot for easy rollback
+
+## Quick start
+
+```bash
+# Install
+pip install -e .
+
+# Set up your Groq API key (free tier)
+cp .env.example .env
+# Edit .env with your key from https://console.groq.com
+
+# Install the pre-commit hook in your repo
+sanity init
+
+# Manually check staged changes
+sanity check
+
+# Rollback to a previous safe state
+sanity rollback
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `sanity init` | Install pre-commit hook in current repo |
+| `sanity check` | Run safety checks on staged diff |
+| `sanity rollback` | Revert to a previous safe snapshot |
+| `sanity config` | Configure thresholds and toggle checks |
+
+## Requirements
+
+- Python 3.11+
+- Git
+- Groq API key (free, no credit card needed)

sanity_guard-0.1.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["setuptools>=68.0", "setuptools-scm>=8.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sanity-guard"
+version = "0.1.0"
+description = "Pre-commit risk checker for AI-generated code changes"
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [{name = "Jinang"}]
+
+dependencies = [
+    "click>=8.1",
+    "gitpython>=3.1",
+    "python-dotenv>=1.0",
+    "groq>=0.9",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4",
+    "pytest-cov>=4.1",
+]
+
+[project.scripts]
+sanity = "sanity.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

sanity_guard-0.1.0/s -ExecutionPolicy RemoteSigned) ; (& c/357/200/272UsersJinangDocumentsantigravityblissful-volta.venvScriptsActivate.ps1)"

@@ -0,0 +1,156 @@
+warning: in the working copy of 'src/sanity/checks.py', LF will be replaced by CRLF the next time Git touches it
+diff --git a/src/sanity/checks.py b/src/sanity/checks.py
+index b4193af..1421f14 100644
+--- a/src/sanity/checks.py
++++ b/src/sanity/checks.py
+@@ -1,4 +1,6 @@
++import math
+ import re
++from collections import Counter
+ 
+ from sanity.config import IGNORE_MARKER, SanityConfig
+ from sanity.models import CheckResult, DiffResult
+@@ -72,6 +74,7 @@ def check_deletion_ratio(diff: DiffResult, threshold: float = 3.0) -> CheckResul
+ SECRET_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
+     ("AWS access key", re.compile(r"AKIA[0-9A-Z]{16}")),
+     ("AWS secret key", re.compile(r"(?i)(aws_secret_access_key|aws_secret)\s*[=:]\s*\S{20,}")),
++    ("Stripe API key", re.compile(r"(?i)(sk_live_|sk_test_|pk_live_|pk_test_)[A-Za-z0-9]{20,}")),
+     ("Private key header", re.compile(r"-----BEGIN\s+(RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----")),
+     ("Generic API key assignment", re.compile(r"(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['\"]?[A-Za-z0-9_\-]{16,}['\"]?")),
+     ("Generic secret assignment", re.compile(r"(?i)(secret[_-]?key|secret)\s*[=:]\s*['\"]?[A-Za-z0-9_\-]{16,}['\"]?")),
+@@ -127,13 +130,45 @@ def check_dangerous_commands(
+     diff: DiffResult,
+     config: SanityConfig | None = None,
+ ) -> CheckResult:
+-    added_lines = _extract_added_lines(diff, config)
++    cfg = config or SanityConfig()
+     findings: list[str] = []
+ 
+-    for file_path, line in added_lines:
+-        for pattern_name, pattern in DANGEROUS_PATTERNS:
+-            if pattern.search(line):
+-                findings.append(f"{pattern_name} in {file_path}")
++    standard_patterns = [p for p in DANGEROUS_PATTERNS if p[0] != "DELETE without WHERE"]
++
++    for f in diff.files:
++        if cfg.is_excluded(f.path):
++            continue
++
++        lines = f.diff_text.splitlines()
++        for i, line in enumerate(lines):
++            if line.startswith("+") and not line.startswith("+++"):
++                content = line[1:]
++                if IGNORE_MARKER in content:
++                    continue
++
++                for pattern_name, pattern in standard_patterns:
++                    if pattern.search(content):
++                        findings.append(f"{pattern_name} in {f.path}")
