v0.4.0: 7-Layer Zero-Plaintext Armor, Dynamic Canary Honey-Tokens & Vibe Coder Speedrun

Hetzer v0.4.0: 7-Layer Zero-Plaintext Armor, Dynamic Canary Honey-Tokens & Vibe Coder Speedrun 🛡️

We are thrilled to release Hetzer v0.4.0, a major evolutionary leap in client-side credential protection for autonomous AI coding agents and developers.

Hetzer v0.4.0 expands the defense boundary from 5 to 7 layers of defense, introduces Dynamic Canary Honey-Tokens for instant intrusion tripping, isolates vault master keys completely outside the project workspace, and debuts npx hetzer protect—a 1.5-second one-command armor designed specifically for the vibe coding generation.

---

🌟 What's New in v0.4.0

1. 🛡️ The 7-Layer Defense Matrix

• Dynamic Canary Honey-Tokens (hetzer canary setup):
  • Deploys decoy canary honey-tokens (HETZER_CANARY_TOKEN=secretRef:canary-token).
  • Any attempt by autonomous agents, malicious scripts, or prompt injections to extract or dump this token triggers an immediate emergency session freeze (process.exit(43)), appends forensic intrusion details to data/hetzer-incidents.log, and logs an audit event to SQLite.
• Master Key Workspace Isolation (hetzer creds isolate-key):
  • Strips HETZER_GRIMOIRE_KEY from the repository .env file and relocates it to ~/.hetzer/grimoire.key (POSIX mode 0600).
  • Guarantees that autonomous AI agents running inside the workspace encounter ZERO master decryption keys.
• Out-of-Band (OOB) Native OS Modal Confirmation (--confirm-ui):
  • Optional GUI confirmation dialog (Windows Forms / macOS AppleScript / Linux Zenity) that breaks out of the terminal stream, requiring physical human interaction before secret revelation.
• 5-Generation Process Tree Ancestry Guard:
  • Traverses up to 5 parent process generations (PPID) to block autonomous agents in YOLO/Turbo mode from calling hetzer creds reveal programmatically.
• Real-Time Output Stream Interceptor & Anti-Reflection:
  • In-memory regex scrubbing (< 2ms) of child process stdout/stderr before context emission.
  • Blocks reflection commands (printenv, env, export, docker inspect, inline os.environ scripts).
• Strict Scoped Execution:
  • hetzer exec --allow <id> [--strict] -- <cmd> decrypts only specified credentials into child process RAM.

2. ⚡ The Vibe Coder Speedrun: npx hetzer protect

• One single command that arms your entire repo in 1.5 seconds:
  • Installs Universal Skills to all detected AI agents (Cursor, Claude, Antigravity, Cline, OpenCode).
  • Installs the Git Pre-Commit Guard (blocks leaked tokens in < 2ms).
  • Automatically vaults plaintext .env keys into AES-256-GCM Grimoire Vault (secretRef:<id>).
• "Nothing to Lose" Promise:
  • 0 Docker containers required
  • 0 external NPM dependencies
  • 0 background RAM footprint
  • < 2ms latency (pure V8 DFA regular expressions)
• Dedicated guide and manifesto published at docs/vibe-coders.md.

3. 🔬 Complete System Logic & Enterprise Value Benchmark

• docs/value-benchmark.md: Quantitative performance and value analysis against HashiCorp Vault, Doppler, and Lakera Guard, mapped to PCI-DSS v4.0.1, NIST SP 800-218 (SSDF), OWASP Top 10 for LLMs (2025/2026), and Indonesian banking standards (OJK SEOJK 29/2022, PBI 23/2021).
• docs/system-logic-and-progress.md: Canonical architecture blueprint detailing sub-system logic, execution flows, and edge-case mitigations.

4. 🧪 Test Suite & Code Quality

• Expanded test suite from ~82 tests to 104 tests across 28 test files (node scripts/check.mjs).
• 100% passing (103 passed, 1 skipped for Windows chmod).

---

🚀 Quick Install & Upgrade

Run instantly with npx:

npx hetzer protect

Install globally via GitHub Packages:

npm install -g @agunggnn/hetzer@0.4.0 --registry=https://npm.pkg.github.com

Or via standard NPM Registry:

npm install -g @agunggnn/hetzer@0.4.0

---

Full Changelog: v0.3.1...v0.4.0