Gabor Körber
087429d275
Implement Goals 1–3 and 5 from the reveal-layer security brain goal.
fermata now detects, redacts, and scans for secrets in AI agent tool
output, filling the ecosystem gap where no coding agent filters secrets
post-read.
New core/secrets/ module:
- config.rs: .botsecrets TOML format with hierarchical merge and ~40
built-in key patterns
- parser.rs: multi-format secret file parser (.env, TOML, YAML, JSON,
Python assignments, Java properties)
- manifest.rs: file discovery + parsing → known-secrets set
- redactor.rs: Aho-Corasick multi-pattern replacement with 4 styles
- scanner.rs: RegexSet heuristic detection with 35 gitleaks-derived
patterns (MIT) and Shannon entropy filtering
- patterns.rs: curated rules for AWS, GitHub, Stripe, Slack, JWT, etc.
Hook integration:
- fermata hook --event post-tool-use reads tool output, runs redactor +
scanner, returns updatedToolOutput for Claude Code
- Backward compatible: --event pre-tool-use (default) unchanged
- Fail-open: errors produce {} and exit 0
Library API:
- Redactor::new(manifest, style).redact(text) → RedactedText
- Scanner::new(config).scan(text) → Vec<Finding>
- Compiles without CLI feature for embedding in other crates
195 tests (130 new), all passing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
999 B
TOML
46 lines
999 B
TOML
[package]
|
|
name = "dirigent_fermata"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
rust-version = "1.75"
|
|
description = "Harness-agnostic policy gate for AI coding agents (.botignore + botignore.toml)"
|
|
license = "MIT OR Apache-2.0"
|
|
repository = "https://git.g4b.org/dirigence/fermata"
|
|
readme = "README.md"
|
|
keywords = ["ai", "agents", "security", "policy", "gitignore"]
|
|
categories = ["command-line-utilities", "development-tools"]
|
|
|
|
[lib]
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "fermata"
|
|
path = "src/bin/fermata.rs"
|
|
required-features = ["cli"]
|
|
|
|
[dependencies]
|
|
aho-corasick = "1.1"
|
|
globset = "0.4"
|
|
ignore = "0.4"
|
|
walkdir = "2"
|
|
toml = "0.8"
|
|
regex = "1.10"
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
serde_yaml = "0.9"
|
|
thiserror = "2.0"
|
|
clap = { version = "4.5", features = ["derive"], optional = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3.10"
|
|
assert_cmd = "2.0"
|
|
predicates = "3.1"
|
|
|
|
[features]
|
|
default = ["cli", "harness-claude"]
|
|
cli = ["dep:clap"]
|
|
harness-claude = []
|
|
|
|
[lints]
|
|
workspace = true
|