++
++                match = re.search(r"(?i)\bDELETE\s+FROM\s+\w+", content)
++                if match:
++                    has_where = False
++                    if re.search(r"(?i)\bWHERE\b", content[match.end():]):
++                        has_where = True
++                    else:
++                        for j in range(i + 1, min(i + 10, len(lines))):
++                            next_line = lines[j]
++                            if next_line.startswith(("-", "---")):
++                                continue
++                            if next_line.startswith(("+", " ")):
++                                next_content = next_line[1:]
++                                if re.search(r"(?i)\bWHERE\b", next_content):
++                                    has_where = True
++                                    break
++                                if ";" in next_content:
++                                    break
++                    if not has_where:
++                        findings.append(f"DELETE without WHERE in {f.path}")
+ 
+     if findings:
+         detail = "; ".join(findings[:5])
+@@ -153,6 +188,74 @@ def check_dangerous_commands(
+     )
+ 
+ 
++def shannon_entropy(s: str) -> float:
++    if not s:
++        return 0.0
++    freqs = Counter(s)
++    entropy = 0.0
++    for count in freqs.values():
++        p = count / len(s)
++        entropy -= p * math.log2(p)
++    return entropy
++
++
++def looks_like_high_entropy_secret(s: str, threshold: float = 3.8) -> bool:
++    if len(s) < 20:
++        return False
++    if " " in s:
++        return False
++
++    lower = s.lower()
++    placeholders = ["your", "here", "xxx", "changeme", "example", "placeholder", "insert", "dummy", "key", "token"]
++    if any(p in lower for p in placeholders):
++        return False
++
++    return shannon_entropy(s) > threshold
++
++
++def check_high_entropy_secrets(
++    diff: DiffResult,
++    config: SanityConfig | None = None,
++) -> CheckResult:
++    cfg = config or SanityConfig()
++    added_lines = _extract_added_lines(diff, cfg)
++    findings: list[str] = []
++
++    threshold = cfg.entropy_threshold
++
++    pattern = re.compile(
++        r"(?i)(?:['\"]?)\b([a-z0-9_]*(?:key|token|secret|password|credential|api|auth)[a-z0-9_]*)\b(?:['\"]?)\s*[=:]\s*(['\"])([^'\"]{20,})\2"
++    )
++
++    for file_path, line in added_lines:
++        if any(p.search(line) for _, p in SECRET_PATTERNS):
++            continue
++
++        for match in pattern.finditer(line):
++            val = match.group(3)
++            if looks_like_high_entropy_secret(val, threshold):
++                var_name = match.group(1)
++                findings.append(f"High entropy secret ({var_name}) in {file_path}")
++                break
++
++    if findings:
++        detail = "; ".join(findings[:5])
++        extra = f" (+{len(findings) - 5} more)" if len(findings) > 5 else ""
++        return CheckResult(
++            check_name="high_entropy_secrets",
++            passed=False,
++            severity="HIGH",
++            reason=f"Potential high-entropy secrets detected: {detail}{extra}",
++        )
++
++    return CheckResult(
++        check_name="high_entropy_secrets",
++        passed=True,
++        severity="LOW",
++        reason="No high-entropy secrets detected.",
++    )
++
++
+ def run_all_checks(
+     diff: DiffResult,
+     config: SanityConfig | None = None,
+@@ -166,6 +269,9 @@ def run_all_checks(
+     if "secret_detection" not in cfg.disabled_checks:
+         results.append(check_secrets(diff, config=cfg))
+ 
++    if "high_entropy_secrets" not in cfg.disabled_checks:
++        results.append(check_high_entropy_secrets(diff, config=cfg))
++
+     if "dangerous_commands" not in cfg.disabled_checks:
+         results.append(check_dangerous_commands(diff, config=cfg))
+ 

