veil-proxy 0.3.0__tar.gz → 0.3.2__tar.gz

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veil-proxy
-Version: 0.3.0
+Version: 0.3.2
 Summary: Privacy middleware for AI coding agents: the model sees consistent pseudonyms, your machine keeps the real values
 Keywords: privacy,pii,llm,proxy,pseudonymization,claude-code,coding-agent
 Requires-Python: >=3.11
@@ -47,10 +47,10 @@ Privacy middleware for AI coding agents. The model sees consistent pseudonyms
 and commands the agent runs locally get the real values back (shell- and SQL-safe).
 
 ```sh
-pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, all
+pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, snowflake, all
                                       # (installs the `veil` and `veil-hook` commands; import name `veil`)
 veil init ~/code/myapp                # seed from .env DB URLs, SQLite, fixtures; wire Claude Code
-veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux)
+veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux) / Startup item (Windows)
 veil status ~/code/myapp
 ```
 
@@ -63,7 +63,7 @@ https://github.com/lemonadesaltbagel/veil):
   pattern matching (1,000 labelled records).
 - **21/21** one-command bypass transforms are contained. Restored values are escaped for every
   language layer they pass through (shell, heredocs, `python -c`, `node -e`, SQL, `bash -c`...):
-  35/35 injection tests, and 55,000 fuzzed nested commands executed with 0 code executions.
+  35/35 injection tests, and 68,000 fuzzed nested commands executed with 0 code executions.
 - Prompt caching keeps working (74–89% cache hits); about 19 ms overhead per request at 40k seeded
   values, and 37 + 68 ms per 234 KB request at 1.2 million seeded values (1.1 GB).
 
@@ -71,6 +71,8 @@ One local proxy (default `127.0.0.1:8787`) serves every client, routed by path:
 Anthropic Messages (Claude Code, Agent SDK), Amazon Bedrock InvokeModel (binary eventstream),
 Google Vertex rawPredict, Microsoft Foundry (`/foundry`), Claude Platform on AWS (`/anthropic-aws`),
 OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and OpenAI Responses (Codex CLI).
+DeepSeek Harness uses the [dsh-veil](https://github.com/lemonadesaltbagel/dsh-veil) plugin. Other
+agents' tools can get veil's restore rules with `veil proxy --tool-alias NAME=ROLE`.
 
 Seeds from Postgres, MySQL/MariaDB, SQLite, SQL Server (native sensitivity labels), MongoDB, Redis,
 Elasticsearch/OpenSearch and fixture files, plus personal fields declared in code (Prisma, Django,

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/README.md

@@ -5,10 +5,10 @@ Privacy middleware for AI coding agents. The model sees consistent pseudonyms
 and commands the agent runs locally get the real values back (shell- and SQL-safe).
 
 ```sh
-pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, all
+pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, snowflake, all
                                       # (installs the `veil` and `veil-hook` commands; import name `veil`)
 veil init ~/code/myapp                # seed from .env DB URLs, SQLite, fixtures; wire Claude Code
-veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux)
+veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux) / Startup item (Windows)
 veil status ~/code/myapp
 ```
 
@@ -21,7 +21,7 @@ https://github.com/lemonadesaltbagel/veil):
   pattern matching (1,000 labelled records).
 - **21/21** one-command bypass transforms are contained. Restored values are escaped for every
   language layer they pass through (shell, heredocs, `python -c`, `node -e`, SQL, `bash -c`...):
-  35/35 injection tests, and 55,000 fuzzed nested commands executed with 0 code executions.
+  35/35 injection tests, and 68,000 fuzzed nested commands executed with 0 code executions.
 - Prompt caching keeps working (74–89% cache hits); about 19 ms overhead per request at 40k seeded
   values, and 37 + 68 ms per 234 KB request at 1.2 million seeded values (1.1 GB).
 
@@ -29,6 +29,8 @@ One local proxy (default `127.0.0.1:8787`) serves every client, routed by path:
 Anthropic Messages (Claude Code, Agent SDK), Amazon Bedrock InvokeModel (binary eventstream),
 Google Vertex rawPredict, Microsoft Foundry (`/foundry`), Claude Platform on AWS (`/anthropic-aws`),
 OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and OpenAI Responses (Codex CLI).
+DeepSeek Harness uses the [dsh-veil](https://github.com/lemonadesaltbagel/dsh-veil) plugin. Other
+agents' tools can get veil's restore rules with `veil proxy --tool-alias NAME=ROLE`.
 
