Crate cleansh_core 

CleanSH Core Library

cleansh-core provides the fundamental, platform-independent logic for data sanitization, redaction, and proactive threat remediation.

Starting with v0.2.0, CleanSH transitions from a passive text filter to an active security partner. It implements a “Self-Healing Engine” that can verify and neutralize leaked secrets in real-time while maintaining zero-latency terminal performance.

Core Architecture

• Sanitization Engines: Locates sensitive patterns using Regex or statistical Entropy.
• Self-Healing Orchestrator: Manages the lifecycle of a detected secret—Verification, Remediation (Revocation), and Global Fingerprint Propagation.
• Triple-Lock Safety: Ensures stability via Pre-flight checks, Confidence-Gating, and a Remediation Governor (Rate-Limiter).

Modules

• config: Defines RedactionRules and RedactionConfig for specifying sensitive patterns.
• sanitizers: Contains engine-specific logic for compiling rules.
• validators: Provides programmatic validation for specific data types.
• redaction_match: Defines data structures for detailed reporting of redaction events.
• engine: Defines the SanitizationEngine trait, enabling a modular design.
• profiles: Defines data structures for user-specified profiles and post-processing.
• audit_log: Defines the structure and logic for writing redaction events to a log file.
• engines: Contains concrete implementations of the SanitizationEngine trait.
• headless: Convenience wrappers for using core engines in a non-interactive mode.
• remediation: (v0.2.0) The Self-Healing framework, including providers and orchestrators.

Usage Example (Proactive Healing)

use cleansh_core::{RedactionConfig, EntropyEngine, HeadlessEngineType, SanitizationEngine}; // <--- Fixed: Added SanitizationEngine trait import
use cleansh_core::remediation::orchestrator::SelfHealingEngine;
use tokio::sync::mpsc;
use std::sync::Arc;

#[tokio::main]
async fn main() -> anyhow::Result<()> {
    let config = RedactionConfig::load_default_rules()?;
    let mut engine = EntropyEngine::new(config)?;

    // 1. Setup the Remediation Channel
    let (tx, rx) = mpsc::channel(100);
     
    // This method requires the SanitizationEngine trait to be in scope
    engine.set_remediation_tx(tx);

    // 2. Initialize the Self-Healing Orchestrator
    // We wrap it in an Arc as required by the 'listen' method for async safety.
    let orchestrator = Arc::new(SelfHealingEngine::new(vec![], None, 5, true, vec![0u8; 32]));
     
    // 3. Start the background listener
    orchestrator.listen(rx);

    Ok(())
}

---

License: MIT OR APACHE 2.0

Re-exports

pub use config::merge_rules;

pub use config::RedactionConfig;

pub use config::RedactionRule;

pub use config::RedactionSummaryItem;

pub use config::RuleConfigNotFoundError;

pub use config::MAX_PATTERN_LENGTH;

pub use errors::CleanshError;

pub use engine::SanitizationEngine;

pub use engines::regex_engine::RegexEngine;

pub use engines::entropy_engine::EntropyEngine;

pub use redaction_match::RedactionLog;

pub use redaction_match::RedactionMatch;

pub use redaction_match::redact_sensitive;

pub use profiles::apply_profile_to_config;

pub use profiles::compute_run_seed;

pub use profiles::DedupeConfig;

pub use profiles::EngineOptions;

pub use profiles::format_token;

pub use profiles::load_profile_by_name;

pub use profiles::PostProcessingConfig;

pub use profiles::ProfileConfig;

pub use profiles::ProfileRule;

pub use profiles::profile_candidate_paths;

pub use profiles::ReportingConfig;

pub use profiles::SamplesConfig;

pub use profiles::sample_score_hex;

pub use profiles::select_samples_for_rule;

pub use audit_log::AuditLog;

pub use headless::headless_sanitize_string;

pub use headless::HeadlessEngineType;

pub use sanitizers::compiler::compile_rules;

pub use sanitizers::compiler::CompiledRule;

pub use sanitizers::compiler::CompiledRules;

pub use remediation::Remediator;

pub use remediation::Remediator as RemediatorTrait;

pub use remediation::RemediationOutcome;

pub use remediation::ConfidenceLevel;

pub use remediation::orchestrator::SelfHealingEngine;

Modules

audit_log

audit_log.rs - Handles the creation and management of a secure, append-only audit log for all redaction events.

config

Configuration management for CleanSH-core.

engine

Defines the core SanitizationEngine trait and related data structures.

engines

This module contains different sanitization engine implementations.

errors

errors.rs - Custom error types for the cleansh-core library.

headless

headless.rs Convenience wrappers for using core engines in headless mode (non-UI). Provides helper functions for a full, one-shot sanitization of strings.

profiles

profiles.rs - Profile configuration, loading, and helpers for CleanSH.

redaction_match

Provides core data structures and utility functions for managing redaction matches and sensitive data logging within the cleansh-core library.

remediation

sanitizers

Core regex sanitization engine for CleanSH.

validators

Programmatic validation functions for specific sensitive data types.