Skip to content

Commit ada5591

Browse files
author
Louis Guthmann
committed
feat: refactor sensitive detection runtime
1 parent 6f4bb98 commit ada5591

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+8684
-3807
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Bug report
2+
description: Report a reproducible problem with KeyClaw behavior, docs, or release artifacts.
3+
title: "[Bug]: "
4+
labels:
5+
- bug
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Thanks for filing a bug. Please redact secrets before pasting logs, payloads, or screenshots.
11+
- type: textarea
12+
id: summary
13+
attributes:
14+
label: What happened?
15+
description: Describe the actual behavior and why it is a problem.
16+
placeholder: KeyClaw allowed an AWS key through a proxied request that should have been redacted.
17+
validations:
18+
required: true
19+
- type: textarea
20+
id: reproduce
21+
attributes:
22+
label: How do we reproduce it?
23+
description: Provide the smallest reliable repro you can.
24+
placeholder: |
25+
1. Run `keyclaw proxy`
26+
2. Source `~/.keyclaw/env.sh`
27+
3. Send this request...
28+
validations:
29+
required: true
30+
- type: dropdown
31+
id: tool
32+
attributes:
33+
label: Which client path is involved?
34+
options:
35+
- Claude Code
36+
- Cursor
37+
- aider
38+
- Continue
39+
- Direct API client
40+
- Other
41+
validations:
42+
required: true
43+
- type: textarea
44+
id: expected
45+
attributes:
46+
label: What did you expect instead?
47+
placeholder: The request should have been blocked with `invalid_json` / redacted before upload / etc.
48+
validations:
49+
required: true
50+
- type: textarea
51+
id: diagnostics
52+
attributes:
53+
label: Diagnostics
54+
description: Include relevant output from `keyclaw doctor`, `cargo --version`, and your platform. Redact secrets first.
55+
render: shell
56+
- type: input
57+
id: version
58+
attributes:
59+
label: KeyClaw version
60+
placeholder: 0.2.1 or git SHA
61+
- type: checkboxes
62+
id: checks
63+
attributes:
64+
label: Before submitting
65+
options:
66+
- label: I confirmed the traffic is actually routed through KeyClaw.
67+
required: true
68+
- label: I removed or redacted secrets from the issue body.
69+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security report
4+
url: https://github.com/GuthL/KeyClaw/security/advisories/new
5+
about: Report vulnerabilities privately. Do not open a public issue for security problems.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Feature request
2+
description: Propose a new capability, workflow improvement, or docs enhancement.
3+
title: "[Feature]: "
4+
labels:
5+
- enhancement
6+
body:
7+
- type: textarea
8+
id: problem
9+
attributes:
10+
label: What problem are you trying to solve?
11+
placeholder: I want a clearer way to verify that Cursor traffic is being intercepted without manually inspecting logs.
12+
validations:
13+
required: true
14+
- type: textarea
15+
id: proposal
16+
attributes:
17+
label: What change would you like?
18+
placeholder: Add a `keyclaw proxy doctor` summary for active intercept counts and trusted-CA status.
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: alternatives
23+
attributes:
24+
label: Alternatives considered
25+
placeholder: I can script this locally today, but it is clumsy and easy to get wrong.
26+
- type: dropdown
27+
id: area
28+
attributes:
29+
label: Area
30+
options:
31+
- Detection
32+
- Proxy/runtime
33+
- CLI UX
34+
- Documentation
35+
- Release/distribution
36+
- Security hardening
37+
- Other
38+
validations:
39+
required: true
40+
- type: checkboxes
41+
id: checks
42+
attributes:
43+
label: Before submitting
44+
options:
45+
- label: I checked for an existing issue or discussion first.
46+
required: true

‎.github/pull_request_template.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
## Summary
2+
3+
- Describe the change and the user or maintainer impact.
4+
5+
## Validation
6+
7+
- [ ] `cargo fmt --check`
8+
- [ ] `cargo clippy --all-targets --all-features -- -D warnings`
9+
- [ ] `cargo build --locked`
10+
- [ ] `cargo test --locked`
11+
- [ ] `cargo test --locked --test e2e_cli -- --ignored --test-threads=1`
12+
- [ ] `cargo doc --no-deps`
13+
14+
## Docs
15+
16+
- [ ] README updated if public behavior changed
17+
- [ ] `docs/` updated if deeper reference material changed
18+
- [ ] Screenshots or SVG assets updated if the repo-facing experience changed
19+
20+
## Notes
21+
22+
- Call out risks, follow-ups, or release considerations here.