 Seeds from Postgres, MySQL/MariaDB, SQLite, SQL Server (native sensitivity labels), MongoDB, Redis,
 Elasticsearch/OpenSearch and fixture files, plus personal fields declared in code (Prisma, Django,

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "veil-proxy"
-version = "0.3.0"
+version = "0.3.2"
 description = "Privacy middleware for AI coding agents: the model sees consistent pseudonyms, your machine keeps the real values"
 readme = "README.md"
 license = "Apache-2.0"

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/anthropic.py

@@ -34,6 +34,34 @@ EGRESS = re.compile(
 
 CONTENT_FIELDS = {"new_string", "content", "new_source"}
 
+# Roles a tool can be aliased to: another agent's tool that takes the same arguments as one
+# of these gets the same policy (`tool_aliases`, set by config, env or `--tool-alias`).
+ALIAS_ROLES = {"Bash", "Read", "Grep", "Glob", "LS", "Edit", "MultiEdit", "Write", "NotebookEdit"}
+
+
+def parse_aliases(spec) -> dict[str, str]:
+    """{"bash": "Bash"} or "bash=Bash,read=Read" -> validated aliases. Unknown roles are refused:
+    an alias may only grant a tool the policy of one of veil's own roles."""
+    if isinstance(spec, str):
+        spec = dict(p.split("=", 1) for p in spec.replace(";", ",").split(",") if "=" in p)
+    out = {}
+    for name, role in (spec or {}).items():
+        name, role = str(name).strip(), str(role).strip()
+        if role not in ALIAS_ROLES:
+            raise ValueError(f"tool alias {name}={role}: role must be one of {sorted(ALIAS_ROLES)}")
+        if name:
+            out[name] = role
+    return out
+
+
+def configured_aliases(cfg: dict | None = None, extra=None) -> dict[str, str]:
+    """config.json "tool_aliases", then VEIL_TOOL_ALIASES, then explicit `extra` (later wins)."""
+    import os
+    aliases = parse_aliases((cfg or {}).get("tool_aliases"))
+    aliases.update(parse_aliases(os.environ.get("VEIL_TOOL_ALIASES", "")))
+    aliases.update(parse_aliases(extra))
+    return aliases
+
 
 PSEUDONYM_NOTICE = (
     "Privacy note: personal data in this session (names, emails, usernames, phones, addresses, "
@@ -53,6 +81,7 @@ class Policy:
     full_tools: set[str] = field(default_factory=lambda: {"Bash", "Read", "Grep", "Glob", "LS"})
     preserve_tools: set[str] = field(default_factory=lambda: {"Edit", "MultiEdit", "Write", "NotebookEdit"})
     full_tool_prefixes: tuple[str, ...] = ()  # e.g. ("mcp__veil_db__",)
+    tool_aliases: dict[str, str] = field(default_factory=dict)  # other agents' names -> veil roles
 
     def mode(self, tool: str, tool_input: dict) -> str:
         if tool == "Bash" and EGRESS.search(str(tool_input.get("command", ""))):
@@ -101,7 +130,30 @@ def _texts(obj) -> str:
     return "\0".join(out)
 
