Documentation
¶
Overview ¶
ABOUTME: Registry of every environment variable Tracker reads, with the trust tier each may be set from. ABOUTME: The .env loader, doctor and the provider-key tables consult it instead of keeping their own lists (#659).
ABOUTME: Records which .env file supplied (or tried to supply) each environment variable. ABOUTME: The loader writes it; doctor reads it to say "from shell" / "from <file>" / "ignored".
ABOUTME: The registry entries — every environment variable Tracker reads, plus the implicit names children honor. ABOUTME: Add a row here when adding an os.Getenv; TestEveryGetenvLiteralIsRegistered fails otherwise.
Index ¶
- func AllowedFrom(name string, src Source) bool
- func AppliedFrom(name string) string
- func ProviderBaseURLVars() []string
- func ProviderKeyVars() []string
- func RecordApplied(name, file string)
- func RecordSkipped(name, file, reason string)
- func ResetProvenance()
- type Origin
- type Purpose
- type Source
- type Var
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowedFrom ¶
AllowedFrom reports whether a file of trust tier src may set name. An unregistered name is never allowed from a file.
func AppliedFrom ¶
AppliedFrom returns the file that supplied name's current value, or "" when the value came from the shell (or is unset).
func ProviderBaseURLVars ¶
func ProviderBaseURLVars() []string
ProviderBaseURLVars returns every per-provider *_BASE_URL override, sorted.
func ProviderKeyVars ¶
func ProviderKeyVars() []string
ProviderKeyVars returns every provider credential name (*_API_KEY), sorted. It is the single list the provider-key tables in llm, tracker, cmd/tracker and the claude-code / ACP backends must agree with.
func RecordApplied ¶
func RecordApplied(name, file string)
RecordApplied notes that name was set from file. A later file that sets the same name replaces the record.
func RecordSkipped ¶
func RecordSkipped(name, file, reason string)
RecordSkipped notes that file tried to set name and the loader refused.
func ResetProvenance ¶
func ResetProvenance()
ResetProvenance clears the record. The loader calls it at the start of a load; tests call it between cases.
Types ¶
type Origin ¶
type Origin struct {
// Name is the variable name.
Name string
// File is the .env path the value came from.
File string
// Applied is true when the value was set into the process environment.
Applied bool
// Reason explains a skip (empty when Applied).
Reason string
}
Origin is one loader decision about a variable from a file.
type Purpose ¶
type Purpose string
Purpose classifies what a variable controls. The invariant tests in this package tie each purpose to the most permissive Source it may have.
const ( // Credential is a provider API key or similar secret Tracker presents to a service. Credential Purpose = "credential" // SecuritySwitch opts out of a default protection (credential scrub, key strip, exit-code contract). SecuritySwitch Purpose = "security_switch" // NetworkDestination decides where Tracker (or a child) sends traffic, or which TLS roots it trusts. NetworkDestination Purpose = "network_destination" // TrustedState locates state Tracker treats as authoritative (secure log, checkpoint, config). TrustedState Purpose = "trusted_state" // SubprocessTarget decides which binary or library a child process runs. SubprocessTarget Purpose = "subprocess_target" // Cost tunes spend accounting or budgets. Cost Purpose = "cost" // UX tunes output, notifications and other non-security behavior. UX Purpose = "ux" // Output is set BY Tracker for its children; it is never an input. Output Purpose = "output" // RunIdentity names the run, instance or pane a process reports as. RunIdentity Purpose = "run_identity" )
Purpose values.
type Source ¶
type Source int
Source is the most permissive place a variable may be set from. The order is by trust, least to most permissive: a variable with Source ConfigEnv may come from the shell or the config file, never from a project .env.
const ( // ShellOnly: only the process environment Tracker was started with. ShellOnly Source = iota // ConfigEnv: the shell or the operator's ~/.config/tracker/.env. ConfigEnv // ProjectEnv: the shell, the config file, or <workdir>/.env. ProjectEnv )
Source values, ordered from least to most permissive.
type Var ¶
type Var struct {
// Name is the exact variable name.
Name string
// Purpose classifies what the variable controls.
Purpose Purpose
// Source is the most permissive file that may set it.
Source Source
// Doc is a one-line description.
Doc string
// Since is the release that introduced the variable ("vX.Y.Z", or
// "unreleased" for a variable added since the last tag).
Since string
// Implicit marks a name Tracker never reads itself but Go, libc or a
// child process honors (proxies, TLS roots, dynamic-linker hooks, PATH).
Implicit bool
}
Var is one registered environment variable.
Source Files