Documentation
¶
Overview ¶
Package subprocess provides bounded, redacted subprocess diagnostics.
Index ¶
Constants ¶
const ( // MaxCapturedLines and MaxCapturedBytes bound each captured stream. MaxCapturedLines = 200 MaxCapturedBytes = 1 << 20 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Buffer ¶
type Buffer struct {
// contains filtered or unexported fields
}
Buffer is a bounded, redacting io.Writer for subprocess output.
type Options ¶
type Options struct {
Dir string
Env []string
Stdin io.Reader
Redactor *secrets.Redactor
// SensitiveValues contains secret values that may appear in argv or in
// subprocess output but are not represented by a sensitive environment
// variable. Values are masked before capture and command rendering.
SensitiveValues []string
// OperationID links diagnostics to the semantic operation that spawned
// the command. When empty, Run derives it from ctx.
OperationID string
}
Options configures a command invocation.
type RedactingWriter ¶
RedactingWriter forwards output after applying redaction. It is useful when a subprocess must stream diagnostics while retaining the same safety policy as captured output.
type Result ¶
type Result struct {
Command []string
DisplayCommand string
OperationID string
Stdout string
Stderr string
ExitCode int
Signal string
Duration time.Duration
Truncated bool
}
Result contains bounded diagnostic output and execution metadata.
func Run ¶
Run executes binary with args and captures bounded, redacted output from both streams. The returned error is the original execution error wrapped with the display-safe command; output remains available in Result.
func RunCommand ¶
RunCommand executes an already-configured command with bounded, redacted stdout and stderr capture. Existing command setup such as an explicit environment, working directory, or stdin is preserved.
func (Result) DiagnosticOutput ¶
DiagnosticOutput returns the useful captured tail for a failed command. Output is already bounded and redacted; when capture reached a limit, the suffix is annotated so callers do not present an incomplete diagnostic as the complete command output.
type StreamingRedactingWriter ¶
type StreamingRedactingWriter struct {
Next io.Writer
Redactor *secrets.Redactor
// contains filtered or unexported fields
}
StreamingRedactingWriter is the chunk-safe variant of RedactingWriter. It retains a short suffix between writes and must be flushed at stream end.
func (*StreamingRedactingWriter) Flush ¶
func (w *StreamingRedactingWriter) Flush() error
Flush forwards the final retained suffix. Callers that stream output should invoke this after the subprocess exits so trailing bytes are not delayed.
Source Files