 
+def _str_replace_editor(veil: Veil, policy: Policy, tool_input: dict) -> dict:
+    """Anthropic's text-editor tool (`str_replace_editor`): view | create | str_replace |
+    insert, mapped onto Read / Write / Edit so the preserve and escaping rules apply."""
+    cmd = tool_input.get("command")
+    if cmd == "create":
+        out = rehydrate_tool_input(veil, policy, "Write", {"file_path": tool_input.get("path", ""),
+                                                            "content": tool_input.get("file_text", "")})
+        return {**tool_input, "path": out["file_path"], "file_text": out["content"]}
+    if cmd in ("str_replace", "insert"):
+        out = rehydrate_tool_input(veil, policy, "Edit", {"file_path": tool_input.get("path", ""),
+                                                           "old_string": tool_input.get("old_str") or "",
+                                                           "new_string": tool_input.get("new_str") or ""})
+        res = {**tool_input, "path": out["file_path"], "new_str": out["new_string"]}
+        if tool_input.get("old_str") is not None:
+            res["old_str"] = out["old_string"]
+        return res
+    return {**tool_input, "path": veil.rehydrate(tool_input.get("path") or "")}  # view, undo_edit
+
+
 def rehydrate_tool_input(veil: Veil, policy: Policy, tool: str, tool_input: dict) -> dict:
+    if tool in policy.tool_aliases:
+        return rehydrate_tool_input(veil, policy, policy.tool_aliases[tool], tool_input)
+    if tool == "str_replace_editor" and isinstance(tool_input, dict):
+        return _str_replace_editor(veil, policy, tool_input)
     mode = policy.mode(tool, tool_input)
     if mode == "full":
         frags = veil.fragments(_texts(tool_input))

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/cli.py

@@ -256,6 +256,8 @@ def _service(args) -> int:
 
 def main(argv: list[str] | None = None) -> int:
     argv = sys.argv[1:] if argv is None else argv
+    from .netenv import normalize_no_proxy
+    normalize_no_proxy()  # before any httpx client: one unparseable NO_PROXY entry makes them all raise
     if argv[:1] == ["audit"]:
         try:  # dev harness: only in a source checkout (prototype/veil_dev), never in the package
             import os
@@ -304,6 +306,8 @@ def main(argv: list[str] | None = None) -> int:
                    help="OpenAI-format upstream for /chat/completions (e.g. https://api.deepseek.com)")
     s.add_argument("--bedrock-upstream", metavar="URL", help="e.g. https://bedrock-runtime.us-east-1.amazonaws.com")
     s.add_argument("--pid-file", metavar="PATH", help="write the process id here (removed on exit)")
+    s.add_argument("--tool-alias", action="append", default=[], metavar="NAME=ROLE",
+                   help="give another agent's tool the policy of a veil role (e.g. bash=Bash; repeatable)")
     s.add_argument("--reseed-interval", type=float, default=30,
                    help="seconds between change checks of remembered sources (0 = off)")
     s.add_argument("--vertex-upstream", metavar="URL", help="e.g. https://us-east5-aiplatform.googleapis.com")
@@ -428,7 +432,14 @@ def main(argv: list[str] | None = None) -> int:
             from .ner import GlinerDetector
             veil.ner = GlinerDetector()
         warm(veil.known)
-        server = serve(veil, Policy(display_real=not args.show_tokens), args.port, args.upstream, args.capture,
+        from .anthropic import configured_aliases
+        try:
+            aliases = configured_aliases(state.config(), ",".join(args.tool_alias))
+        except ValueError as e:
+            raise SystemExit(f"veil: {e}")
+        if aliases:
+            print(f"[veil] tool aliases: {', '.join(f'{k}={v}' for k, v in sorted(aliases.items()))}", file=sys.stderr)
+        server = serve(veil, Policy(display_real=not args.show_tokens, tool_aliases=aliases), args.port, args.upstream, args.capture,
                        args.openai_upstream, args.bedrock_upstream, args.vertex_upstream,
                        args.foundry_upstream, args.anthropic_aws_upstream)
         sources = state.load_sources(veil.vault.cipher)

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/engine.py

@@ -14,6 +14,7 @@ from .vault import Vault
 
 
 # The person code inside each token shape: user_mz5z, user_mz5z+2@…, User Mz5z, First_Mz5z, Mz5z Example Street
+PHONE_TOKEN = re.compile(r"\+1-\d{3}-555-01\d\d")  # tokens.render(kind="phone")
 TOKEN_CODE = re.compile(r"(?:user_|User |First_|Last_|card_|secret_)([A-Za-z2-9]{4,6})|^([A-Za-z2-9]{4,6}) Example Street")
 