sanity_guard-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sanity_guard-0.1.0/src/sanity/__init__.py

@@ -0,0 +1,3 @@
+"""Sanity — pre-commit risk checker for AI-generated code."""
+
+__version__ = "0.1.0"

sanity_guard-0.1.0/src/sanity/__main__.py

@@ -0,0 +1,3 @@
+from sanity.cli import main
+
+main()

sanity_guard-0.1.0/src/sanity/checks.py

@@ -0,0 +1,278 @@
+import math
+import re
+from collections import Counter
+
+from sanity.config import IGNORE_MARKER, SanityConfig
+from sanity.models import CheckResult, DiffResult
+
+
+def _extract_added_lines(
+    diff: DiffResult,
+    config: SanityConfig | None = None,
+) -> list[tuple[str, str]]:
+    """Extract added lines from diff, returning (file_path, line_content) pairs.
+
+    Skips files matching exclusion patterns and lines with the inline ignore marker.
+    """
+    results = []
+    for f in diff.files:
+        if config and config.is_excluded(f.path):
+            continue
+        for line in f.diff_text.splitlines():
+            if line.startswith("+") and not line.startswith("+++"):
+                content = line[1:]
+                if IGNORE_MARKER in content:
+                    continue
+                results.append((f.path, content))
+    return results
+
+
+def check_deletion_ratio(diff: DiffResult, threshold: float = 3.0) -> CheckResult:
+    if diff.total_added == 0 and diff.total_deleted == 0:
+        return CheckResult(
+            check_name="deletion_ratio",
+            passed=True,
+            severity="LOW",
+            reason="No line changes to evaluate.",
+        )
+
+    if diff.total_added == 0:
+        if diff.total_deleted > 0:
+            return CheckResult(
+                check_name="deletion_ratio",
+                passed=False,
+                severity="HIGH",
+                reason=f"Pure deletion: {diff.total_deleted} lines deleted with 0 lines added.",
+            )
+        return CheckResult(
+            check_name="deletion_ratio",
+            passed=True,
+            severity="LOW",
+            reason="No meaningful changes.",
+        )
+
+    ratio = diff.total_deleted / diff.total_added
+    if ratio > threshold:
+        return CheckResult(
+            check_name="deletion_ratio",
+            passed=False,
+            severity="HIGH",
+            reason=(
+                f"Deletion ratio {ratio:.1f}x exceeds threshold {threshold}x "
+                f"({diff.total_deleted} deleted / {diff.total_added} added)."
+            ),
+        )
+
+    return CheckResult(
+        check_name="deletion_ratio",
+        passed=True,
+        severity="LOW",
+        reason=f"Deletion ratio {ratio:.1f}x is within threshold {threshold}x.",
+    )
+
+
+SECRET_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
+    ("AWS access key", re.compile(r"AKIA[0-9A-Z]{16}")),
+    ("AWS secret key", re.compile(r"(?i)(aws_secret_access_key|aws_secret)\s*[=:]\s*\S{20,}")),
+    ("Stripe API key", re.compile(r"(?i)(sk_live_|sk_test_|pk_live_|pk_test_)[A-Za-z0-9]{20,}")),
+    ("Private key header", re.compile(r"-----BEGIN\s+(RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----")),
+    ("Generic API key assignment", re.compile(r"(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['\"]?[A-Za-z0-9_\-]{16,}['\"]?")),
+    ("Generic secret assignment", re.compile(r"(?i)(secret[_-]?key|secret)\s*[=:]\s*['\"]?[A-Za-z0-9_\-]{16,}['\"]?")),
+    ("Generic token assignment", re.compile(r"(?i)(auth[_-]?token|access[_-]?token|token)\s*[=:]\s*['\"]?[A-Za-z0-9_\-]{16,}['\"]?")),
+    ("Password assignment", re.compile(r"(?i)(password|passwd|pwd)\s*[=:]\s*['\"]?[^\s'\"]{8,}['\"]?")),
+    ("Connection string", re.compile(r"(?i)(mysql|postgres|mongodb|redis)://\S+:\S+@")),
+]
+
+
+def check_secrets(
+    diff: DiffResult,
+    config: SanityConfig | None = None,
+) -> CheckResult:
+    added_lines = _extract_added_lines(diff, config)
+    findings: list[str] = []
+
+    for file_path, line in added_lines:
+        for pattern_name, pattern in SECRET_PATTERNS:
+            if pattern.search(line):
+                findings.append(f"{pattern_name} in {file_path}")
+                break  # one finding per line is enough
+
+    if findings:
+        detail = "; ".join(findings[:5])
+        extra = f" (+{len(findings) - 5} more)" if len(findings) > 5 else ""
+        return CheckResult(
+            check_name="secret_detection",
+            passed=False,
+            severity="HIGH",
+            reason=f"Potential secrets detected: {detail}{extra}",
+        )
+
+    return CheckResult(
+        check_name="secret_detection",
+        passed=True,
+        severity="LOW",
+        reason="No secrets detected in added lines.",
+    )
+
+
+DANGEROUS_PATTERNS: list[tuple[str, re.Pattern[str]]] = [
+    ("rm -rf", re.compile(r"\brm\s+(-[a-zA-Z]*r[a-zA-Z]*f|--recursive\s+--force|-[a-zA-Z]*f[a-zA-Z]*r)\b")),  # sanity: ignore
+    ("DROP TABLE", re.compile(r"(?i)\bDROP\s+TABLE\b")),  # sanity: ignore
+    ("DELETE without WHERE", re.compile(r"(?i)\bDELETE\s+FROM\s+\w+\s*;")),
+    ("TRUNCATE", re.compile(r"(?i)\bTRUNCATE\s+(TABLE\s+)?\w+")),
+    ("git force push", re.compile(r"git\s+push\s+.*(-f|--force)\b")),
+    ("os.remove", re.compile(r"\bos\s*\.\s*remove\s*\(")),
