PHPackages certamesh/gaze-laravel - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. certamesh/gaze-laravel ActiveLibrary[Security](/categories/security) certamesh/gaze-laravel ====================== Redact PII, PHI & secrets before they reach OpenAI/Anthropic/Gemini — one Gaze::clean()/Gaze::restore() call. Reversible, signed-encrypted pseudonymization for Laravel LLM & agent pipelines (GDPR/EU AI Act). v0.13.0(1mo ago)012Apache-2.0PHPPHP ^8.2CI passing Since May 8Pushed 1mo agoCompare [ Source](https://github.com/CertaMesh/gaze-laravel)[ Packagist](https://packagist.org/packages/certamesh/gaze-laravel)[ Docs](https://github.com/CertaMesh/gaze-laravel)[ GitHub Sponsors](https://github.com/CertaMesh)[ RSS](/packages/certamesh-gaze-laravel/feed)WikiDiscussions main Synced 1w ago READMEChangelog (10)Dependencies (14)Versions (15)Used By (0) gaze-laravel ============ [](#gaze-laravel) [![Latest Stable Version](https://camo.githubusercontent.com/37bef7c1a5490903bda84fdac4ee6b3b06ef765572f53f47c0c6f546f5da45cc/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f63657274616d6573682f67617a652d6c61726176656c2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/certamesh/gaze-laravel)[![Total Downloads](https://camo.githubusercontent.com/3db91a462d1745b30ff7cde4392b61ad208510cbd2d2a86168065d4499fff556/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f63657274616d6573682f67617a652d6c61726176656c2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/certamesh/gaze-laravel)[![PHP Version](https://camo.githubusercontent.com/0100080e7a3c6da829b39a6c0f6a74d7ef6bf68076a7772216e99ea52495a8af/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253545382e322d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/0100080e7a3c6da829b39a6c0f6a74d7ef6bf68076a7772216e99ea52495a8af/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253545382e322d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)[![Laravel Version](https://camo.githubusercontent.com/7bed4d7490f79074703bd85ec8e1d6e320e70c4787418f5bacbbe7e1c8383dd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d3131253230253743253743253230313225323025374325374325323031332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/7bed4d7490f79074703bd85ec8e1d6e320e70c4787418f5bacbbe7e1c8383dd8/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d3131253230253743253743253230313225323025374325374325323031332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465)[![Tests](https://camo.githubusercontent.com/d5acbbc9454647ac15d5438801f633b2226111c4b71060fcdbf86f2c0c4cd6f8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f43657274614d6573682f67617a652d6c61726176656c2f746573742e796d6c3f6272616e63683d6d61696e266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/CertaMesh/gaze-laravel/actions/workflows/test.yml)[![License](https://camo.githubusercontent.com/c2feb0c90974bffe5636c61845ad76be948afe8dd0a8c74f35d82af653d83ca4/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f43657274614d6573682f67617a652d6c61726176656c3f7374796c653d666c61742d737175617265)](https://github.com/CertaMesh/gaze-laravel/blob/main/LICENSE) > Pseudonymize PII / PHI / secrets before they cross the LLM boundary — one `Gaze::clean()` call out, `Gaze::restore()` back, fully reversible owner-side. ``` use CertaMesh\Gaze\Facades\Gaze; // 1. Strip PII / PHI / secrets before the prompt leaves your app. $session = Gaze::clean($request->input('body')); // 2. Send only pseudonymized text across the model boundary. $reply = $llm->complete($session->cleanText); // 3. Restore the real values owner-side, once the model has replied. return Gaze::restore($session, $reply); ``` The model never sees real data, yet your app restores it losslessly — tokens map back through a signed, encrypted-at-rest session blob. The same call runs inside queues and long-lived agent loops, not just a single HTTP request, and subprocess failures arrive as typed, exit-bucketed exceptions. `gaze-laravel` is the Laravel adapter for the [`gaze`](https://github.com/CertaMesh/gaze)CLI contract. Detection logic lives upstream in Rust — this package never re-implements pseudonymization in PHP. Contents -------- [](#contents) - [Requirements](#requirements) - [Installation](#installation) — **start here** - [Usage](#usage) - [How is this different?](#how-is-this-different-from-regex--generic-anonymization-libraries) - [Advanced surfaces](#advanced-surfaces) - [Documentation](#documentation) - [Security](#security) Requirements ------------ [](#requirements) - PHP `^8.2` - Laravel `^11.0 || ^12.0 || ^13.0` - The `gaze` binary — `gaze:install` fetches