dirigence/fermata
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10 Commits 1 Branch 0 Tags
087429d275a2e9842c857374de306d258a5e707c
Commit Graph

10 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Gabor Körber 087429d275 ✨ feat(fermata): add secret filtering engine — the security brain 
Implement Goals 1–3 and 5 from the reveal-layer security brain goal.
fermata now detects, redacts, and scans for secrets in AI agent tool
output, filling the ecosystem gap where no coding agent filters secrets
post-read.

New core/secrets/ module:
- config.rs: .botsecrets TOML format with hierarchical merge and ~40
  built-in key patterns
- parser.rs: multi-format secret file parser (.env, TOML, YAML, JSON,
  Python assignments, Java properties)
- manifest.rs: file discovery + parsing → known-secrets set
- redactor.rs: Aho-Corasick multi-pattern replacement with 4 styles
- scanner.rs: RegexSet heuristic detection with 35 gitleaks-derived
  patterns (MIT) and Shannon entropy filtering
- patterns.rs: curated rules for AWS, GitHub, Stripe, Slack, JWT, etc.

Hook integration:
- fermata hook --event post-tool-use reads tool output, runs redactor +
  scanner, returns updatedToolOutput for Claude Code
- Backward compatible: --event pre-tool-use (default) unchanged
- Fail-open: errors produce {} and exit 0

Library API:
- Redactor::new(manifest, style).redact(text) → RedactedText
- Scanner::new(config).scan(text) → Vec<Finding>
- Compiles without CLI feature for embedding in other crates

195 tests (130 new), all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-25 17:29:07 +02:00
g4borg f77fd73966 fix(fermata): .botignore as fallback root, not ignored; extract SVGs to files 
- Walk-up: .botignore no longer stops the search but is remembered as a
  fallback when no strong marker (.git, botignore.toml, .botignore.toml)
  is found — prevents fail-open regression for projects without .git
- Extract inline SVGs to policy-layers.svg and architecture.svg
- READMEs reference SVGs via <img> tags

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-08 23:46:15 +02:00
g4borg 424e6814fd docs(export): rework all export READMEs 
- fermata: position as security layer, add policy protection layers SVG,
  update walk-up docs to match code change
- dirigate: clarify Dirigent Protocol as ACP superset with parity goal
- anth: tools-first structure (anth_usage then anth_bear), library second
- dirigent: link to tool repos instead of install instructions, add
  architecture SVG, under-construction notice
- purge all localsettings references from examples

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-08 23:37:21 +02:00
g4borg fd2482e3e6 fix(fermata): .botignore no longer stops project-root walk-up 
Only .git, botignore.toml, and .botignore.toml define project boundaries.
A bare .botignore is a policy file, not a root marker.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-08 23:30:30 +02:00
g4borg 4c533c09cb 𝄐 fermata 2026-05-07 22:42:18 +02:00
g4borg 14c679541a docs(fermata): redesign READMEs with polished formatting and examples 
Rewrote both the monorepo and export READMEs with a punchy tagline, status
table, realistic before/after scenarios (including the bash bypass case), full
configuration reference, and Claude Code hook integration guide.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-07 22:27:13 +02:00
g4borg d3c082058e fix(fermata): correct install instructions in both READMEs 2026-05-07 22:23:56 +02:00
g4borg 2be8570af9 chore(fermata): set real repository URLs (git.g4b.org/dirigence) 
- Cargo.toml: repository = https://git.g4b.org/dirigence/fermata
- README.standalone.md: upstream link points at git.g4b.org/dirigence/dirigent
 2026-04-30 22:43:41 +02:00
g4borg 478bf1927b feat(fermata): add cargo publish/install metadata 
Adds license (MIT OR Apache-2.0), repository (placeholder TODO URL),
readme, keywords, categories, rust-version, dual LICENSE files, and a
README install section. Adds a regression test asserting these fields
remain present so future edits cannot silently break cargo publish.

`cargo install --path crates/dirigent_fermata --features cli` produces
a working `fermata` binary; `cargo publish --dry-run` is clean.
 2026-04-30 22:08:39 +02:00
g4borg 97001e1544 chore: rename packages/ to crates/ 
Move all 29 workspace members from packages/<name>/ to crates/<name>/.
Updates: workspace Cargo.toml (members + path deps), justfile, root
CLAUDE.md, scripts/build/CARGO_INSTALL.md, docs/architecture/crates.md
(renamed from packages.md), structural references in docs/architecture
and docs/configuration, per-crate CLAUDE.md self-references. Historical
plans, reports, and building/ docs are left untouched.

No behavior change; just check-all stays green and fermata tests pass.
 2026-04-30 21:58:57 +02:00