feat(hush): add a broker daemon that alone holds the BWS token

feat(hush): add a broker daemon that alone holds the BWS tokenAojdevStudio/agentic-utilities #75 · 3 diagrams

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team

100%

01 / 06Broker daemon added for token custodyA background root daemon isolates vault tokens from agent inspection. checks token file permissions and serves requests over a Unix socket in +133 −0.
02 / 06Client queries catalog over socketThe client sends length-prefixed JSON requests and receives metadata. connects to the socket and calls , defined in +89 −0.
03 / 06Daemon verifies caller and writes auditKernel peer credentials identify callers and write to an append-only log. reads credentials and calls on .
04 / 06Backend drops secrets before responseThe backend fetches vault data but discards values from catalog outputs. calls run bws secret list on in +269 −0.
05 / 06Hush CLI falls back if daemon is offlineCommands check the socket first and use direct calls if unavailable. queries or calls directly in +31 −0.
06 / 06Everything this change touchedThe broker daemon, socket client, backend, and audit log in one picture.

esc to leave