 
@@ -71,6 +72,7 @@ class Veil:
         self.ner = ner  # optional free-text detector (veil.ner.GlinerDetector)
         self.quasi_mode = "warn"  # "redact": rare quasi-identifiers are pseudonymised too (veil/quasi.py)
         self._tokens = TokenPattern()
+        self._phone_pieces: tuple[int, set[str]] = (-1, set())
         self._tokens_lock = threading.Lock()
         self._codes: dict[str, list[str]] = {}
         self._codes_version = -1
@@ -92,7 +94,7 @@ class Veil:
             # job title of one person); no person group: shared values must not link people
             extra = (extra or []) + [dataclasses.replace(s, group=None) for s in self.known.find_quasi(text)] \
                 + [s for combo, _ in self.known.quasi_combos(text) for s in combo]
-        spans = detect(text, self.known, self.vault.is_token, extra)
+        spans = [s for s in detect(text, self.known, self.vault.is_token, extra) if not self.pseudonym_piece(s)]
         if not spans:
             return text
         out, pos = [], 0
@@ -103,6 +105,17 @@ class Veil:
         out.append(text[pos:])
         return "".join(out)
 
+    def pseudonym_piece(self, span) -> bool:
+        """A phone-pattern hit that is (part of) one of our own phone pseudonyms: a model
+        searching LIKE '%408-555-0133%' for +1-408-555-0133. Re-redacting it would mint a
+        second pseudonym for the first one's digits. Seeded values are never skipped."""
+        if span.kind != "phone" or span.priority >= 10:
+            return False
+        if self._phone_pieces[0] != self.vault.version:
+            self._phone_pieces = (self.vault.version, {re.sub(r"\D", "", t)[-10:] for t in self.vault._by_token
+                                                       if PHONE_TOKEN.fullmatch(t)})
+        return re.sub(r"\D", "", span.value)[-10:] in self._phone_pieces[1]
+
     # -- token -> real ---------------------------------------------------
     def token_pattern(self) -> TokenPattern | None:
         if hasattr(self.vault, "refresh"):

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/guard.py

@@ -270,6 +270,8 @@ class Guard:
                         hits.append((a, b, PARTIAL, ix.kind_of(value), "partial"))
         if not frozen:
             for span in detect(s, None, self.veil.vault.is_token):
+                if self.veil.pseudonym_piece(span):
+                    continue
                 if not any(a < span.end and span.start < b for a, b, *_ in hits):
                     tok = self.veil.vault.token_for(span.kind, span.value)
                     hits.append((span.start, span.end, tok, span.kind, "pattern"))

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/hooks.py

@@ -16,7 +16,10 @@ def hook_response(veil, kind: str, event: dict) -> dict | None:
             return {"hookSpecificOutput": {"hookEventName": "PostToolUse", "updatedToolOutput": redacted}}
     else:
         original = event.get("tool_input", {})
-        updated = rehydrate_tool_input(veil, Policy(), event.get("tool_name", ""), original)
+        from .anthropic import configured_aliases
+        from .state import config
+        policy = Policy(tool_aliases=configured_aliases(config()))
+        updated = rehydrate_tool_input(veil, policy, event.get("tool_name", ""), original)
         if updated != original:
             return {"hookSpecificOutput": {"hookEventName": "PreToolUse", "updatedInput": updated}}
     return None

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/mcpdb.py

@@ -154,9 +154,16 @@ class SQLSource:
             self.conn = pymysql.connect(host=u.hostname or "127.0.0.1", port=u.port or 3306,
                                         user=unquote(u.username or "root"), password=unquote(u.password or ""),
                                         database=u.path.lstrip("/"), autocommit=True, charset="utf8mb4",
-                                        connect_timeout=10)
+                                        connect_timeout=10, read_timeout=60, write_timeout=60)
             with self.conn.cursor() as c:
                 c.execute("SET SESSION TRANSACTION READ ONLY")
+                for limit in ("SET SESSION MAX_EXECUTION_TIME = 30000",  # MySQL (ms)
+                              "SET SESSION max_statement_time = 30"):     # MariaDB (s)
+                    try:
+                        c.execute(limit)
+                        break
+                    except Exception:
+                        continue
             self.kind, self.paramstyle = "mysql", "format"
         elif u.scheme in ("mssql", "sqlserver"):
             from .sources.mssql import _connect