the pinned build for you (see below), or supply your own on `PATH`, in `vendor/bin/gaze`, or via `GAZE_BINARY`. Installation ------------ [](#installation) Two steps: ``` composer require certamesh/gaze-laravel php artisan gaze:install ``` `php artisan gaze:install` is the canonical setup path. It provisions the app end-to-end and finishes on a `gaze:doctor` green-check: - downloads the **pinned gaze binary** into `vendor/bin/`, - publishes the **config** and writes a sane default **`policy.toml`** (never clobbering one you've already edited), - optionally installs the **NER model** (~184 MB, ONNX-backed), - optionally wires a **safety-net backend** (OPF or Kiji). It is idempotent — safe to re-run. A failed run rolls `.env` back to its pre-install state. ### Non-interactive / CI [](#non-interactive--ci) Headless runs skip every prompt; the safety-net defaults to `none` unless you opt in: ``` php artisan gaze:install --no-interaction --safety-net=opf ``` Common flags (`php artisan gaze:install --help` lists them all): FlagEffect`--skip-binary`Don't download the gaze binary`--skip-ner`Don't download the NER model`--safety-net=opf|kiji|none`Pick the safety-net backend non-interactively`--force`Re-run already-done steps (re-download binary, re-fetch NER)`--force-policy`Also overwrite an existing `policy.toml` (destructive — off by default)`--no-doctor`Skip the final `gaze:doctor` gate### Sub-commands [](#sub-commands) The umbrella composes three standalone commands you can run on their own for finer control: - `gaze:install:binary` — install the pinned gaze binary into `vendor/bin/`. - `gaze:install:ner` — download the pinned ONNX NER model and wire `policy.toml`(legacy alias: `gaze:install-ner`). - `gaze:install:safety-net` — wire an `opf` or `kiji` backend into `.env`. ### Automating the binary install (optional) [](#automating-the-binary-install-optional) `gaze:install` is explicit by design — nothing runs on `composer install` or `composer update`. Adopters who want the old auto-download behaviour back (the binary refreshed after every Composer update, no plugin) can wire the Composer-context installer into a `post-update-cmd` script in their app's `composer.json`: ``` "scripts": { "post-update-cmd": [ "CertaMesh\\Gaze\\Install\\BinaryInstaller::postInstall" ] } ``` Set `GAZE_SKIP_BINARY_DOWNLOAD=1` to suppress that fetch (e.g. in CI, where the binary is provisioned separately). The `GAZE_VERSION` / `GAZE_RELEASE_BASE`overrides and the full config reference live in [Configuration](./docs/reference/configuration.md). **New here?** Walk through the [getting started guide](./docs/tutorials/getting-started.md). Usage ----- [](#usage) ``` use CertaMesh\Gaze\Facades\Gaze; $session = Gaze::clean($request->input('body')); $reply = $llm->complete($session->cleanText); return Gaze::restore($session, $reply); ``` See [`examples/clean-before-openai.php`](./examples/clean-before-openai.php) for a runnable clean → OpenAI → restore example. ### Per-rule detection entries [](#per-rule-detection-entries) `GazeSession::$entries` exposes each tokenized span as a readonly `Entry` DTO (`class`, `raw`, `token`, `family`). The array is empty for upstream releases that don't surface the field, so consumers can always iterate safely: ``` foreach ($session->entries as $entry) { logger()->info('detected', [ 'class' => $entry->class, 'token' => $entry->token, 'family' => $entry->family, ]); } ``` See [Exceptions](./docs/reference/exceptions.md) for the exit-bucket reference and [Testing](./docs/how-to/testing.md) for fakes, assertions, and integration setup. How is this different from regex / generic anonymization libraries? ------------------------------------------------------------------- [](#how-is-this-different-from-regex--generic-anonymization-libraries) Regex / generic anonymization libs`gaze-laravel`**Detection**Hand-maintained PHP regex, usually English-centricUpstream Rust `gaze` — NER + validated rulepacks + locale packs, never re-implemented in PHP**Reversibility**One-way redaction; the original is goneTokens map back owner-side through a signed, encrypted-at-rest session blob**Failures**Generic exceptions or silent pass-throughTyped exceptions bucketed by exit class (caller / config / integrity / infra)**Runtime fit**Built for a single HTTP requestQueue-aware, with a long-lived daemon for multi-turn agent loops**Not what you're after?