ghuntley / preflight

# preflight
**A local proxy that scans LLM requests and attachments for secrets before they reach the model.**
 [code] 
Someone pastes an `.env` file? Detected credentials become stable placeholders and the request continues. A screenshot or PDF contains a key? preflight decodes it, runs local extraction and OCR, and sanitizes it where supported. When inspection or safe rewriting is impossible, the request stays grounded.
---
## Why
Coding agents read source files, shell output, screenshots, and documents. Secrets can arrive through any of them. preflight sits between the harness and underclass, inspecting the outbound copy before inference starts:
- **One base URL change** — keep the supported OpenAI HTTP endpoints, tool-call structure, session headers, and response streams.
- **Redact by default** — replace detected secrets with `[REDACTED:rule-id]` so ordinary pasted-key incidents do not stop the agent.
- **Attachments get inspected too** — decode images and PDFs locally; scan extracted text, metadata, barcodes, and OCR output.
- **No repeated OCR tax** — identical attachments reuse completed inspection results while their scope and inspection profile remain the same.
- **No generic randomness detector** — prompts and source dumps are entropy soup. Default rules use recognizable credential shapes.
- **Nothing forwarded halfway through inspection** — the whole request is checked before it goes to underclass.
## Quick start
With underclass running on `127.0.0.1:8080`, start preflight with its complete document-processing toolchain:
 [code] 
Point the harness at:
 [code] 
Keep using the existing underclass API key. By default, preflight passes authorization through. You can also configure separate client-facing and upstream credentials.
For a local checkout:
 [code] 
Building all binaries also builds the Rust attachment worker. Startup checks the sandboxed native toolchain before the proxy becomes ready.
## How inspection works
- **Parse first.** Walk decoded JSON string leaves, including messages, instructions, tool results, and nested JSON tool arguments. Duplicate object keys are rejected.
- **Match structured content.** Each text unit goes through keyword filtering, a Gitleaks-derived regex, optional entropy filtering, and the trusted allowlist. Ordered text parts and wrapped JWTs get mapped reconstruction passes.
- **Inspect attachments locally.** Resolve their bytes, decode them, extract text, render PDF pages, and run OCR. External attachment URLs never receive the underclass credential.
- **Apply one request-wide decision.** Redact supported spans, rebuild affected artifacts, or reject the request. Rebuilt attachments are inspected again before approval.
- **Forward approved content.** Enforcing modes send the exact approved bytes or sanitized replacement. Unchanged clean requests preserve their original body bytes; underclass's response streams through.
Preflight does not retry inference requests. Underclass owns provider routing and fai