An agent that reads your screen and your files will eventually read a credential, and the moment it does, that credential is in a prompt going to a third party. The defence is to redact before the prompt leaves rather than to hope the model behaves, and the second defence is to stop the agent following a hostile link, because a page that can make the agent fetch a URL can exfiltrate whatever is in its context. Grux OS puts both jobs in a separate Swift package with 125 tests, zero dependencies and an MIT licence, so the riskiest code is small enough to audit and usable without the app around it. The package publishes 6 GitHub advisories against its own earlier releases, 2 of them critical.
| Job | The failure it prevents | Where it runs |
|---|---|---|
| Secret redaction | A key read off your screen or out of a file ending up in a prompt | Before anything is sent |
| URL policy, SSRF | The agent following a link that reaches loopback, a private range or a redirect chain that gets there | Before any fetch |
Six of the package's first nine tags failed to redact something. Each one has a published advisory naming exactly what leaked, and the tags stay resolvable, so anyone pinned to a bad version gets told rather than staying quietly broken. A redaction library with no advisory history is not a library that never failed. It is a library nobody checked.
The failures were the instructive kind: a path heuristic that discarded a percentage of AWS secret access keys, a NAT64 route that reached loopback, a denylist that failed open unless its entries were bare hosts, a forgeable prompt injection fence. Those are the bugs a test suite written after the fact would not have thought of.
It is a Swift package with no dependencies of its own, so adding it puts exactly one node in your graph. Grux OS depends on it rather than carrying a copy, and Package.resolved shows that rather than a README claiming it.
.package(url: "https://github.com/dotcomjack/grux-guardrails.git", from: "0.8.2")