** This is *not* in-process PHP detection — the Rust crate is the source of truth — and *not* a generic subprocess wrapper; it is specific to `gaze`. See the [North Star non-goals](./docs/NORTH_STAR.md#non-goals). Advanced surfaces ----------------- [](#advanced-surfaces) Opt-in surfaces — reach for them once the basic clean / restore round-trip is in place: - **[HTTP proxy daemon](./docs/how-to/proxy-daemon.md)** — pseudonymizes requests bound for OpenAI / Anthropic / Gemini and restores their replies. - **[JSONL stdio daemon](./docs/how-to/daemon.md)** — low-latency `Gaze::daemon()`runtime for agent loops and worker queues, with no per-turn binary startup. - **[Kiji safety-net backend](./docs/how-to/safety-net.md)** — Tier 2.5 DistilBERT NER subprocess for higher-recall Pass-3 leak detection. Documentation ------------- [](#documentation) - [Documentation index](./docs/README.md) - [Getting started](./docs/tutorials/getting-started.md) - [Configuration](./docs/reference/configuration.md) - [Architecture](./docs/explanation/architecture.md) - [NER detection](./docs/explanation/ner.md) - [Blob lifecycle](./docs/explanation/blob-lifecycle.md) - [Security model](./docs/explanation/security.md) - [Exceptions](./docs/reference/exceptions.md) - [Diagnostics](./docs/reference/diagnostics.md) - [Testing](./docs/how-to/testing.md) - [Queue integration](./docs/how-to/queue-integration.md) - [Retry discipline](./docs/how-to/retry.md) - [Livewire integration](./docs/how-to/livewire-integration.md) - [Conversational-loop patterns](./docs/how-to/conversational-loops.md) - [Operations](./docs/how-to/operations.md) - [Audit query / export](./docs/how-to/audit-query-export.md) - [Proxy daemon](./docs/how-to/proxy-daemon.md) - [Daemon (JSONL stdio)](./docs/how-to/daemon.md) - [SafetyNet (OPF + Kiji)](./docs/how-to/safety-net.md) - [Upgrading & migrations](./UPGRADING.md) - [Upstream coverage](./docs/reference/upstream-coverage.md) Security -------- [](#security) Session blobs are encrypted at rest with Laravel's encrypter, keyed by `GAZE_ENCRYPTION_KEY` or `APP_KEY`. Only the pseudonymized `$session->cleanText`should cross the model boundary; restore happens owner-side. See the [Security model](./docs/explanation/security.md) for guarantees, responsibilities, and compliance boundaries. Known limitations ----------------- [](#known-limitations) - Pre-built binaries currently cover Linux x86\_64 and macOS arm64. Intel Mac users must install `gaze` from source and set `GAZE_BINARY`. - NER model artifacts are not bundled in the Composer package. `gaze:install`fetches them on demand (or run `gaze:install:ner` directly); pass `--skip-ner`to defer. License ------- [](#license) Apache-2.0 — see [LICENSE](./LICENSE). ### Health Score 39 — LowBetter than 84% of packages Maintenance90 Actively maintained with recent releases Popularity7 Limited adoption so far Community9 Small or concentrated contributor base Maturity44 Maturing project, gaining track record Bus Factor1 Top contributor holds 81.3% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~5 days Recently: every ~12 days Total 13 Last Release 45d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/10154100?v=4)[Krishan König](/maintainers/Naoray)[@Naoray](https://github.com/Naoray) --- Top Contributors [![Naoray](https://avatars.githubusercontent.com/u/10154100?v=4)](https://github.com/Naoray "Naoray (113 commits)")[![lord-eagle](https://avatars.githubusercontent.com/u/2154876?v=4)](https://github.com/lord-eagle "lord-eagle (23 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (3 commits)") --- Tags aianonymizationcomposer-plugindata-privacygdprlaravelllmphppiipii-redactionlaravelaiopenaisecretsagentsGeminiredactionllmanthropicgdprcomplianceprivacyanonymizationpiiphipseudonymizationdlpeu-ai-act ### Code Quality TestsPest Static AnalysisPHPStan Code StyleLaravel Pint Type Coverage Yes ### Embed Badge ![Health badge](/badges/certamesh-gaze-laravel/health.svg) ``` [![Health](https://phpackages.com/badges/certamesh-gaze-laravel/health.svg)](https://phpackages.com/packages/certamesh-gaze-laravel) ``` ### Alternatives [laravel/ai The official AI SDK for Laravel. 1.1k4.6M331](/packages/laravel-ai)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 79227.1M238](/packages/laravel-mcp)[illuminate/queue The Illuminate Queue package. 20433.0M1.8k](/packages/illuminate-queue)[laravel/horizon Dashboard and code-driven configuration for Laravel queues. 4.2k99.8M356](/packages/laravel-horizon)[laravel/sail Docker files for running a basic Laravel application. 1.9k212.4M1.5k](/packages/laravel-sail)[spatie/laravel-health Monitor the health of a Laravel application 88212.7M189](/packages/spatie-laravel-health) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)