Metadata-Version: 2.4
Name: oneport-debug-local
Version: 0.2.0
Summary: Air-gapped AI debugger for banking, healthcare, and defense: runs entirely on-premise via Ollama/vLLM/llama.cpp with network enforcement to guarantee zero data exfiltration
Project-URL: Homepage, https://github.com/oneport-debug/oneport-debug
Project-URL: Repository, https://github.com/oneport-debug/oneport-debug
Project-URL: Bug Tracker, https://github.com/oneport-debug/oneport-debug/issues
Project-URL: Changelog, https://github.com/oneport-debug/oneport-debug/blob/main/CHANGELOG.md
Author: OnePort Debug Contributors
License: Apache-2.0
Keywords: air-gap,banking,compliance,enterprise,hipaa,local-llm,ollama,on-premise,vllm
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Debuggers
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: click>=8.1.7
Requires-Dist: httpx>=0.27.0
Requires-Dist: oneport-debug-core>=0.1.0
Requires-Dist: pydantic>=2.9.0
Requires-Dist: pyyaml>=6.0.2
Requires-Dist: rich>=13.8.0
Description-Content-Type: text/markdown

# oneport-debug-local

**Air-gapped AI debugger for regulated industries.** Banks, hospitals, and defense
shops forbid sending any code or logs to external APIs — so Claude Code and ChatGPT
are blocked at the firewall, and developers get no AI debugging. `oneport-local`
runs a debugging agent entirely on-premise against your own Ollama / vLLM / llama.cpp
model, **enforces the air-gap with iptables**, and writes a **tamper-evident audit
trail** that proves zero data left the network.

## Try it in 60 seconds (no GPU, no model, no API key)

```bash
pip install oneport-debug-local
oneport-local demo
```

The demo runs the **real** debugging agent against a materialized buggy repo (driven
by a bundled offline model), shows the **real** iptables rules that would seal the
network, and writes + verifies a **real** hash-chained audit entry:

```
Air-gap compliance preflight
  iptables -A OUTPUT -j DROP
  iptables -I OUTPUT -d localhost -p tcp --dport 11434 -j ACCEPT
  ...
✔ provider=local-inference  ·  hash chain intact
```

## Use it on your own code + on-prem model

```bash
export ONEPORT_MODE=local
export LOCAL_INFERENCE_URL=http://localhost:11434       # Ollama, vLLM, or llama.cpp
export LOCAL_INFERENCE_MODEL=deepseek-coder:6.7b

oneport-local debug src/payment/charge.py --error-log /var/log/app.log
```

The agent reads local files, greps, and runs tests in the workspace — talking only
to your local model. It never makes any other network call.

### Seal the network (provable air-gap)

```bash
sudo -E oneport-local debug src/ --error-log app.log --enforce-network
```

`--enforce-network` applies iptables OUTPUT rules that **DROP all outbound traffic
except the allowlisted local inference endpoint**, then removes them when done.

> **Honesty by design:** enforcement requires **Linux + root**. On any other host the
> tool records `enforcement_status=skipped:*` and prints a warning — it will **never**
> write `network_enforced=true` for an air-gap it didn't actually seal. The audit log
> always reflects what really happened.

### Prove compliance

Every analysis writes a hash-chained entry to the audit log. Verify it anytime:

```bash
oneport-local verify-compliance --log /var/log/oneport-debug/audit.jsonl
```

This checks (a) every session used local inference only — any cloud provider is a
violation — and (b) the **hash chain is intact**, so any edit, deletion, or insertion
of a past entry is detected. Required for SOX §404, HIPAA §164.312(b), PCI-DSS 10.5,
ISO 27001 A.12.4.

```bash
oneport-local models --server http://localhost:11434   # list available local models
```

### Configuration

| Variable | Meaning |
|---|---|
| `ONEPORT_MODE=local` | Forces local inference; never falls back to cloud |
| `LOCAL_INFERENCE_URL` | Ollama/vLLM/llama.cpp endpoint (must be in the host allowlist) |
| `LOCAL_INFERENCE_MODEL` | Model name, e.g. `deepseek-coder:6.7b` |
| `AUDIT_LOG_PATH` | Where the hash-chained audit trail is written |
| `AUDIT_HMAC_KEY` | Signing key for the audit chain (**set this in production**) |

The local-inference provider refuses to connect to any non-allowlisted host — a
misconfigured URL fails closed rather than silently reaching the internet.

## Why an agent, not just a prompt

The agent guards its own sandbox: file reads are confined to the workspace (path
traversal is blocked), and destructive commands (`rm`, `git push`, `curl`, `pip
install`, …) are refused. It's built to run unattended inside a regulated network.

## License

Apache-2.0