‎.github/workflows/ci.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: ["master", "main"]
6+
pull_request:
7+
branches: ["master", "main"]
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
12+
permissions:
13+
contents: read
14+
15+
concurrency:
16+
group: ci-${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
fmt:
21+
name: fmt
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
- uses: dtolnay/rust-toolchain@stable
26+
with:
27+
components: rustfmt
28+
- uses: Swatinem/rust-cache@v2
29+
- name: cargo fmt --check
30+
run: cargo fmt --check
31+
32+
clippy:
33+
name: clippy
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@v4
37+
- uses: dtolnay/rust-toolchain@stable
38+
with:
39+
components: clippy
40+
- uses: Swatinem/rust-cache@v2
41+
- name: cargo clippy --all-targets --all-features -- -D warnings
42+
run: cargo clippy --all-targets --all-features -- -D warnings
43+
44+
build:
45+
name: build (${{ matrix.os }})
46+
runs-on: ${{ matrix.os }}
47+
strategy:
48+
fail-fast: false
49+
matrix:
50+
os: ["ubuntu-latest", "macos-latest"]
51+
steps:
52+
- uses: actions/checkout@v4
53+
- uses: dtolnay/rust-toolchain@stable
54+
- uses: Swatinem/rust-cache@v2
55+
- name: cargo build --locked
56+
run: cargo build --locked
57+
58+
test:
59+
name: test (${{ matrix.os }})
60+
runs-on: ${{ matrix.os }}
61+
strategy:
62+
fail-fast: false
63+
matrix:
64+
os: ["ubuntu-latest", "macos-latest"]
65+
steps:
66+
- uses: actions/checkout@v4
67+
- uses: dtolnay/rust-toolchain@stable
68+
- uses: Swatinem/rust-cache@v2
69+
- name: cargo test --locked
70+
run: cargo test --locked
71+
72+
slow-daemon-tests:
73+
name: slow daemon tests (${{ matrix.os }})
74+
runs-on: ${{ matrix.os }}
75+
strategy:
76+
fail-fast: false
77+
matrix:
78+
os: ["ubuntu-latest", "macos-latest"]
79+
steps:
80+
- uses: actions/checkout@v4
81+
- uses: dtolnay/rust-toolchain@stable
82+
- uses: Swatinem/rust-cache@v2
83+
- name: cargo test --locked --test e2e_cli -- --ignored --test-threads=1
84+
run: cargo test --locked --test e2e_cli -- --ignored --test-threads=1
85+
86+
publish-dry-run:
87+
name: publish dry-run
88+
runs-on: ubuntu-latest
89+
needs: [fmt, clippy, build, test, slow-daemon-tests]
90+
steps:
91+
- uses: actions/checkout@v4
92+
- uses: dtolnay/rust-toolchain@stable
93+
- uses: Swatinem/rust-cache@v2
94+
- name: cargo publish --dry-run --locked
95+
run: cargo publish --dry-run --locked

‎.github/workflows/release.yml‎

Lines changed: 64 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,27 @@ permissions:
1212

1313
jobs:
1414
package:
15-
name: Package (${{ matrix.target }})
15+
name: package (${{ matrix.target }})
1616
runs-on: ${{ matrix.os }}
1717
strategy:
1818
fail-fast: false
1919
matrix:
2020
include:
21-
- os: ubuntu-latest
21+
- os: ubuntu-22.04
2222
target: x86_64-unknown-linux-gnu
23-
- os: macos-latest
23+
- os: macos-14
2424
target: x86_64-apple-darwin
25-
- os: macos-latest
25+
- os: macos-14
2626
target: aarch64-apple-darwin
2727

2828
steps:
2929
- uses: actions/checkout@v4
3030
- uses: dtolnay/rust-toolchain@stable
3131
with:
3232
targets: ${{ matrix.target }}
33+
- uses: Swatinem/rust-cache@v2
34+
with:
35+
shared-key: release-${{ matrix.target }}
3336
- name: Derive release version
3437
id: version
3538
shell: bash
@@ -39,7 +42,7 @@ jobs:
3942
echo "expected tag in v{version} format, got ${GITHUB_REF_NAME}" >&2
4043
exit 1
4144
fi
42-
cargo_version="$(sed -n 's/^version = \"\\([^\"]*\\)\"$/\\1/p' Cargo.toml | head -n 1)"
45+
cargo_version="$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')"
4346
if [ "$cargo_version" != "$version" ]; then
4447
echo "Cargo.toml version ${cargo_version} does not match tag ${version}" >&2
4548
exit 1
@@ -61,11 +64,12 @@ jobs:
6164
path: dist/keyclaw-v${{ steps.version.outputs.value }}-${{ matrix.target }}.tar.gz
6265
if-no-files-found: error
6366