veil_proxy-0.3.2/veil/netenv.py

@@ -0,0 +1,62 @@
+"""NO_PROXY entries that httpx can't parse.
+
+httpx turns each NO_PROXY entry into a URL pattern when a client is created, and one entry it
+can't parse makes every `httpx.Client()` raise, so veil would exit at startup. DeepSeek
+Harness, for one, adds `[::1]` (an IPv6 address in brackets, which httpx doesn't recognise as an
+address) for its child processes.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import os
+import re
+import sys
+from typing import MutableMapping
+
+KEYS = ("NO_PROXY", "no_proxy")
+_BRACKETED = re.compile(r"\[([0-9A-Fa-f:.%]+)\](?::\d+)?")
+
+
+def _pattern(host: str) -> str:
+    """The URL pattern httpx builds for one NO_PROXY entry (httpx._utils.get_environment_proxies)."""
+    if "://" in host:
+        return host
+    for cls, fmt in ((ipaddress.IPv4Address, "all://{}"), (ipaddress.IPv6Address, "all://[{}]")):
+        try:
+            cls(host.split("/")[0])
+            return fmt.format(host)
+        except ValueError:
+            pass
+    return f"all://{host}" if host.lower() == "localhost" else f"all://*{host}"
+
+
+def _parses(host: str) -> bool:
+    import httpx
+    try:
+        httpx.URL(_pattern(host))
+        return True
+    except Exception:
+        return False
+
+
+def normalize_no_proxy(environ: MutableMapping[str, str] = os.environ, log=sys.stderr) -> None:
+    """Rewrite `[::1]` and `[::1]:port` to `::1`, and drop entries httpx would still reject."""
+    for key in KEYS:
+        value = environ.get(key)
+        if not value:
+            continue
+        kept, dropped = [], []
+        for host in (h.strip() for h in value.split(",")):
+            if not host:
+                continue
+            m = _BRACKETED.fullmatch(host)
+            host = m.group(1) if m else host
+            if host == "*" or _parses(host):
+                if host not in kept:
+                    kept.append(host)
+            else:
+                dropped.append(host)
+        if dropped and log:
+            print(f"[veil] ignoring {key} entries that can't be parsed: {', '.join(dropped)}", file=log)
+        environ[key] = ",".join(kept)

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/proxy.py

@@ -414,6 +414,8 @@ def serve(veil: Veil, policy: Policy, port: int = 8787, upstream: str = "https:/
           capture: str | None = None, openai_upstream: str | None = None, bedrock_upstream: str | None = None,
           vertex_upstream: str | None = None, foundry_upstream: str | None = None,
           anthropic_aws_upstream: str | None = None):
+    from .netenv import normalize_no_proxy
+    normalize_no_proxy()
     client = httpx.Client(timeout=httpx.Timeout(600, connect=10))
     observer = capture_observer(capture) if capture else None
     server = LocalHTTPServer(("127.0.0.1", port), make_handler(veil, policy, upstream, client,

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/reseed.py

@@ -63,7 +63,8 @@ def fingerprint(source: str) -> str:
     if u.scheme in ("mysql", "mariadb"):
         import pymysql
         c = pymysql.connect(host=u.hostname or "127.0.0.1", port=u.port or 3306, user=unquote(u.username or "root"),
-                            password=unquote(u.password or ""), database=u.path.lstrip("/"), connect_timeout=5)
+                            password=unquote(u.password or ""), database=u.path.lstrip("/"), connect_timeout=5,
+                            read_timeout=5, write_timeout=5)  # connect_timeout doesn't cover the handshake
         try:
             with c.cursor() as cur:
                 try:

{veil_proxy-0.3.0 → veil_proxy-0.3.2}/veil/sources/sql.py

@@ -207,7 +207,8 @@ def seed_mysql(known: KnownValues, host: str, user: str, password: str, database
     import pymysql
 
     conn = pymysql.connect(host=host, port=port, user=user, password=password, database=database,
-                           cursorclass=pymysql.cursors.DictCursor, charset="utf8mb4", connect_timeout=10)
+                           cursorclass=pymysql.cursors.DictCursor, charset="utf8mb4", connect_timeout=10,
+                           read_timeout=300, write_timeout=300)
     with conn.cursor() as cur:
         cur.execute("SET SESSION TRANSACTION READ ONLY")
         cur.execute("""SELECT TABLE_NAME t, COLUMN_NAME c, DATA_TYPE d, COLUMN_KEY k, COLUMN_COMMENT m