+    ("shutil.rmtree", re.compile(r"\bshutil\s*\.\s*rmtree\s*\(")),
+]
+
+
+def check_dangerous_commands(
+    diff: DiffResult,
+    config: SanityConfig | None = None,
+) -> CheckResult:
+    cfg = config or SanityConfig()
+    findings: list[str] = []
+
+    standard_patterns = [p for p in DANGEROUS_PATTERNS if p[0] != "DELETE without WHERE"]
+
+    for f in diff.files:
+        if cfg.is_excluded(f.path):
+            continue
+
+        lines = f.diff_text.splitlines()
+        for i, line in enumerate(lines):
+            if line.startswith("+") and not line.startswith("+++"):
+                content = line[1:]
+                if IGNORE_MARKER in content:
+                    continue
+
+                for pattern_name, pattern in standard_patterns:
+                    if pattern.search(content):
+                        findings.append(f"{pattern_name} in {f.path}")
+
+                match = re.search(r"(?i)\bDELETE\s+FROM\s+\w+", content)
+                if match:
+                    has_where = False
+                    if re.search(r"(?i)\bWHERE\b", content[match.end():]):
+                        has_where = True
+                    else:
+                        for j in range(i + 1, min(i + 10, len(lines))):
+                            next_line = lines[j]
+                            if next_line.startswith(("-", "---")):
+                                continue
+                            if next_line.startswith(("+", " ")):
+                                next_content = next_line[1:]
+                                if re.search(r"(?i)\bWHERE\b", next_content):
+                                    has_where = True
+                                    break
+                                if ";" in next_content:
+                                    break
+                    if not has_where:
+                        findings.append(f"DELETE without WHERE in {f.path}")
+
+    if findings:
+        detail = "; ".join(findings[:5])
+        extra = f" (+{len(findings) - 5} more)" if len(findings) > 5 else ""
+        return CheckResult(
+            check_name="dangerous_commands",
+            passed=False,
+            severity="HIGH",
+            reason=f"Dangerous commands detected: {detail}{extra}",
+        )
+
+    return CheckResult(
+        check_name="dangerous_commands",
+        passed=True,
+        severity="LOW",
+        reason="No dangerous commands detected in added lines.",
+    )
+
+
+def shannon_entropy(s: str) -> float:
+    if not s:
+        return 0.0
+    freqs = Counter(s)
+    entropy = 0.0
+    for count in freqs.values():
+        p = count / len(s)
+        entropy -= p * math.log2(p)
+    return entropy
+
+
+def looks_like_high_entropy_secret(s: str, threshold: float = 3.8) -> bool:
+    if len(s) < 20:
+        return False
+    if " " in s:
+        return False
+
+    lower = s.lower()
+    placeholders = ["your", "here", "xxx", "changeme", "example", "placeholder", "insert", "dummy", "key", "token"]
+    if any(p in lower for p in placeholders):
+        return False
+
+    return shannon_entropy(s) > threshold
+
+
+def check_high_entropy_secrets(
+    diff: DiffResult,
+    config: SanityConfig | None = None,
+) -> CheckResult:
+    cfg = config or SanityConfig()
+    added_lines = _extract_added_lines(diff, cfg)
+    findings: list[str] = []
+
+    threshold = cfg.entropy_threshold
+
+    pattern = re.compile(
+        r"(?i)(?:['\"]?)\b([a-z0-9_]*(?:key|token|secret|password|credential|api|auth)[a-z0-9_]*)\b(?:['\"]?)\s*[=:]\s*(['\"])([^'\"]{20,})\2"
+    )
+
+    for file_path, line in added_lines:
+        if any(p.search(line) for _, p in SECRET_PATTERNS):
+            continue
+
+        for match in pattern.finditer(line):
+            val = match.group(3)
+            if looks_like_high_entropy_secret(val, threshold):
+                var_name = match.group(1)
+                findings.append(f"High entropy secret ({var_name}) in {file_path}")
+                break
+
+    if findings:
+        detail = "; ".join(findings[:5])
+        extra = f" (+{len(findings) - 5} more)" if len(findings) > 5 else ""
+        return CheckResult(
+            check_name="high_entropy_secrets",
+            passed=False,
+            severity="HIGH",
+            reason=f"Potential high-entropy secrets detected: {detail}{extra}",
+        )
+
+    return CheckResult(
+        check_name="high_entropy_secrets",
+        passed=True,
+        severity="LOW",
+        reason="No high-entropy secrets detected.",
+    )
+
+
+def run_all_checks(
+    diff: DiffResult,
+    config: SanityConfig | None = None,
+) -> list[CheckResult]:
+    cfg = config or SanityConfig()
+    results: list[CheckResult] = []
+
+    if "deletion_ratio" not in cfg.disabled_checks:
+        results.append(check_deletion_ratio(diff, threshold=cfg.deletion_ratio_threshold))
+
+    if "secret_detection" not in cfg.disabled_checks:
+        results.append(check_secrets(diff, config=cfg))
+
+    if "high_entropy_secrets" not in cfg.disabled_checks:
+        results.append(check_high_entropy_secrets(diff, config=cfg))
+
+    if "dangerous_commands" not in cfg.disabled_checks:
+        results.append(check_dangerous_commands(diff, config=cfg))
+
+    return results