64-
publish-draft:
65-
name: Publish Draft Release
66-
runs-on: ubuntu-latest
67+
publish-release:
68+
name: publish release
69+
runs-on: ubuntu-22.04
6770
needs: package
68-
71+
outputs:
72+
version: ${{ steps.version.outputs.value }}
6973
steps:
7074
- uses: actions/checkout@v4
7175
- name: Derive release version
@@ -86,22 +90,63 @@ jobs:
8690
- name: Generate SHA256SUMS
8791
shell: bash
8892
run: |
89-
mapfile -t archives < <(find dist -maxdepth 1 -type f -name "keyclaw-v${{ steps.version.outputs.value }}-*.tar.gz" -printf '%f\n' | sort)
90-
if [ "${#archives[@]}" -ne 3 ]; then
91-
echo "expected 3 release archives, found ${#archives[@]}" >&2
92-
exit 1
93-
fi
94-
(
95-
cd dist
96-
sha256sum "${archives[@]}" > SHA256SUMS
97-
)
93+
cd dist
94+
sha256sum keyclaw-v${{ steps.version.outputs.value }}-*.tar.gz > SHA256SUMS
9895
- name: Verify release artifact contract
9996
shell: bash
10097
run: scripts/verify-release-contract.sh "${{ steps.version.outputs.value }}" dist
10198
- uses: softprops/action-gh-release@v2
10299
with:
103-
draft: true
100+
generate_release_notes: true
104101
files: |
105102
dist/*.tar.gz
106103
dist/SHA256SUMS
107104
fail_on_unmatched_files: true
105+
106+
publish-homebrew:
107+
name: publish homebrew formula
108+
runs-on: ubuntu-22.04
109+
needs: publish-release
110+
steps:
111+
- uses: actions/checkout@v4
112+
- uses: actions/download-artifact@v4
113+
with:
114+
path: dist
115+
pattern: release-*
116+
merge-multiple: true
117+
- name: Generate SHA256SUMS
118+
shell: bash
119+
run: |
120+
cd dist
121+
sha256sum keyclaw-v${{ needs.publish-release.outputs.version }}-*.tar.gz > SHA256SUMS
122+
- name: Verify release artifact contract
123+
shell: bash
124+
run: scripts/verify-release-contract.sh "${{ needs.publish-release.outputs.version }}" dist
125+
- name: Render Homebrew formula
126+
shell: bash
127+
run: |
128+
scripts/render-homebrew-formula.sh \
129+
"${{ needs.publish-release.outputs.version }}" \
130+
dist \
131+
Formula/keyclaw.rb
132+
ruby -c Formula/keyclaw.rb
133+
- uses: actions/checkout@v4
134+
with:
135+
repository: GuthL/homebrew-tap
136+
ref: main
137+
token: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
138+
path: homebrew-tap
139+
- name: Update tap formula
140+
shell: bash
141+
run: |
142+
install -D -m 644 Formula/keyclaw.rb homebrew-tap/Formula/keyclaw.rb
143+
cd homebrew-tap
144+
if git diff --quiet -- Formula/keyclaw.rb; then
145+
echo "formula already up to date"
146+
exit 0
147+
fi
148+
git config user.name "github-actions[bot]"
149+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
150+
git add Formula/keyclaw.rb
151+
git commit -m "keyclaw ${{ needs.publish-release.outputs.version }}"
152+
git push origin HEAD:main

‎.gitignore‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*.swp
44
*.swo
55
*.bak
6+
*.log
67

78
# Environment files
89
.env
@@ -13,12 +14,16 @@ target/
1314

1415
# Local binaries
1516
keyclaw
17+
dist/
1618

1719
# Generated CA certs (machine-specific)
1820
certs/
1921

22+
# Local runtime state
23+
.keyclaw/
24+
2025
# Internal docs
21-
docs/
26+
# docs/ is tracked; tests depend on docs/plans/
2227

2328
# Git worktrees
2429
.worktrees/

0 commit comments

Comments
 (0)