Documentation
¶
Overview ¶
Package secret masks credentials in text before it is written to the vault.
It started in internal/ingest, where a transcript is someone else's agent talking to a shell and routinely carries a pasted API key. But an agent writing a checkpoint, a working note or a memory pastes the same keys — "verified: the upload works with GITHUB_TOKEN=ghp_…" — and those paths went to the vault verbatim (#209). It is a leaf package so session and memory can use it without importing ingest, which imports them.
Two strengths, because the two kinds of text differ. A transcript is mostly machine output nobody chose to keep, so ingest also masks anything that merely looks random (MaskAll). An agent's own write is prose it chose, full of long mixed-case words — test names, module paths, identifiers with digits in them — that the entropy check can take for a key (#210 spares the plainest of them, not all) and that are the whole content of a verified line; there only a known credential shape is masked (Mask).
Index ¶
Constants ¶
const Marker = "[REDACTED]"
Marker replaces what was masked.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Redaction ¶
type Redaction struct {
Field string // field the token was found in ("Commands", "Verified", ...)
Reason string // why it matched
}
Redaction records one secret-shaped token that was masked, so the caller can announce it instead of leaving the fix invisible.
Source Files