Cloak
During high-pressure production outages, developers frequently paste crash logs, database connection URIs, and JWT headers directly into AI chat windows, turning debugging sessions into critical security vulnerabilities. Cloak sits directly between terminal inputs, the clipboard, and AI models: it sniffs and tokenizes secrets into structurally valid synthetic mocks, consults Gemma, and deterministically inverts placeholders back to real credentials locally before terminal execution.
Syntax-Preserving Synthetic Masking
Unlike naive redaction tools that drop destructive [REDACTED] tags that corrupt JSON parsing and strip critical context, Cloak substitutes secrets with syntactically compatible synthetic mocks. It preserves port numbers, query strings, and database schemas so AI models have precise technical structure to diagnose connection errors and stack traces accurately.
Zero-Knowledge In-Memory Vault & Local Rehydration
Maintains an ephemeral SessionVault strictly in RAM that is wiped immediately upon command completion. After Gemma generates the diagnosis and terminal remediation command, the local rehydration engine automatically inverts synthetic placeholders back into genuine host secrets, returning a ready-to-run terminal fix without sensitive secrets ever leaving localhost.
Dual Runtime & Unified Unix Workflow
Seamlessly routes between cloud-based Gemma 4 (31B and 26B-A4B via Google GenAI SDK) and 100% offline local inference via Ollama (gemma2:2b). Operates as an interactive CLI (cloak ask), a global clipboard monitor (cloak clip/restore), and a native Unix pipeline (kubectl logs | cloak ask), providing zero-telemetry defense across development workflows.